Multi problèmes

Bonsoir 2203, les plaisirs des téléchargements....

Suis cette procédure et poste le résultat du scan

http://stopovirus.xooit.fr/t428-ZHPDiag.htm


Rappel:

Les rapports doivent être postés en lien

http://cjoint.com/?AKbadygFXiw

Salement infecté cette machine

- Télécharge RogueKiller (par tigzy) sur le bureau

http://www.sur-la-toile.com/RogueKiller/

- Quitte tous tes programmes en cours

- Lance RogueKiller.exe.

- Sous Vista/Seven, clique droit et lancer en tant qu'administrateur

- Lorsque demandé, tape 2 (delete) et valide

- Un rapport (RKreport.txt) a du se créer à côté de l'exécutable, colle son contenu dans la réponse

Note:
Si le programme a été bloqué, ne pas hésiter à essayer plusieurs fois.

RogueKiller V6.1.5 [29/10/2011] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discuss[...]-Remontees.html
Blog: http://tigzyrk.blogspot.com

Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: leydier [Droits d'admin]
Mode: Suppression -- Date : 01/11/2011 00:25:59

Processus malicieux: 3
[SUSP PATH] 892534172:1661128138.exe -- c:\windows\892534172:1661128138.exe -> KILLED [TermProc]
[SUSP PATH] 892534172:1661128138.exe -- c:\windows\892534172:1661128138.exe -> KILLED [TermProc]
[RESIDUE] 892534172:1661128138.exe -- c:\windows\892534172:1661128138.exe -> KILLED [TermProc]

Entrees de registre: 1
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED ()

Fichiers / Dossiers particuliers:

Driver: [LOADED]

Fichier HOSTS:
127.0.0.1 localhost


Termine : << RKreport[1].txt >>
RKreport[1].txt

C'est deja un peu mieux

Étape 1

Attention le temps de téléchargement du script a été limité à 4 jours

- Clique sur http://cjoint.com/?3KbaLDEUIwN

- Sur la page qui s'ouvre clic droit et Tout sélectionner
- Refais un clic droit et Copier

- Double clique sur ZHPFix qui est sur le bureau.

** Pour Vista et Seven fais un clic droit sur le fichier téléchargé et Exécuter en tant qu'adminstrateur

- Clique maintenant sur le H bleu http://img51.xooimage.com/files/f/3[...]leu-226894a.jpg (coller les lignes helper)

- Le texte copié dans le presse papiers s'affichera dans la fenêtre de ZHPFix

http://img63.xooimage.com/files/a/b[...]fix-273d5b0.jpg

- Clique sur Go patiente le temps du traitement

- Un rapport nommé ZHPFixReport.txt sera créé et sauvegardé dans C:\ZHP\ZHPFix[R1].txt

- Poste son contenu dans ta prochaine réponse

peux tu me trouver une autre solution pour la manip ,car je poste depuis mon portable pour faire les manips sur le pc verole.
MERCI

Tu arrives à te connecter a partir du PC infecté?
En mode sans echec avec oprise en charge du reseau par exemple?

On va essayer autre chose au cas ou ça echoue


1. Télécharge combofix.exe (par sUBs) sur le bureau à l'aide d'un des liens ci-dessous:

http://download.bleepingcomputer.co[...]Bs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Installe la console de récupération si cela est demandé en suivant soigneusement les instructions qui s'afficheront


Ferme le navigateur et tous les programmes ouverts
Désactive tous les logiciels de sécurité (antivirus antimalwares spybot etc) et ne clique pas dans la fenêtre pendant l'exécution du scan


2. Fais un double clic sur ComboFix.exe, laisse ensuite le scan se dérouler sans toucher à la souris ni au clavier.


3. Lorsque le scan sera complété, un rapport apparaitra. Copie/colle ce rapport dans ta prochaine réponse.

Le rapport se trouve également ici : C:\Combofix.txt

NOTE:
Combofix peut être détecté par certains antivirus.
Ne pas en tenir compte, c'est un faux positif
Cliquer sur ignorer et continuer la procédure

Je reviens a la charge , mon ordi etant verole , je ne peux acceder au site de sos ordi ,d'ou travail a partir du portable et ensuite cle usb por effectuer les manips sur le pc verole.
Le debut de la manipproposee est difficile pour moi ,car je ne peux l'enregistrer sur ma clef usb???
D'OU MON PRECEDENT POST.MERCI POUR L'AIDE

Passe au telechargement de combofix
Avant de le transférer via la clé usb , renomme le en trombofix.exe
Cela empechera le rootkit de le bloquer
Une fois trombofix sur le bureau du PC a l'agonie (mode sans echec ou normal) double clic dessus
La console de recuperation ne pourra sans doute pas s'installe, laisse la manip se derouler quand même

Il me dit que mse est actif!!! et le le neutraliser,AVANT DE CONTINUER comment faire???

