re voila le rapport
ComboFix 09-03-26.03 - yohan 2009-03-26 22:49:42.5 - NTFSx86
Microsoft Windows XP Edition familiale 5.1.2600.3.1252.1.1036.18.1015.477 [GMT 1:00]
Lancé depuis: c:documents and settingsyohanBureauComboFix.exe
Commutateurs utilisés :: c:documents and settingsyohanBureauCFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090325-0] *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
FILE ::
c:windows
lmark2.dat
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:install.exe
c:program filesInternet Explorerfxavx.ini
c:windows
lmark2.dat
c:windowspatch.exe
c:windowssystem32ert
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-26 au 2009-03-26 ))))))))))))))))))))))))))))))))))))
.
2062-12-21 05:05 . 2062-12-21 05:05 3,120 --a------ c:windowsMF_C421.lfa
2062-12-21 05:05 . 2062-12-21 05:05 3,120 --a------ c:windowsMF_C420.lfa
2009-03-24 22:32 . 2009-03-26 17:43 <REP> d-------- c:documents and settingsAll UsersApplication DataNOS
2009-03-20 11:12 . 2009-03-20 11:12 29 --a------ c:documents and settingsyohankoob.bat
2009-03-19 20:01 . 2009-03-19 20:01 <REP> d--hs---- c:documents and settingsLocalServiceIETldCache
2009-03-19 19:29 . 2009-03-19 19:31 <REP> d--h-c--- c:windowsie8
2009-03-19 16:58 . 2009-03-20 11:06 <REP> d-------- c:program filesNavilog1
2009-03-19 11:18 . 2009-03-19 11:18 <REP> d-------- c:program filesCodeStuff
2009-03-17 13:09 . 2009-02-06 18:08 55,152 --a------ c:windowssystem32driversfssfltr_tdi.sys
2009-03-17 13:08 . 2009-03-17 13:08 <REP> d-------- c:program filesMicrosoft Sync Framework
2009-03-17 13:05 . 2009-03-17 13:05 <REP> d-------- c:program filesWindows Live SkyDrive
2009-03-14 02:15 . 2009-03-19 19:31 1,374 --a------ c:windowsimsins.BAK
2009-03-08 14:17 . 2009-03-08 14:17 57,344 --------- c:windowssystem32msrating.dll.mui
2009-03-08 14:17 . 2009-03-08 14:17 2,560 --------- c:windowssystem32mshta.exe.mui
2009-03-08 14:16 . 2009-03-08 14:16 4,096 --------- c:windowssystem32ie4uinit.exe.mui
2009-03-08 14:15 . 2009-03-08 14:15 81,920 --------- c:windowssystem32iedkcs32.dll.mui
2009-03-07 19:03 . 2009-03-07 19:03 <REP> d-------- c:program filesPhotoFiltre
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-26 21:20 --------- d-----w c:program filesMiniCap
2009-03-26 18:09 --------- d-----w c:program filesMalwarebytes' Anti-Malware
2009-03-26 16:42 --------- d-----w c:program filesMessenger Plus! Live
2009-03-26 16:22 --------- d-----w c:documents and settingsAll UsersApplication DataGoogle Updater
2009-03-26 15:49 38,496 ----a-w c:windowssystem32driversmbamswissarmy.sys
2009-03-26 15:49 15,504 ----a-w c:windowssystem32driversmbam.sys
2009-03-25 03:52 --------- d-----w c:documents and settingsyohanApplication DataLimeWire
2009-03-24 21:31 --------- d-----w c:program filesNOS
2009-03-20 09:54 --------- d-----w c:program filesGoogle
2009-03-19 20:49 --------- d-----w c:program filesEPSON
2009-03-19 01:32 --------- d-----w c:documents and settingsyohanApplication DataTuneUp Software
2009-03-19 01:32 --------- d-----w c:documents and settingsAll UsersApplication DataTuneUp Software