Desactive la premiere case dans paramètre ==> protection en temps réel

http://img66.xooimage.com/files/9/f[...]e19-2d03186.jpg

si ça ne va pas, continu, le tool passera en force

Edité par zaede le 01/11/2011 à 01:21

ComboFix 11-10-30.04 - leydier 01/11/2011 1:36.1.1 - x86 MINIMAL
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.791 [GMT 1:00]
Lancé depuis: F:\TROMBOFIX.EXE.exe
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\SPL149.tmp
c:\documents and settings\All Users\SPL5A.tmp
c:\documents and settings\leydier\Application Data\Toolbar4
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\156783.png
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\cache\ded0070427585a10b47dc38c30725f43
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\games01.png
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\go_btn.png
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\5563cef889bfa801bacf546650741142
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\a28fb005e91cf194594645214b0c743e
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\d218065c7312190b4bd44f226e0ddcb3
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\ed27fb3bbcc1f40fbf99c2f6a3664931
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\logo.gif
c:\documents and settings\leydier\WINDOWS
c:\windows\$NtUninstallKB20791$
c:\windows\$NtUninstallKB20791$\2633839157\@
c:\windows\$NtUninstallKB20791$\2633839157\L\akygdmgo
c:\windows\$NtUninstallKB20791$\2633839157\loader(2)(2).tlb
c:\windows\$NtUninstallKB20791$\2633839157\loader(2)(3).tlb
c:\windows\$NtUninstallKB20791$\2633839157\loader.tlb
c:\windows\$NtUninstallKB20791$\2633839157\U\@00000001
c:\windows\$NtUninstallKB20791$\2633839157\U\@000000c0
c:\windows\$NtUninstallKB20791$\2633839157\U\@000000cb
c:\windows\$NtUninstallKB20791$\2633839157\U\@000000cf
c:\windows\$NtUninstallKB20791$\2633839157\U\@80000000
c:\windows\$NtUninstallKB20791$\2633839157\U\@800000c0
c:\windows\$NtUninstallKB20791$\2633839157\U\@800000cb
c:\windows\$NtUninstallKB20791$\2633839157\U\@800000cf
c:\windows\$NtUninstallKB20791$\41198353
c:\windows\system32\config\systemprofile\Application Data\Toolbar4
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\156783.png
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\arrow_refresh.png
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\basis.xml
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\cache\ded0070427585a10b47dc38c30725f43
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\cog.png
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\computer_delete.png
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\descargar3.exe
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\favicon.png
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\games01.png
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\go_btn.png
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\icons.bmp
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\2f1fbcac8ea17ed466f1344bdc66bf14
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\4af2303a5dbe762cb7c936431e8fe010
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\95a5e24eeb50cd21b0a3c25611abd0b5
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\c253ba70c0fe10ff9e0a1b695f815cc4
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\info.txt
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\logo.gif
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\stations.js
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\TbHelper2.exe
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\uninstall.exe
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\uninstaller.exe
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\update.exe
c:\windows\system32\config\systemprofile\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\version.txt
G:\autorun.inf
.
Une copie infectée de c:\windows\system32\drivers\cdrom.sys a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\ServicePackFiles\i386\cdrom.sys
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-10-01 au 2011-11-01 ))))))))))))))))))))))))))))))))))))
.
.
2011-11-01 00:57 . 2011-11-01 00:57 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEABEE5-AB1A-4775-8672-18CBD5E57D52}\MpKsledea8767.sys
2011-11-01 00:56 . 2011-11-01 00:56 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEABEE5-AB1A-4775-8672-18CBD5E57D52}\offreg.dll
2011-10-31 23:25 . 2011-10-31 23:27 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2011-10-31 22:42 . 2011-10-31 22:42 512 ----a-w- C:\PhysicalDisk0_MBR.bin
2011-10-31 22:27 . 2011-10-31 22:42 -------- d-----w- C:\ZHP
2011-10-31 22:26 . 2011-10-31 22:42 -------- d-----w- c:\program files\ZHPDiag
2011-10-31 17:07 . 2011-11-01 00:10 -------- d-----w- c:\program files\RechercherWeb Toolbar
2011-10-31 16:54 . 2011-10-31 16:54 41680 ----a-w- c:\windows\system32\drivers\qwuehfge.sys
2011-10-31 16:39 . 2011-10-31 16:39 41680 ----a-w- c:\windows\system32\drivers\odjevbjh.sys
2011-10-31 16:24 . 2011-10-31 16:24 41680 ----a-w- c:\windows\system32\drivers\tckgqnfx.sys
2011-10-31 16:09 . 2011-10-31 16:09 41680 ----a-w- c:\windows\system32\drivers\twcslgee.sys
2011-10-31 15:55 . 2011-10-06 19:48 6668624 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEABEE5-AB1A-4775-8672-18CBD5E57D52}\mpengine.dll
2011-10-31 15:55 . 2011-10-31 15:55 41680 ----a-w- c:\windows\system32\drivers\vtdpnnjx.sys
2011-10-31 15:09 . 2011-10-31 15:09 -------- d-----w- c:\documents and settings\leydier\Local Settings\Application Data\FixItCenter
2011-10-31 14:48 . 2011-10-31 14:48 -------- d-----w- c:\windows\MATS
2011-10-31 14:48 . 2011-10-31 14:48 -------- d-----w- c:\program files\Microsoft Fix it Center
2011-10-31 14:43 . 2011-10-31 14:43 -------- d-----w- c:\documents and settings\leydier\Application Data\ElevatedDiagnostics
2011-10-31 13:10 . 2011-10-31 13:25 11368 ----a-w- C:\FixitRegBackup.reg
2011-10-30 14:43 . 2011-10-30 14:43 -------- d-----w- c:\windows\system32\wbem\Repository
2011-10-30 12:56 . 2011-10-30 14:41 -------- d-----w- c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}(2)
2011-10-30 12:37 . 2011-10-30 12:37 -------- d-----w- c:\documents and settings\leydier\Application Data\TuneUp Software
2011-10-30 12:37 . 2011-10-30 14:41 -------- d-----w- c:\program files\TuneUp Utilities 2011
2011-10-30 12:36 . 2011-10-30 14:41 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2011-10-30 12:08 . 2011-10-30 12:08 -------- d-----w- c:\documents and settings\leydier\Application Data\Uniblue
2011-10-29 22:17 . 2011-10-30 14:42 -------- d-----w- c:\program files\Microsoft Security Client
2011-10-29 21:32 . 2011-10-31 22:42 -------- d-sh--w- c:\documents and settings\leydier\Local Settings\Application Data\9cfd3235
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-06 19:48 . 2011-07-10 08:03 6668624 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-09-26 09:41 . 2011-09-26 09:41 614400 ------w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 1979-12-31 23:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 1979-12-31 23:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 09:12 . 1979-12-31 23:00 606208 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 14:10 . 1979-12-31 23:00 1859072 ----a-w- c:\windows\system32\win32k.sys
2011-09-02 06:22 . 2011-06-21 06:18 404640 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-17 21:24 . 1979-12-31 23:00 832512 ----a-w- c:\windows\system32\wininet.dll
2011-08-17 21:24 . 1979-12-31 23:00 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-08-17 21:24 . 2010-12-28 09:15 78336 ------w- c:\windows\system32\ieencode.dll
2011-08-17 21:24 . 1979-12-31 23:00 17408 ----a-w- c:\windows\system32\corpol.dll
2011-08-17 13:49 . 1979-12-31 23:00 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2011-08-17 12:22 . 2010-12-28 09:15 389120 ------w- c:\windows\system32\html.iec
2011-08-12 11:51 . 2010-12-28 10:54 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2001-10-25 15:14 . 2010-12-21 14:23 372736 -c--a-w- c:\program files\Super_PR.exe
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2011-06-10 06:24 165256 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8FFA7469-654F-423E-84FE-6A583CB1C284}"= "c:\program files\RechercherWeb Toolbar\tbcore3.dll" [2011-09-01 2650328]
.
[HKEY_CLASSES_ROOT\clsid\{8ffa7469-654f-423e-84fe-6a583cb1c284}]
[HKEY_CLASSES_ROOT\TBSB01555.TBSB01555.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB01555.TBSB01555]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{8FFA7469-654F-423E-84FE-6A583CB1C284}"= "c:\program files\RechercherWeb Toolbar\tbcore3.dll" [2011-09-01 2650328]
.
[HKEY_CLASSES_ROOT\clsid\{8ffa7469-654f-423e-84fe-6a583cb1c284}]
[HKEY_CLASSES_ROOT\TBSB01555.TBSB01555.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB01555.TBSB01555]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2011-06-10 959880]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^PC Clone EX.LNK]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\PC Clone EX.LNK
backup=c:\windows\pss\PC Clone EX.LNKCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 10:55 937920 ----a-w- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-05 17:04 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2010-10-27 17:17 207424 -c--a-w- c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
2001-09-15 00:15 245760 ----a-w- c:\windows\system32\atiptaxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EM_EXEC]
2001-08-24 08:40 35328 -c--a-w- c:\progra~1\MOUSEW~1\system\EM_EXEC.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
2010-01-18 17:27 139944 ----a-w- c:\program files\Lexmark S300-S400 Series\ezprint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxeamon.exe]
2010-01-18 17:27 770728 -c--a-w- c:\program files\Lexmark S300-S400 Series\lxeamon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2011-06-15 13:16 997920 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 15:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2011-04-22 12:21 247728 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TomTomHOMEService"=2 (0x2)
"lxea_device"=2 (0x2)
"lxeaCATSCustConnectService"=2 (0x2)
"ACDaemon"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\FinalMediaPlayer\\FMPCheckForUpdates.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\lxeacoms.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\scan\\scanman6.exe"=
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\Program Files\\Fichiers communs\\Microsoft Shared\\DW\\DW20.EXE"=
"c:\\Program Files\\Microsoft Fix it Center\\MatsWiz.exe"=
"c:\\Program Files\\Microsoft Fix it Center\\FixitCenter1st.exe"=
"c:\\Program Files\\Microsoft Fix it Center\\FixitCenter.exe"=
"c:\\Program Files\\CCleaner\\CCleaner.exe"=
"c:\\Program Files\\SFR\\Kit\\9launch.exe"=
"c:\\Program Files\\ZHPDiag\\ZHPDiag.exe"=
.
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [19/12/2010 14:26 7040]
R1 MpKsledea8767;MpKsledea8767;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEABEE5-AB1A-4775-8672-18CBD5E57D52}\MpKsledea8767.sys [01/11/2011 01:57 28752]
R3 CVIAAUD;NEC VIA 3D Environmental Audio;c:\windows\system32\drivers\cviaaud.sys [01/01/1980 320864]
R3 CVIAHALA;CVIAHALA;c:\windows\system32\drivers\cviahal.sys [01/01/1980 214688]
R3 PxHelper;PxHelper;c:\windows\system32\drivers\PxHelper.sys [19/12/2010 12:17 15776]
S1 abokrjcj;abokrjcj;\??\c:\windows\system32\drivers\abokrjcj.sys --> c:\windows\system32\drivers\abokrjcj.sys [?]
S1 ahzjbiec;ahzjbiec;\??\c:\windows\system32\drivers\ahzjbiec.sys --> c:\windows\system32\drivers\ahzjbiec.sys [?]
S1 ajcvqnrd;ajcvqnrd;\??\c:\windows\system32\drivers\ajcvqnrd.sys --> c:\windows\system32\drivers\ajcvqnrd.sys [?]
S1 atmyfxoq;atmyfxoq;\??\c:\windows\system32\drivers\atmyfxoq.sys --> c:\windows\system32\drivers\atmyfxoq.sys [?]
S1 attlqhft;attlqhft;\??\c:\windows\system32\drivers\attlqhft.sys --> c:\windows\system32\drivers\attlqhft.sys [?]
S1 avvncbdn;avvncbdn;\??\c:\windows\system32\drivers\avvncbdn.sys --> c:\windows\system32\drivers\avvncbdn.sys [?]
S1 bgjwvcap;bgjwvcap;\??\c:\windows\system32\drivers\bgjwvcap.sys --> c:\windows\system32\drivers\bgjwvcap.sys [?]
S1 bkfcizrv;bkfcizrv;\??\c:\windows\system32\drivers\bkfcizrv.sys --> c:\windows\system32\drivers\bkfcizrv.sys [?]
S1 bmbicibu;bmbicibu;\??\c:\windows\system32\drivers\bmbicibu.sys --> c:\windows\system32\drivers\bmbicibu.sys [?]
S1 booeotiy;booeotiy;\??\c:\windows\system32\drivers\booeotiy.sys --> c:\windows\system32\drivers\booeotiy.sys [?]
S1 cikhmcix;cikhmcix;\??\c:\windows\system32\drivers\cikhmcix.sys --> c:\windows\system32\drivers\cikhmcix.sys [?]
S1 cpzbsdyx;cpzbsdyx;\??\c:\windows\system32\drivers\cpzbsdyx.sys --> c:\windows\system32\drivers\cpzbsdyx.sys [?]
S1 dciefels;dciefels;\??\c:\windows\system32\drivers\dciefels.sys --> c:\windows\system32\drivers\dciefels.sys [?]
S1 dweyjqhh;dweyjqhh;\??\c:\windows\system32\drivers\dweyjqhh.sys --> c:\windows\system32\drivers\dweyjqhh.sys [?]
S1 dyhzzxfo;dyhzzxfo;\??\c:\windows\system32\drivers\dyhzzxfo.sys --> c:\windows\system32\drivers\dyhzzxfo.sys [?]
S1 dyvrmaqx;dyvrmaqx;\??\c:\windows\system32\drivers\dyvrmaqx.sys --> c:\windows\system32\drivers\dyvrmaqx.sys [?]
S1 edbjgmue;edbjgmue;\??\c:\windows\system32\drivers\edbjgmue.sys --> c:\windows\system32\drivers\edbjgmue.sys [?]
S1 egscnlxa;egscnlxa;\??\c:\windows\system32\drivers\egscnlxa.sys --> c:\windows\system32\drivers\egscnlxa.sys [?]
S1 ehfrluce;ehfrluce;\??\c:\windows\system32\drivers\ehfrluce.sys --> c:\windows\system32\drivers\ehfrluce.sys [?]
S1 ejmsstux;ejmsstux;\??\c:\windows\system32\drivers\ejmsstux.sys --> c:\windows\system32\drivers\ejmsstux.sys [?]
S1 eqspzxer;eqspzxer;\??\c:\windows\system32\drivers\eqspzxer.sys --> c:\windows\system32\drivers\eqspzxer.sys [?]
S1 etydbbhb;etydbbhb;\??\c:\windows\system32\drivers\etydbbhb.sys --> c:\windows\system32\drivers\etydbbhb.sys [?]
S1 ffoehtlw;ffoehtlw;\??\c:\windows\system32\drivers\ffoehtlw.sys --> c:\windows\system32\drivers\ffoehtlw.sys [?]
S1 fhkxmcqr;fhkxmcqr;\??\c:\windows\system32\drivers\fhkxmcqr.sys --> c:\windows\system32\drivers\fhkxmcqr.sys [?]
S1 fllsvcuu;fllsvcuu;\??\c:\windows\system32\drivers\fllsvcuu.sys --> c:\windows\system32\drivers\fllsvcuu.sys [?]
S1 fuostfjq;fuostfjq;\??\c:\windows\system32\drivers\fuostfjq.sys --> c:\windows\system32\drivers\fuostfjq.sys [?]
S1 futivxky;futivxky;\??\c:\windows\system32\drivers\futivxky.sys --> c:\windows\system32\drivers\futivxky.sys [?]
S1 gbdgpvmp;gbdgpvmp;\??\c:\windows\system32\drivers\gbdgpvmp.sys --> c:\windows\system32\drivers\gbdgpvmp.sys [?]
S1 gixhodhe;gixhodhe;\??\c:\windows\system32\drivers\gixhodhe.sys --> c:\windows\system32\drivers\gixhodhe.sys [?]
S1 hrxbwvyq;hrxbwvyq;\??\c:\windows\system32\drivers\hrxbwvyq.sys --> c:\windows\system32\drivers\hrxbwvyq.sys [?]
S1 htiyosgw;htiyosgw;\??\c:\windows\system32\drivers\htiyosgw.sys --> c:\windows\system32\drivers\htiyosgw.sys [?]
S1 htppitnx;htppitnx;\??\c:\windows\system32\drivers\htppitnx.sys --> c:\windows\system32\drivers\htppitnx.sys [?]
S1 hvojtjsi;hvojtjsi;\??\c:\windows\system32\drivers\hvojtjsi.sys --> c:\windows\system32\drivers\hvojtjsi.sys [?]
S1 hxgsrnvb;hxgsrnvb;\??\c:\windows\system32\drivers\hxgsrnvb.sys --> c:\windows\system32\drivers\hxgsrnvb.sys [?]
S1 ilupgdrf;ilupgdrf;\??\c:\windows\system32\drivers\ilupgdrf.sys --> c:\windows\system32\drivers\ilupgdrf.sys [?]
S1 ivokjffn;ivokjffn;\??\c:\windows\system32\drivers\ivokjffn.sys --> c:\windows\system32\drivers\ivokjffn.sys [?]
S1 iwgbvuzz;iwgbvuzz;\??\c:\windows\system32\drivers\iwgbvuzz.sys --> c:\windows\system32\drivers\iwgbvuzz.sys [?]
S1 jpjxgegu;jpjxgegu;\??\c:\windows\system32\drivers\jpjxgegu.sys --> c:\windows\system32\drivers\jpjxgegu.sys [?]
S1 jqlmmxmo;jqlmmxmo;\??\c:\windows\system32\drivers\jqlmmxmo.sys --> c:\windows\system32\drivers\jqlmmxmo.sys [?]
S1 jtgloxjd;jtgloxjd;\??\c:\windows\system32\drivers\jtgloxjd.sys --> c:\windows\system32\drivers\jtgloxjd.sys [?]
S1 kezqjzwv;kezqjzwv;\??\c:\windows\system32\drivers\kezqjzwv.sys --> c:\windows\system32\drivers\kezqjzwv.sys [?]
S1 kgdlugom;kgdlugom;\??\c:\windows\system32\drivers\kgdlugom.sys --> c:\windows\system32\drivers\kgdlugom.sys [?]
S1 kqphnpxx;kqphnpxx;\??\c:\windows\system32\drivers\kqphnpxx.sys --> c:\windows\system32\drivers\kqphnpxx.sys [?]
S1 lbbmnnck;lbbmnnck;\??\c:\windows\system32\drivers\lbbmnnck.sys --> c:\windows\system32\drivers\lbbmnnck.sys [?]
S1 lvznunwm;lvznunwm;\??\c:\windows\system32\drivers\lvznunwm.sys --> c:\windows\system32\drivers\lvznunwm.sys [?]
S1 mebcuenk;mebcuenk;\??\c:\windows\system32\drivers\mebcuenk.sys --> c:\windows\system32\drivers\mebcuenk.sys [?]
S1 mgqncrvd;mgqncrvd;\??\c:\windows\system32\drivers\mgqncrvd.sys --> c:\windows\system32\drivers\mgqncrvd.sys [?]
S1 mnpizyay;mnpizyay;\??\c:\windows\system32\drivers\mnpizyay.sys --> c:\windows\system32\drivers\mnpizyay.sys [?]
S1 MpKsl01167cd6;MpKsl01167cd6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsl01167cd6.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsl01167cd6.sys [?]
S1 MpKsl0e16056f;MpKsl0e16056f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E7BED0D-7738-4DDC-B2AC-B5DB95995737}\MpKsl0e16056f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E7BED0D-7738-4DDC-B2AC-B5DB95995737}\MpKsl0e16056f.sys [?]
S1 MpKsl15a74f0b;MpKsl15a74f0b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C804D43E-1277-4E84-8A48-3B2827FCEC42}\MpKsl15a74f0b.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C804D43E-1277-4E84-8A48-3B2827FCEC42}\MpKsl15a74f0b.sys [?]