2009-03-19 01:10 --------- d-sh--w c:documents and settingsAll UsersApplication Data{55A29068-F2CE-456C-9148-C869879E2357}
2009-03-17 12:09 --------- d-----w c:program filesWindows Live
2009-03-17 12:08 --------- d-----w c:program filesWindows Live Toolbar
2009-03-17 11:47 --------- d-----w c:program filesMicrosoft
2009-03-17 10:09 --------- d-----w c:program filesWindows Live Safety Center
2009-03-15 09:08 --------- d-----w c:program filesSpybot - Search & Destroy
2009-03-13 19:37 --------- d-----w c:program filesFichiers communsAdobe
2009-03-13 19:25 --------- d-----w c:documents and settingsyohanApplication DataSkype
2009-03-13 19:19 --------- d-----w c:program filesLimeWire
2009-03-07 20:22 --------- d-----w c:program filesma-config.com
2009-03-07 20:21 --------- d-----w c:documents and settingsAll UsersApplication Datama-config.com
2009-03-07 19:59 --------- d-----w c:documents and settingsAll UsersApplication DataSpybot - Search & Destroy
2009-02-20 14:01 --------- d-----w c:program filesAscentive
2009-02-19 20:18 --------- d-----w c:documents and settingsernardApplication DataSkype
2009-02-19 20:18 --------- d-----w c:documents and settingsernardApplication DataCoreFTP
2009-02-19 20:17 --------- d-----w c:documents and settingsAll UsersApplication DataYahoo! Companion
2009-02-19 20:17 --------- d-----w c:documents and settingsAll UsersApplication DataNCH Software
2009-02-19 20:17 --------- d-----w c:documents and settingsAll UsersApplication DataAVS4YOU
2009-02-19 20:17 --------- d-----w c:documents and settingsAll UsersApplication Dataavg8
2009-02-19 20:13 --------- d-----w c:documents and settingsyohanApplication DataGlarySoft
2009-02-19 20:01 --------- d--h--w c:program filesInstallShield Installation Information
2009-02-14 22:57 --------- d-----w c:program filesFichiers communsAdobe AIR
2009-02-08 10:42 --------- d-----w c:documents and settingsAll UsersApplication DataWinZip
2009-02-08 10:07 --------- d-----w c:program filesRomStation
2009-02-07 19:40 --------- d-----w c:program filesWindows Live Favorites
2009-02-07 19:37 --------- d-----w c:documents and settingsAll UsersApplication DataWLInstaller
2009-02-07 16:48 --------- d-----w c:program filesWindows Installer Clean Up
2009-02-07 16:48 --------- d-----w c:program filesMSECache
2009-02-06 18:39 308,600 ----a-w c:windowsWLXPGSS.SCR
2009-02-04 13:54 --------- d-----w c:documents and settingsyohanApplication DataskypePM
2009-02-04 13:52 --------- d-----w c:program filesFichiers communsSkype
2009-02-04 13:52 --------- d-----w c:documents and settingsAll UsersApplication DataSkype
2009-02-04 13:52 --------- d-----r c:program filesSkype
2009-02-04 13:46 --------- d-----w c:program filesJava
2009-02-01 20:07 --------- d-----w c:documents and settingsyohanApplication DataDesktopicon
2009-02-01 20:06 --------- d-----w c:program filesFormatFactory
2009-01-30 15:27 --------- d-----w c:documents and settingsyohanApplication DataKC Softwares
2009-01-28 16:28 --------- d-----w c:documents and settingsyohanApplication DataXnView
2009-01-26 01:29 --------- d-----w c:documents and settingsyohanApplication Datavlc
2008-10-12 11:56 41,008 ----a-w c:documents and settingsyohanApplication DataGDIPFONTCACHEV1.DAT