S1 MpKsl1a422d4f;MpKsl1a422d4f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9A4682C-4F5D-44EB-B468-8739F8C120FA}\MpKsl1a422d4f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9A4682C-4F5D-44EB-B468-8739F8C120FA}\MpKsl1a422d4f.sys [?]
S1 MpKsl1bfbfc32;MpKsl1bfbfc32;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F60AAE2B-AC6B-4E47-9E1A-195ED50749DC}\MpKsl1bfbfc32.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F60AAE2B-AC6B-4E47-9E1A-195ED50749DC}\MpKsl1bfbfc32.sys [?]
S1 MpKsl2c9fb12f;MpKsl2c9fb12f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A83E1A8B-4886-4693-A8EC-D323A3B0E250}\MpKsl2c9fb12f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A83E1A8B-4886-4693-A8EC-D323A3B0E250}\MpKsl2c9fb12f.sys [?]
S1 MpKsl307e05bc;MpKsl307e05bc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{68A16570-9BE3-4A3E-869E-2A8DB83AB516}\MpKsl307e05bc.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{68A16570-9BE3-4A3E-869E-2A8DB83AB516}\MpKsl307e05bc.sys [?]
S1 MpKsl39b772c2;MpKsl39b772c2;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{353E8CA6-C5F2-4F72-8D8D-06F2B429ECB3}\MpKsl39b772c2.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{353E8CA6-C5F2-4F72-8D8D-06F2B429ECB3}\MpKsl39b772c2.sys [?]
S1 MpKsl53841977;MpKsl53841977;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE7B5757-43A8-410A-9393-D3BD7A9B3862}\MpKsl53841977.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE7B5757-43A8-410A-9393-D3BD7A9B3862}\MpKsl53841977.sys [?]
S1 MpKsl68035b7c;MpKsl68035b7c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3D36E30A-605A-4CB1-8DDE-11465C57C274}\MpKsl68035b7c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3D36E30A-605A-4CB1-8DDE-11465C57C274}\MpKsl68035b7c.sys [?]
S1 MpKsl6c8c5fba;MpKsl6c8c5fba;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7EBEB62D-C684-4068-BBA6-7BF34577C267}\MpKsl6c8c5fba.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7EBEB62D-C684-4068-BBA6-7BF34577C267}\MpKsl6c8c5fba.sys [?]
S1 MpKsl7e3cac6d;MpKsl7e3cac6d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{482F684A-4B14-40FD-B48B-D28C42CF4E89}\MpKsl7e3cac6d.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{482F684A-4B14-40FD-B48B-D28C42CF4E89}\MpKsl7e3cac6d.sys [?]
S1 MpKsl8478db31;MpKsl8478db31;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4ADC9FB8-0633-4A89-96E8-D065CDF04FA8}\MpKsl8478db31.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4ADC9FB8-0633-4A89-96E8-D065CDF04FA8}\MpKsl8478db31.sys [?]
S1 MpKsl8f34221f;MpKsl8f34221f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D00B33A8-2010-47E0-AE88-4608E8070937}\MpKsl8f34221f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D00B33A8-2010-47E0-AE88-4608E8070937}\MpKsl8f34221f.sys [?]
S1 MpKsl8fbb6121;MpKsl8fbb6121;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55DB2C13-43A4-45A7-BBBB-893A5020F818}\MpKsl8fbb6121.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55DB2C13-43A4-45A7-BBBB-893A5020F818}\MpKsl8fbb6121.sys [?]
S1 MpKsl98b7b3f0;MpKsl98b7b3f0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{AE9AE752-E286-4525-9BAA-3342F8C5ECD5}\MpKsl98b7b3f0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{AE9AE752-E286-4525-9BAA-3342F8C5ECD5}\MpKsl98b7b3f0.sys [?]
S1 MpKslc340bc73;MpKslc340bc73;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{84D3DC1C-1D20-476D-9D9B-9BA06841B6DD}\MpKslc340bc73.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{84D3DC1C-1D20-476D-9D9B-9BA06841B6DD}\MpKslc340bc73.sys [?]
S1 MpKsld4fd4d25;MpKsld4fd4d25;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsld4fd4d25.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsld4fd4d25.sys [?]
S1 MpKslf7f9de36;MpKslf7f9de36;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C0D6660-FA85-49F7-AA61-8855DDF81F6A}\MpKslf7f9de36.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C0D6660-FA85-49F7-AA61-8855DDF81F6A}\MpKslf7f9de36.sys [?]
S1 MpKslfcb37bf8;MpKslfcb37bf8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{86D7DFF5-8AF1-4CE6-9894-DB62A2D407F4}\MpKslfcb37bf8.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{86D7DFF5-8AF1-4CE6-9894-DB62A2D407F4}\MpKslfcb37bf8.sys [?]
S1 mplmvswf;mplmvswf;\??\c:\windows\system32\drivers\mplmvswf.sys --> c:\windows\system32\drivers\mplmvswf.sys [?]
S1 mqhiexdl;mqhiexdl;\??\c:\windows\system32\drivers\mqhiexdl.sys --> c:\windows\system32\drivers\mqhiexdl.sys [?]
S1 nnzmxxfr;nnzmxxfr;\??\c:\windows\system32\drivers\nnzmxxfr.sys --> c:\windows\system32\drivers\nnzmxxfr.sys [?]
S1 nujliuxs;nujliuxs;\??\c:\windows\system32\drivers\nujliuxs.sys --> c:\windows\system32\drivers\nujliuxs.sys [?]
S1 obcrrjka;obcrrjka;\??\c:\windows\system32\drivers\obcrrjka.sys --> c:\windows\system32\drivers\obcrrjka.sys [?]
S1 pilomcls;pilomcls;\??\c:\windows\system32\drivers\pilomcls.sys --> c:\windows\system32\drivers\pilomcls.sys [?]
S1 pnsvathj;pnsvathj;\??\c:\windows\system32\drivers\pnsvathj.sys --> c:\windows\system32\drivers\pnsvathj.sys [?]
S1 qtaqjlpz;qtaqjlpz;\??\c:\windows\system32\drivers\qtaqjlpz.sys --> c:\windows\system32\drivers\qtaqjlpz.sys [?]
S1 rdvcwgbs;rdvcwgbs;\??\c:\windows\system32\drivers\rdvcwgbs.sys --> c:\windows\system32\drivers\rdvcwgbs.sys [?]
S1 rlyubqzs;rlyubqzs;\??\c:\windows\system32\drivers\rlyubqzs.sys --> c:\windows\system32\drivers\rlyubqzs.sys [?]
S1 rotlldti;rotlldti;\??\c:\windows\system32\drivers\rotlldti.sys --> c:\windows\system32\drivers\rotlldti.sys [?]
S1 rypadabf;rypadabf;\??\c:\windows\system32\drivers\rypadabf.sys --> c:\windows\system32\drivers\rypadabf.sys [?]
S1 sdtgbmjp;sdtgbmjp;\??\c:\windows\system32\drivers\sdtgbmjp.sys --> c:\windows\system32\drivers\sdtgbmjp.sys [?]
S1 sjrrmkgb;sjrrmkgb;\??\c:\windows\system32\drivers\sjrrmkgb.sys --> c:\windows\system32\drivers\sjrrmkgb.sys [?]
S1 slimmnwe;slimmnwe;\??\c:\windows\system32\drivers\slimmnwe.sys --> c:\windows\system32\drivers\slimmnwe.sys [?]
S1 sormzzom;sormzzom;\??\c:\windows\system32\drivers\sormzzom.sys --> c:\windows\system32\drivers\sormzzom.sys [?]
S1 tiuwbccl;tiuwbccl;\??\c:\windows\system32\drivers\tiuwbccl.sys --> c:\windows\system32\drivers\tiuwbccl.sys [?]
S1 tzmdahfe;tzmdahfe;\??\c:\windows\system32\drivers\tzmdahfe.sys --> c:\windows\system32\drivers\tzmdahfe.sys [?]
S1 uajicieq;uajicieq;\??\c:\windows\system32\drivers\uajicieq.sys --> c:\windows\system32\drivers\uajicieq.sys [?]
S1 ubqielxa;ubqielxa;\??\c:\windows\system32\drivers\ubqielxa.sys --> c:\windows\system32\drivers\ubqielxa.sys [?]
S1 unxnybcn;unxnybcn;\??\c:\windows\system32\drivers\unxnybcn.sys --> c:\windows\system32\drivers\unxnybcn.sys [?]
S1 uobzuams;uobzuams;\??\c:\windows\system32\drivers\uobzuams.sys --> c:\windows\system32\drivers\uobzuams.sys [?]
S1 uolngeap;uolngeap;\??\c:\windows\system32\drivers\uolngeap.sys --> c:\windows\system32\drivers\uolngeap.sys [?]
S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [13/06/2011 22:09 267568]
S3 TrueSight;TrueSight;c:\windows\system32\drivers\TrueSight.sys [01/11/2011 00:25 111872]
S4 lxea_device;lxea_device;c:\windows\system32\lxeacoms.exe -service --> c:\windows\system32\lxeacoms.exe -service [?]
S4 lxeaCATSCustConnectService;lxeaCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxeaserv.exe [10/07/2011 09:39 91240]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [22/04/2011 13:21 92592]
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - MPKSLEDEA8767
.
Contenu du dossier 'Tâches planifiées'
.
2011-11-01 c:\windows\Tasks\ConfigExec.job
- c:\program files\Microsoft Fix it Center\MatsApi.dll [2011-06-13 21:09]
.
2011-10-31 c:\windows\Tasks\DataUpload.job
- c:\program files\Microsoft Fix it Center\MatsApi.dll [2011-06-13 21:09]
.
2011-11-01 c:\windows\Tasks\Final Media Player Update Checker.job
- c:\program files\FinalMediaPlayer\FMPCheckForUpdates.exe [2011-03-16 15:50]
.
2011-11-01 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 13:39]
.
2010-12-19 c:\windows\Tasks\Rappel d'enregistrement 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2010-12-19 02:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
mStart Page = hxxp://wwwmywebsites.com
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-01 01:58
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(2356)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\ArcSoft\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
.
**************************************************************************
.
Heure de fin: 2011-11-01 02:08:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-11-01 01:08
.
Avant-CF: 20 645 462 016 octets libres
Après-CF: 19 750 563 840 octets libres
.
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP �dition familiale" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 1200F21C22AE2FC0A50A7C99A56AD587

Bonjour 2203, il reste encore de quoi faire


- Télécharge CFScript.txt ici http://vbgq6c.alterupload.com/
Clique sur Click here to start your download pour commencer le téléchargement enregistre ce fichier dans le même dossier que Combofix, ce dernier terminé.

- Quitte ton navigateur ainsi que toutes les applications en cours.

Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture

http://img.photobucket.com/albums/v[...]Bs/CFScript.gif
http://moe.mabul.org/up/moe/2010/05[...]22465960m5e.gif

[*] Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

Note : La durée de téléchargement du script a été limité à une journée

Bonjour Zeade,

je n'arrive pas a faire la manip demandee....
Je ne trouve pas la ligne de commande "click here...doxnload" et la depose de cfs sur comBo exe me dit que je n'ai^pas la ressource...
Dans l'attente...

ComboFix 11-11-01.03 - leydier 01/11/2011 17:02:43.2.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.660 [GMT 1:00]
Lancé depuis: c:\trombofix.exe\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\leydier\Bureau\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\documents and settings\leydier\Local Settings\Application Data\9cfd3235"
"c:\windows\system32\drivers\abokrjcj.sys"
"c:\windows\system32\drivers\ahzjbiec.sys"
"c:\windows\system32\drivers\ajcvqnrd.sys"
"c:\windows\system32\drivers\atmyfxoq.sys"
"c:\windows\system32\drivers\attlqhft.sys"
"c:\windows\system32\drivers\avvncbdn.sys"
"c:\windows\system32\drivers\bgjwvcap.sys"
"c:\windows\system32\drivers\bkfcizrv.sys"
"c:\windows\system32\drivers\bmbicibu.sys"
"c:\windows\system32\drivers\booeotiy.sys"
"c:\windows\system32\drivers\cikhmcix.sys"
"c:\windows\system32\drivers\cpzbsdyx.sys"
"c:\windows\system32\drivers\dciefels.sys"
"c:\windows\system32\drivers\dweyjqhh.sys"
"c:\windows\system32\drivers\dyhzzxfo.sys"
"c:\windows\system32\drivers\dyvrmaqx.sys"
"c:\windows\system32\drivers\edbjgmue.sys"
"c:\windows\system32\drivers\egscnlxa.sys"
"c:\windows\system32\drivers\ehfrluce.sys"
"c:\windows\system32\drivers\ejmsstux.sys"
"c:\windows\system32\drivers\eqspzxer.sys"
"c:\windows\system32\drivers\etydbbhb.sys"
"c:\windows\system32\drivers\ffoehtlw.sys"
"c:\windows\system32\drivers\fhkxmcqr.sys"
"c:\windows\system32\drivers\fllsvcuu.sys"
"c:\windows\system32\drivers\fuostfjq.sys"
"c:\windows\system32\drivers\futivxky.sys"
"c:\windows\system32\drivers\gbdgpvmp.sys"
"c:\windows\system32\drivers\gixhodhe.sys"
"c:\windows\system32\drivers\hrxbwvyq.sys"
"c:\windows\system32\drivers\htiyosgw.sys"
"c:\windows\system32\drivers\htppitnx.sys"
"c:\windows\system32\drivers\hvojtjsi.sys"
"c:\windows\system32\drivers\hxgsrnvb.sys"
"c:\windows\system32\drivers\ilupgdrf.sys"
"c:\windows\system32\drivers\ivokjffn.sys"
"c:\windows\system32\drivers\iwgbvuzz.sys"
"c:\windows\system32\drivers\jpjxgegu.sys"
"c:\windows\system32\drivers\jqlmmxmo.sys"
"c:\windows\system32\drivers\jtgloxjd.sys"
"c:\windows\system32\drivers\kezqjzwv.sys"
"c:\windows\system32\drivers\kgdlugom.sys"
"c:\windows\system32\drivers\kqphnpxx.sys"
"c:\windows\system32\drivers\lbbmnnck.sys"
"c:\windows\system32\drivers\lvznunwm.sys"
"c:\windows\system32\drivers\mebcuenk.sys"
"c:\windows\system32\drivers\mgqncrvd.sys"
"c:\windows\system32\drivers\mnpizyay.sys"
"c:\windows\system32\drivers\mqhiexdl.sys"
"c:\windows\system32\drivers\nnzmxxfr.sys"
"c:\windows\system32\drivers\nujliuxs.sys"
"c:\windows\system32\drivers\obcrrjka.sys"
"c:\windows\system32\drivers\pilomcls.sys"
"c:\windows\system32\drivers\pnsvathj.sys"
"c:\windows\system32\drivers\qtaqjlpz.sys"
"c:\windows\system32\drivers\rdvcwgbs.sys"
"c:\windows\system32\drivers\rlyubqzs.sys"
"c:\windows\system32\drivers\rotlldti.sys"
"c:\windows\system32\drivers\rypadabf.sys"
"c:\windows\system32\drivers\sdtgbmjp.sys"
"c:\windows\system32\drivers\sjrrmkgb.sys"
"c:\windows\system32\drivers\slimmnwe.sys"
"c:\windows\system32\drivers\sormzzom.sys"
"c:\windows\system32\drivers\tiuwbccl.sys"
"c:\windows\system32\drivers\tzmdahfe.sys"
"c:\windows\system32\drivers\uajicieq.sys"
"c:\windows\system32\drivers\ubqielxa.sys"
"c:\windows\system32\drivers\unxnybcn.sys"
"c:\windows\system32\drivers\uobzuams.sys"
"c:\windows\system32\drivers\uolngeap.sys"
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\leydier\Application Data\Toolbar4
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\156783.png
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\arrow_refresh.png
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\basis.xml
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\cache\ded0070427585a10b47dc38c30725f43
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\cog.png
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\computer_delete.png
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\descargar3.exe
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\favicon.png
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\games01.png
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\go_btn.png
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\icons.bmp
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\5563cef889bfa801bacf546650741142
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\a28fb005e91cf194594645214b0c743e
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\d218065c7312190b4bd44f226e0ddcb3
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\include_files\ed27fb3bbcc1f40fbf99c2f6a3664931
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\info.txt
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\logo.gif
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\stations.js
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\TbHelper2.exe
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\uninstall.exe
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\uninstaller.exe
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\update.exe
c:\documents and settings\leydier\Application Data\Toolbar4\8FFA7469-654F-423E-84FE-6A583CB1C284\version.txt
c:\program files\RechercherWeb Toolbar
c:\program files\RechercherWeb Toolbar\156783.png
c:\program files\RechercherWeb Toolbar\arrow_refresh.png
c:\program files\RechercherWeb Toolbar\basis.xml
c:\program files\RechercherWeb Toolbar\cog.png
c:\program files\RechercherWeb Toolbar\computer_delete.png
c:\program files\RechercherWeb Toolbar\descargar3.exe
c:\program files\RechercherWeb Toolbar\favicon.png
c:\program files\RechercherWeb Toolbar\games01.png
c:\program files\RechercherWeb Toolbar\go_btn.png
c:\program files\RechercherWeb Toolbar\icons.bmp
c:\program files\RechercherWeb Toolbar\info.txt
c:\program files\RechercherWeb Toolbar\logo.gif
c:\program files\RechercherWeb Toolbar\stations.js
c:\program files\RechercherWeb Toolbar\TbCommonUtils.dll
c:\program files\RechercherWeb Toolbar\tbcore3.dll
c:\program files\RechercherWeb Toolbar\tbhelper.dll
c:\program files\RechercherWeb Toolbar\TbHelper2.exe
c:\program files\RechercherWeb Toolbar\toolbar1.dll
c:\program files\RechercherWeb Toolbar\uninstall.exe
c:\program files\RechercherWeb Toolbar\uninstaller.exe
c:\program files\RechercherWeb Toolbar\update.exe
c:\program files\RechercherWeb Toolbar\version.txt
c:\windows\system32\
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_abokrjcj
-------\Service_ahzjbiec
-------\Service_ajcvqnrd
-------\Service_atmyfxoq
-------\Service_attlqhft
-------\Service_avvncbdn
-------\Service_bgjwvcap
-------\Service_bkfcizrv
-------\Service_bmbicibu
-------\Service_booeotiy
-------\Service_cikhmcix
-------\Service_cpzbsdyx
-------\Service_dciefels
-------\Service_dweyjqhh
-------\Service_dyhzzxfo
-------\Service_dyvrmaqx
-------\Service_edbjgmue
-------\Service_egscnlxa
-------\Service_ehfrluce
-------\Service_ejmsstux
-------\Service_eqspzxer
-------\Service_etydbbhb
-------\Service_ffoehtlw
-------\Service_fhkxmcqr
-------\Service_fllsvcuu
-------\Service_fuostfjq
-------\Service_futivxky
-------\Service_gbdgpvmp
-------\Service_gixhodhe
-------\Service_hrxbwvyq
-------\Service_htiyosgw
-------\Service_htppitnx
-------\Service_hvojtjsi
-------\Service_hxgsrnvb
-------\Service_ilupgdrf
-------\Service_ivokjffn
-------\Service_iwgbvuzz
-------\Service_jpjxgegu
-------\Service_jqlmmxmo
-------\Service_jtgloxjd
-------\Service_kezqjzwv
-------\Service_kgdlugom
-------\Service_kqphnpxx
-------\Service_lbbmnnck
-------\Service_lvznunwm
-------\Service_mebcuenk
-------\Service_mgqncrvd
-------\Service_mnpizyay
-------\Service_mqhiexdl
-------\Service_nnzmxxfr
-------\Service_nujliuxs
-------\Service_obcrrjka
-------\Service_pilomcls
-------\Service_pnsvathj
-------\Service_qtaqjlpz
-------\Service_rdvcwgbs
-------\Service_rlyubqzs
-------\Service_rotlldti
-------\Service_rypadabf
-------\Service_sdtgbmjp
-------\Service_sjrrmkgb
-------\Service_slimmnwe
-------\Service_sormzzom
-------\Service_tiuwbccl
-------\Service_tzmdahfe
-------\Service_uajicieq
-------\Service_ubqielxa
-------\Service_unxnybcn
-------\Service_uobzuams
-------\Service_uolngeap
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-10-01 au 2011-11-01 ))))))))))))))))))))))))))))))))))))
.
.
2011-11-01 16:19 . 2011-11-01 16:19 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEABEE5-AB1A-4775-8672-18CBD5E57D52}\MpKsldf1d4841.sys
2011-11-01 15:58 . 2011-11-01 16:00 -------- d-----w- C:\TROMBOFIX.EXE
2011-11-01 00:57 . 2011-11-01 00:57 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEABEE5-AB1A-4775-8672-18CBD5E57D52}\MpKsledea8767.sys