2008-09-16 09:17 41,008 ----a-w c:documents and settingsernardApplication DataGDIPFONTCACHEV1.DAT
2008-07-08 17:51 83,456 ----a-w c:program files1036.MST
2008-07-08 17:51 55,682,048 ----a-w c:program filesPalm.msi
2008-07-03 16:27 1 ----a-w c:documents and settingsyohanSI.bin
2008-02-16 15:01 32 ----a-w c:documents and settingsAll UsersApplication Dataezsid.dat
2007-07-19 21:19 855,886 ----a-w c:program filesAUG2007_d3dx10_35_x64.cab
2007-07-19 21:19 800,467 ----a-w c:program filesAUG2007_d3dx10_35_x86.cab
2007-07-19 21:19 1,803,760 ----a-w c:program filesAUG2007_d3dx9_35_x64.cab
2007-07-19 21:18 44,684 ----a-w c:program filesdxdllreg_x86.cab
2007-07-19 21:18 201,696 ----a-w c:program filesAUG2007_XACT_x64.cab
2007-07-19 21:18 156,612 ----a-w c:program filesAUG2007_XACT_x86.cab
2007-07-19 21:18 1,711,752 ----a-w c:program filesAUG2007_d3dx9_35_x86.cab
2006-10-18 07:28 407 ----a-w c:program filesToy200.sav
2006-10-18 07:28 24 ----a-w c:program files oy2.cfg
2004-03-19 09:42 5,125,120 ----a-w c:program filesgdiplus-FullFile-GLB.msp
2008-09-12 19:16 23 --sha-w c:windowssystem32deaaceda7_g.dll
2008-05-16 17:47 32,768 --sha-w c:windowssystem32configsystemprofileLocal SettingsHistoriqueHistory.IE5MSHist012008051620080517index.dat
.
------- Sigcheck -------
2008-04-14 03:34 979968 2393594f52e95c24e35936d2bf2be869 c:windowsexplorer.exe
2007-06-13 14:10 1037312 b795475444d6d57a572c14b9e1a29839 c:windows$hf_mig$KB938828SP2QFEexplorer.exe
2008-04-14 03:34 979968 2393594f52e95c24e35936d2bf2be869 c:windowsServicePackFilesi386explorer.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"UberIcon"="c:windowsBricoPacksVista Inspirat 2UberIconUberIcon Manager.exe" [2006-05-21 180224]
"ctfmon.exe"="c:windowssystem32ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"avast!"="c:progra~1ALWILS~1Avast4ashDisp.exe" [2009-02-05 81000]
c:documents and settingsernardMenu D,marrerProgrammesD,marrage
Palm Registration.lnk - c:program filesPalm
egister.exe [2007-08-15 2494464]
c:documents and settingsyohanMenu D,marrerProgrammesD,marrage
RocketDock.lnk - c:windowsBricoPacksVista Inspirat 2RocketDockRocketDock.exe [2007-03-18 630784]
UberIcon.lnk - c:windowsBricoPacksVista Inspirat 2UberIconUberIcon Manager.exe [2006-05-21 180224]
Y'z Shadow.lnk - c:windowsBricoPacksVista Inspirat 2YzShadowYzShadow.exe [2006-05-21 155648]
[hkey_local_machinesoftwaremicrosoftwindowscurrentversionexplorerShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:program filesWindows Desktop SearchMSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
BootExecute REG_MULTI_SZ autocheck autochk /r ??f:
0autocheck autochk /r ??g:
0autocheck autochk *
0OODBS
[HKLM~startupfolderC:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HOTSYNCSHORTCUTNAME.lnk]
backup=c:windowspssHOTSYNCSHORTCUTNAME.lnkCommon Startup
[HKLM~startupfolderC:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
backup=c:windowspssOutil de mise à jour Google.lnkCommon Startup
HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregGoogle Desktop Search
HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregswg
[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMiniCap]
--a------ 2004-03-09 18:11 15872 c:program filesMiniCapMiniCap.EXE
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\alaplaya\S4League\S4Client.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
"86:TCP"= 86:TCP:BroadCam Web Server
R0 pavboot;pavboot;c:windowssystem32driverspavboot.sys [2009-01-30 28544]
R1 aswSP;avast! Self Protection;c:windowssystem32driversaswSP.sys [2008-06-28 114768]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2008-06-28 20560]
R2 fssfltr;FssFltr;c:windowssystem32driversfssfltr_tdi.sys [2009-03-17 55152]
R2 fsssvc;Windows Live Contrôle parental;c:program filesWindows LiveFamily Safetyfsssvc.exe [2009-02-06 533360]
R2 SeaPort;SeaPort;c:program filesMicrosoftSearch Enhancement PackSeaPortSeaPort.exe [2009-01-14 226656]
R3 Avgfwdx;Avgfwdx;c:windowssystem32driversavgfwdx.sys [2008-06-26 23296]
S2 gupdate1c98ed278a5781a;Service Google Update (gupdate1c98ed278a5781a);c:program filesGoogleUpdateGoogleUpdate.exe [2009-02-14 133104]
S3 Avgfwfd;AVG network filter service;c:windowssystem32driversavgfwdx.sys [2008-06-26 23296]
S3 ComFiltr;Panda Anti-Dialer;??c:windowssystem32DRIVERSCOMFiltr.sys --> c:windowssystem32DRIVERSCOMFiltr.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:program filesNOSingetPlus_HelperSvc.exe [2009-03-24 33176]
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{0032483a-8bed-11da-a3b2-000b6aea6898}]
ShellAutoRuncommand - RavMon.exe
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermountpoints2{3e80029e-9804-11da-a3de-000b6aea6898}]
ShellAutoRuncommand - RavMon.exe
[HKEY_LOCAL_MACHINEsoftwaremicrosoftactive setupinstalled components>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:windowssystem32
undll32.exe" "c:windowssystem32iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'
2009-03-26 c:windowsTasksGoogle Software Updater.job
- c:program filesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe [2009-02-14 15:18]
2009-03-26 c:windowsTasksGoogleUpdateTaskMachine.job
- c:program filesGoogleUpdateGoogleUpdate.exe [2009-02-14 19:31]
2009-03-26 c:windowsTasksUser_Feed_Synchronization-{BC0BEB09-AFCF-495C-B90E-1E0D41D6429D}.job
- c:windowssystem32msfeedssync.exe [2009-03-08 04:31]
.
- - - - ORPHELINS SUPPRIMES - - - -
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
MSConfigStartUp-Steam - c:valveSteamSteam.exe
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL =
hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
mWindow Title =
IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200
IE: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspx
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} -
hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} -
hxxp://game06.zylom.com/activex/zylomgamesplayer.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} -
hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-03-26 22:56:15
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERSS-1-5-21-1292428093-1563985344-725345543-1005SoftwareSecuROM!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:9b,76,91,2d,37,30,0c,16,6e,af,f2,73,df,af,90,04,fe,63,1b,a2,e9,8d,c9,