2011-11-01 00:56 . 2011-11-01 16:19 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEABEE5-AB1A-4775-8672-18CBD5E57D52}\offreg.dll
2011-10-31 23:25 . 2011-10-31 23:27 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2011-10-31 22:42 . 2011-10-31 22:42 512 ----a-w- C:\PhysicalDisk0_MBR.bin
2011-10-31 22:27 . 2011-10-31 22:42 -------- d-----w- C:\ZHP
2011-10-31 22:26 . 2011-10-31 22:42 -------- d-----w- c:\program files\ZHPDiag
2011-10-31 16:54 . 2011-10-31 16:54 41680 ----a-w- c:\windows\system32\drivers\qwuehfge.sys
2011-10-31 16:39 . 2011-10-31 16:39 41680 ----a-w- c:\windows\system32\drivers\odjevbjh.sys
2011-10-31 16:24 . 2011-10-31 16:24 41680 ----a-w- c:\windows\system32\drivers\tckgqnfx.sys
2011-10-31 16:09 . 2011-10-31 16:09 41680 ----a-w- c:\windows\system32\drivers\twcslgee.sys
2011-10-31 15:55 . 2011-10-06 19:48 6668624 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEABEE5-AB1A-4775-8672-18CBD5E57D52}\mpengine.dll
2011-10-31 15:55 . 2011-10-31 15:55 41680 ----a-w- c:\windows\system32\drivers\vtdpnnjx.sys
2011-10-31 15:09 . 2011-10-31 15:09 -------- d-----w- c:\documents and settings\leydier\Local Settings\Application Data\FixItCenter
2011-10-31 14:48 . 2011-10-31 14:48 -------- d-----w- c:\windows\MATS
2011-10-31 14:48 . 2011-10-31 14:48 -------- d-----w- c:\program files\Microsoft Fix it Center
2011-10-31 14:43 . 2011-10-31 14:43 -------- d-----w- c:\documents and settings\leydier\Application Data\ElevatedDiagnostics
2011-10-31 13:10 . 2011-10-31 13:25 11368 ----a-w- C:\FixitRegBackup.reg
2011-10-30 14:43 . 2011-10-30 14:43 -------- d-----w- c:\windows\system32\wbem\Repository
2011-10-30 12:56 . 2011-10-30 14:41 -------- d-----w- c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}(2)
2011-10-30 12:37 . 2011-10-30 12:37 -------- d-----w- c:\documents and settings\leydier\Application Data\TuneUp Software
2011-10-30 12:37 . 2011-10-30 14:41 -------- d-----w- c:\program files\TuneUp Utilities 2011
2011-10-30 12:36 . 2011-10-30 14:41 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2011-10-30 12:08 . 2011-10-30 12:08 -------- d-----w- c:\documents and settings\leydier\Application Data\Uniblue
2011-10-29 22:17 . 2011-10-30 14:42 -------- d-----w- c:\program files\Microsoft Security Client
2011-10-29 21:32 . 2011-10-31 22:42 -------- d-sh--w- c:\documents and settings\leydier\Local Settings\Application Data\9cfd3235
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-06 19:48 . 2011-07-10 08:03 6668624 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-09-26 09:41 . 2011-09-26 09:41 614400 ------w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 1979-12-31 23:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 1979-12-31 23:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 09:12 . 1979-12-31 23:00 606208 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 14:10 . 1979-12-31 23:00 1859072 ----a-w- c:\windows\system32\win32k.sys
2011-09-02 06:22 . 2011-06-21 06:18 404640 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-17 21:24 . 1979-12-31 23:00 832512 ----a-w- c:\windows\system32\wininet.dll
2011-08-17 21:24 . 1979-12-31 23:00 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-08-17 21:24 . 2010-12-28 09:15 78336 ------w- c:\windows\system32\ieencode.dll
2011-08-17 21:24 . 1979-12-31 23:00 17408 ----a-w- c:\windows\system32\corpol.dll
2011-08-17 13:49 . 1979-12-31 23:00 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2011-08-17 12:22 . 2010-12-28 09:15 389120 ------w- c:\windows\system32\html.iec
2011-08-12 11:51 . 2010-12-28 10:54 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2001-10-25 15:14 . 2010-12-21 14:23 372736 -c--a-w- c:\program files\Super_PR.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-11-01_00.59.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-01 01:06 . 2011-11-01 01:06 18944 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f9f6ed920c3f3d419a2c2ca689ee74cf\Microsoft.PowerShell.Security.resources.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 31744 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\ea08066566f0fa46bc79ed28d0fea9ef\Microsoft.PowerShell.Commands.Utility.resources.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 37376 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\c39024e478399b41b97bd5ed061d6dcb\Microsoft.PowerShell.ConsoleHost.resources.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 20992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\5ac9fb729c8c0a47bb6009f11691e77d\Microsoft.PowerShell.Commands.Management.resources.ni.dll
+ 2011-11-01 01:05 . 2011-11-01 01:05 81920 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\94414d43c583824f8c0cab50021717ad\Microsoft.Build.Framework.ni.dll
+ 2011-11-01 01:05 . 2011-11-01 01:05 15360 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\7cf819c35cb15a41a7d72ec60fd30b51\dfsvc.ni.exe
+ 2011-11-01 01:04 . 2011-11-01 01:04 26624 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\785099e0752d364d876506db119ad7e5\Accessibility.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 684032 c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1C.tmp\System.Transactions.dll
+ 2011-11-01 01:24 . 2011-11-01 01:24 237568 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\eca7663c94d03d4c90c8b820235a6ec2\System.Web.RegularExpressions.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 729088 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\a144e4bdc3569642ac59e0344fe8766b\System.Security.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 184320 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\d1dd020f38eaf74fb02c597905bc4847\System.Management.Automation.resources.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 294912 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\7bb22a8afa9adc4281f33be8ac6c5229\System.EnterpriseServices.Wrapper.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 659456 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\7bb22a8afa9adc4281f33be8ac6c5229\System.EnterpriseServices.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 512000 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\09ae7b1538b88e4eaa29d91721bd85c3\System.DirectoryServices.Protocols.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 962560 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\3283d7cd97d0394ea4e37d0ad6c1082a\System.Configuration.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 524288 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\eeab8760adcca94fb3b50468e7b4866a\Microsoft.PowerShell.Commands.Management.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 552960 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\91ef5ebd3b228243aded3b7841b2890a\Microsoft.PowerShell.ConsoleHost.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 176128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\07e1ae01db71a34a94ee1ee9e05777e9\Microsoft.PowerShell.Security.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 163840 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\aa497155dac68e468a2c3f1f3fbd51bf\Microsoft.Build.Utilities.ni.dll
+ 2011-11-01 01:05 . 2011-11-01 01:05 880640 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\59267e45eaec314ea322f39f5c7b7834\Microsoft.Build.Engine.ni.dll
+ 2011-11-01 01:05 . 2011-11-01 01:05 237568 c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\660f691655dcb5478c641b1a2349c16c\CustomMarshalers.ni.dll
+ 2011-11-01 01:05 . 2011-11-01 01:05 860160 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\19f432bc74d65540b4810e634af1b6b5\AspNetMMCExt.ni.dll
+ 2011-11-01 01:24 . 2011-11-01 01:24 1945600 c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP20.tmp\System.Web.Services.dll
+ 2011-11-01 01:24 . 2011-11-01 01:24 2310144 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\8c47c56d21d87b4faa778d21f9a0fc5c\System.Web.Mobile.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 5271552 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\44ba66180535a349b2f1ae77c1b1b6cd\System.Management.Automation.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 1220608 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\ae6259926f88144abb75c831d52b8396\System.DirectoryServices.ni.dll
+ 2011-11-01 01:07 . 2011-11-01 01:07 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\ae92eca9129986408131ae25ace532ea\System.Deployment.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 1724416 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\598720969af2de428426ccbf82ebbead\Microsoft.VisualBasic.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 1069056 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\9bc5904fe86152478012894d53309a18\Microsoft.PowerShell.Commands.Utility.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 1691648 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\8070dba44d29ee4090d231b264a378af\Microsoft.Build.Tasks.ni.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2011-06-10 06:24 165256 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2011-06-10 959880]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^PC Clone EX.LNK]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\PC Clone EX.LNK
backup=c:\windows\pss\PC Clone EX.LNKCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 10:55 937920 ----a-w- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-05 17:04 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2010-10-27 17:17 207424 -c--a-w- c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
2001-09-15 00:15 245760 ----a-w- c:\windows\system32\atiptaxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EM_EXEC]
2001-08-24 08:40 35328 -c--a-w- c:\progra~1\MOUSEW~1\system\EM_EXEC.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
2010-01-18 17:27 139944 ----a-w- c:\program files\Lexmark S300-S400 Series\ezprint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxeamon.exe]
2010-01-18 17:27 770728 -c--a-w- c:\program files\Lexmark S300-S400 Series\lxeamon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2011-06-15 13:16 997920 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 15:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2011-04-22 12:21 247728 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TomTomHOMEService"=2 (0x2)
"lxea_device"=2 (0x2)
"lxeaCATSCustConnectService"=2 (0x2)
"ACDaemon"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\FinalMediaPlayer\\FMPCheckForUpdates.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\lxeacoms.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\scan\\scanman6.exe"=
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\Program Files\\Fichiers communs\\Microsoft Shared\\DW\\DW20.EXE"=
"c:\\Program Files\\Microsoft Fix it Center\\MatsWiz.exe"=
"c:\\Program Files\\Microsoft Fix it Center\\FixitCenter1st.exe"=
"c:\\Program Files\\Microsoft Fix it Center\\FixitCenter.exe"=
"c:\\Program Files\\CCleaner\\CCleaner.exe"=
"c:\\Program Files\\SFR\\Kit\\9launch.exe"=
"c:\\Program Files\\ZHPDiag\\ZHPDiag.exe"=
.
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [19/12/2010 14:26 7040]
R1 MpKsldf1d4841;MpKsldf1d4841;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEABEE5-AB1A-4775-8672-18CBD5E57D52}\MpKsldf1d4841.sys [01/11/2011 17:19 28752]
R1 MpKsledea8767;MpKsledea8767;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEABEE5-AB1A-4775-8672-18CBD5E57D52}\MpKsledea8767.sys [01/11/2011 01:57 28752]
R3 CVIAAUD;NEC VIA 3D Environmental Audio;c:\windows\system32\drivers\cviaaud.sys [01/01/1980 320864]
R3 CVIAHALA;CVIAHALA;c:\windows\system32\drivers\cviahal.sys [01/01/1980 214688]
R3 PxHelper;PxHelper;c:\windows\system32\drivers\PxHelper.sys [19/12/2010 12:17 15776]
S1 MpKsl01167cd6;MpKsl01167cd6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsl01167cd6.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsl01167cd6.sys [?]
S1 MpKsl0e16056f;MpKsl0e16056f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E7BED0D-7738-4DDC-B2AC-B5DB95995737}\MpKsl0e16056f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E7BED0D-7738-4DDC-B2AC-B5DB95995737}\MpKsl0e16056f.sys [?]
S1 MpKsl15a74f0b;MpKsl15a74f0b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C804D43E-1277-4E84-8A48-3B2827FCEC42}\MpKsl15a74f0b.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C804D43E-1277-4E84-8A48-3B2827FCEC42}\MpKsl15a74f0b.sys [?]
S1 MpKsl1a422d4f;MpKsl1a422d4f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9A4682C-4F5D-44EB-B468-8739F8C120FA}\MpKsl1a422d4f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9A4682C-4F5D-44EB-B468-8739F8C120FA}\MpKsl1a422d4f.sys [?]
S1 MpKsl1bfbfc32;MpKsl1bfbfc32;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F60AAE2B-AC6B-4E47-9E1A-195ED50749DC}\MpKsl1bfbfc32.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F60AAE2B-AC6B-4E47-9E1A-195ED50749DC}\MpKsl1bfbfc32.sys [?]
S1 MpKsl2c9fb12f;MpKsl2c9fb12f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A83E1A8B-4886-4693-A8EC-D323A3B0E250}\MpKsl2c9fb12f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A83E1A8B-4886-4693-A8EC-D323A3B0E250}\MpKsl2c9fb12f.sys [?]
S1 MpKsl307e05bc;MpKsl307e05bc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{68A16570-9BE3-4A3E-869E-2A8DB83AB516}\MpKsl307e05bc.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{68A16570-9BE3-4A3E-869E-2A8DB83AB516}\MpKsl307e05bc.sys [?]
S1 MpKsl39b772c2;MpKsl39b772c2;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{353E8CA6-C5F2-4F72-8D8D-06F2B429ECB3}\MpKsl39b772c2.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{353E8CA6-C5F2-4F72-8D8D-06F2B429ECB3}\MpKsl39b772c2.sys [?]
S1 MpKsl53841977;MpKsl53841977;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE7B5757-43A8-410A-9393-D3BD7A9B3862}\MpKsl53841977.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE7B5757-43A8-410A-9393-D3BD7A9B3862}\MpKsl53841977.sys [?]
S1 MpKsl68035b7c;MpKsl68035b7c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3D36E30A-605A-4CB1-8DDE-11465C57C274}\MpKsl68035b7c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3D36E30A-605A-4CB1-8DDE-11465C57C274}\MpKsl68035b7c.sys [?]
S1 MpKsl6c8c5fba;MpKsl6c8c5fba;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7EBEB62D-C684-4068-BBA6-7BF34577C267}\MpKsl6c8c5fba.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7EBEB62D-C684-4068-BBA6-7BF34577C267}\MpKsl6c8c5fba.sys [?]
S1 MpKsl7e3cac6d;MpKsl7e3cac6d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{482F684A-4B14-40FD-B48B-D28C42CF4E89}\MpKsl7e3cac6d.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{482F684A-4B14-40FD-B48B-D28C42CF4E89}\MpKsl7e3cac6d.sys [?]
S1 MpKsl8478db31;MpKsl8478db31;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4ADC9FB8-0633-4A89-96E8-D065CDF04FA8}\MpKsl8478db31.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4ADC9FB8-0633-4A89-96E8-D065CDF04FA8}\MpKsl8478db31.sys [?]
S1 MpKsl8f34221f;MpKsl8f34221f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D00B33A8-2010-47E0-AE88-4608E8070937}\MpKsl8f34221f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D00B33A8-2010-47E0-AE88-4608E8070937}\MpKsl8f34221f.sys [?]
S1 MpKsl8fbb6121;MpKsl8fbb6121;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55DB2C13-43A4-45A7-BBBB-893A5020F818}\MpKsl8fbb6121.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55DB2C13-43A4-45A7-BBBB-893A5020F818}\MpKsl8fbb6121.sys [?]
S1 MpKsl98b7b3f0;MpKsl98b7b3f0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{AE9AE752-E286-4525-9BAA-3342F8C5ECD5}\MpKsl98b7b3f0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{AE9AE752-E286-4525-9BAA-3342F8C5ECD5}\MpKsl98b7b3f0.sys [?]
S1 MpKslc340bc73;MpKslc340bc73;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{84D3DC1C-1D20-476D-9D9B-9BA06841B6DD}\MpKslc340bc73.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{84D3DC1C-1D20-476D-9D9B-9BA06841B6DD}\MpKslc340bc73.sys [?]
S1 MpKsld4fd4d25;MpKsld4fd4d25;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsld4fd4d25.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsld4fd4d25.sys [?]
S1 MpKslf7f9de36;MpKslf7f9de36;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C0D6660-FA85-49F7-AA61-8855DDF81F6A}\MpKslf7f9de36.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C0D6660-FA85-49F7-AA61-8855DDF81F6A}\MpKslf7f9de36.sys [?]
S1 MpKslfcb37bf8;MpKslfcb37bf8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{86D7DFF5-8AF1-4CE6-9894-DB62A2D407F4}\MpKslfcb37bf8.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{86D7DFF5-8AF1-4CE6-9894-DB62A2D407F4}\MpKslfcb37bf8.sys [?]
S1 mplmvswf;mplmvswf;\??\c:\windows\system32\drivers\mplmvswf.sys --> c:\windows\system32\drivers\mplmvswf.sys [?]
S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [13/06/2011 22:09 267568]
S3 TrueSight;TrueSight;c:\windows\system32\drivers\TrueSight.sys [01/11/2011 00:25 111872]
S4 lxea_device;lxea_device;c:\windows\system32\lxeacoms.exe -service --> c:\windows\system32\lxeacoms.exe -service [?]
S4 lxeaCATSCustConnectService;lxeaCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxeaserv.exe [10/07/2011 09:39 91240]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [22/04/2011 13:21 92592]
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - MPKSLDF1D4841
.
Contenu du dossier 'Tâches planifiées'
.
2011-11-01 c:\windows\Tasks\ConfigExec.job
- c:\program files\Microsoft Fix it Center\MatsApi.dll [2011-06-13 21:09]
.
2011-10-31 c:\windows\Tasks\DataUpload.job
- c:\program files\Microsoft Fix it Center\MatsApi.dll [2011-06-13 21:09]
.
2011-11-01 c:\windows\Tasks\Final Media Player Update Checker.job
- c:\program files\FinalMediaPlayer\FMPCheckForUpdates.exe [2011-03-16 15:50]
.
2011-11-01 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 13:39]
.
2010-12-19 c:\windows\Tasks\Rappel d'enregistrement 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2010-12-19 02:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
mStart Page = hxxp://wwwmywebsites.com
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-{8FFA7469-654F-423E-84FE-6A583CB1C284} - c:\program files\RechercherWeb Toolbar\tbcore3.dll
WebBrowser-{8FFA7469-654F-423E-84FE-6A583CB1C284} - c:\program files\RechercherWeb Toolbar\tbcore3.dll
AddRemove-RechercherWeb Toolbar - c:\program files\RechercherWeb Toolbar\uninstaller.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-01 17:20
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(3056)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\ArcSoft\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
.
**************************************************************************
.
Heure de fin: 2011-11-01 17:27:47 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-11-01 16:27
ComboFix2.txt 2011-11-01 01:08
.
Avant-CF: 19 612 540 928 octets libres
Après-CF: 19 583 737 856 octets libres
.
- - End Of File - - 334500788A038E1D5D1234DE476A45C0