62,3b,e7,a7,9f,85,3e,a6,5b,5a,dd,dd,fc,c8,18,f9,2a,e1,68,d7,99,8d,87,ac,03,
"??"=hex:53,a7,07,c0,39,50,38,ec,b9,04,ba,c7,4a,31,d8,bb
[HKEY_LOCAL_MACHINEsoftwareMicrosoftWindowsCurrentVersionSystem*]
"OODEFRAG10.00.00.01WORKSTATION"="7E0A70112E352DE73565201DA1D420DB269B2CA09E5AE988430BDF7F263E2ECE060A706D16F0FCDFBEFAC0A80057DA1FF230B3831116D557CAA00D3686AEBC3413EAE50EB5ED4B9AC72E2CE3A1230042B4AABA6321B3EFA8A235F2279870B25396817A1AB9C8DF5EA2AFF438E142155EBDB6D812FCC8128D3C935327F8C5E650C3D2BA8C5193A70561E10F6723B3BCA1A3340EB55561BBA8CDB7D562CBE64F64901B96353052B37BDB5D5505C9E8C350BD393D43E0FB8F3151D406D33701075AB7C662358EFD3941AFEB03783D47963E2BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CA6A0AC4980AC7933A2D97226D213B555028E8E8998CB34549145CF3BA6BC9500C413A3C4C7292CAB6F1F186CE6293E53A0365BDF45165BF3F4CC384B385AF3A93A115F7D3C48D2DDE589FA234A0356865850998786FE057571CC6AEF3E85ED34750ABFFEB1D5D673419B6BAEB2C83E8CCF89E4CF9091AB8C0C59C4A9D505D153779D0A1B5271FA42209934D07792CE7C6170AB8C087FDCB17A6CFBFD92C00281F34E56273DDF9764D231F251E39B74301BFB3195831FB821AAE396F57747F47AD481927C85859738DE7019F9B8C5AEC741818BC61266F4D9B980711C814B34C035037EF833EE7A5F7ECB6C1A2B12132648C0A57FB5F4D9A0FCE7BB031E235F99E57FAD7E3FCA53C01F9A8604612AC8715BD73FA3608A47FD7AA4F9BD2DC6A78CEA0A0CF19B6A4885E096D68F785A8C97D94C6999FC8CABBE6EA103E6875653677E1955BDA847169C9B611D9480912FC555050C4FE8020E7149B1041976123D3C8B8898503FFA8BB856FCEEF3FC63146E94506132F41A876BAD8BFA7636E052DF3393BB9929C30CCED1D13890E509334A915D7937652545C472C5BCA37B4C97EACADFF790A6060F99FB2AB4CF285D9954FB4135D4739707D8A4607148EA01A03B59715AAD69479E17FC36F61DA2DFE7CA36F44D884C8A24C782BB93119D5319F11CB4C16F19B2DA892D0A66672A36D13156D24B5191BA0676009B7430A3B7BEF2047665D65018F7F61B1B3920062720CF269C0DB15789A88DC5AC36587D4863E7B4E8CB6A9F693CA906C5003EF21FAE30A676C73328FB9CF7ADF9524422C26FBE07A4533408BE8330E5499B3D212D6DA107E9005F7E3A896647F593AEF9095AA88722AC408251BBDBE3CAC29BB485E0B8B0611347CE1127CCD6F419D866A1341A7740DA2077016AC25BCE7D5BC480A1CA3CAE2DFD7AF2C2E354B1580835B51FCCCA41396BC851A4BF60C2AA045D1ADBF3F805511C5D723EA66AC81884AF9451BC2ACBF2BA48679671B8F47B1FFE715014697E583BC2CA0F56793BF39A8E2E93ACF16A092BBB90FEB8DA1AF63C9ECAD1"
.
------------------------ Autres processus actifs ------------------------
.
c:windowssystem32savedump.exe
c:program filesAlwil SoftwareAvast4aswUpdSv.exe
c:program filesAlwil SoftwareAvast4ashServ.exe
c:program filesFichiers communsEPSONeEBAPISAgent2.exe
c:program filesJavajre6injqs.exe
c:program filesFichiers communsMicrosoft SharedVS7Debugmdm.exe
c:program filesNeroNero8Nero BackItUpNBService.exe
c:program filesAlwil SoftwareAvast4ashMaiSv.exe
c:program filesAlwil SoftwareAvast4ashWebSv.exe
c:windowssystem32wbemwmiapsrv.exe
c:windowssystem32wscntfy.exe
c:program filesAlwil SoftwareAvast4Setupavast.setup
.
**************************************************************************
.
Heure de fin: 2009-03-26 22:59:27 - La machine a redémarré [yohan]
ComboFix-quarantined-files.txt 2009-03-26 21:59:24
Avant-CF: 114,697,932,800 octets libres
Après-CF: 115,080,687,616 octets libres
234 --- E O F --- 2009-03-15 00:44:10