Télécharger DummyCreator.zip http://download.bleepingcomputer.co[...]ummyCreator.zip et décompresser cette archive sur le bureau

Lancer l'exécution de l'outil.

http://assiste.com.free.fr/m/nick/DummyCreator

Copie/colle la ligne ci-dessous dans la zone blanche:

c:\documents and settings\leydier\Local Settings\Application Data\9cfd3235

Cliquer sur le bouton Create et envoyez le rapport (contenu du fichier Result.txt).

Important: redémarrer le PC.

==========================================================================


Une fois le PC relancé, passe ce script combofix


- Télécharge CFScript.txt ici http://xdbbfy.1fichier.com/
Clique sur Click here to start your download pour commencer le téléchargement enregistre ce fichier dans le même dossier que Combofix, ce dernier terminé.

- Quitte ton navigateur ainsi que toutes les applications en cours.

Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture

http://img.photobucket.com/albums/v[...]Bs/CFScript.gif
http://moe.mabul.org/up/moe/2010/05[...]22465960m5e.gif

[*] Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

Note : La durée de téléchargement du script a été limité à une journée

Edité par zaede le 01/11/2011 à 20:34

http://assiste.com.free.fr/m/nick/DummyCreator. ERREUR 404 Comment poursuivre???

Ce n'est rien que l'image de l'outil
Un cadre blanc ou tu colles
c:\documents and settings\leydier\Local Settings\Application Data\9cfd3235

puis Create et envoyez le rapport (contenu du fichier Result.txt).

important, redémarre le PC



http://assiste.com.free.fr/m/nick/DummyCreator

Edité par zaede le 01/11/2011 à 20:35

DummyCreator by Farbar
Ran by leydier (administrator) on 01-11-2011 at 20:40:42
**************************************************************

c:\documents and settings\leydier\Local Settings\Application Data\9cfd3235 [01-11-2011 20:40:42]

== End of log ==

impeccable, lance combofix via le script

ComboFix 11-11-01.04 - leydier 01/11/2011 20:57:50.3.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.719 [GMT 1:00]
Lancé depuis: F:\TROMBOFIX.EXE.exe
Commutateurs utilisés :: c:\documents and settings\leydier\Bureau\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\windows\system32\drivers\odjevbjh.sys"
"c:\windows\system32\drivers\qwuehfge.sys"
"c:\windows\system32\drivers\tckgqnfx.sys"
"c:\windows\system32\drivers\twcslgee.sys"
"c:\windows\system32\drivers\vtdpnnjx.sys"
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\leydier\Local Settings\Application Data\9cfd3235
c:\program files\messenger\msmsgsin.exe
c:\program files\msn\msncorefiles\copymar.exe
c:\program files\msn\msncorefiles\custdial.dll
c:\program files\msn\msncorefiles\logonmgr.dll
c:\windows\help\tours\htmltour\unlock_playing.htm
c:\windows\pp.exe
c:\windows\system32\d3d9caps.dat
c:\windows\system32\drivers\odjevbjh.sys
c:\windows\system32\drivers\qwuehfge.sys
c:\windows\system32\drivers\tckgqnfx.sys
c:\windows\system32\drivers\twcslgee.sys
c:\windows\system32\drivers\vtdpnnjx.sys
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-10-01 au 2011-11-01 ))))))))))))))))))))))))))))))))))))
.
.
2011-11-01 20:08 . 2011-11-01 20:08 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C823B5DA-6CE6-4115-8AC0-D7E9DC37488B}\MpKsl94179b26.sys
2011-11-01 19:47 . 2011-11-01 19:47 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C823B5DA-6CE6-4115-8AC0-D7E9DC37488B}\MpKsl47605a9e.sys
2011-11-01 19:47 . 2011-11-01 20:08 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C823B5DA-6CE6-4115-8AC0-D7E9DC37488B}\offreg.dll
2011-11-01 16:31 . 2011-10-06 19:48 6668624 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C823B5DA-6CE6-4115-8AC0-D7E9DC37488B}\mpengine.dll
2011-11-01 15:58 . 2011-11-01 16:00 -------- d-----w- C:\TROMBOFIX.EXE
2011-10-31 23:25 . 2011-10-31 23:27 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2011-10-31 22:42 . 2011-10-31 22:42 512 ----a-w- C:\PhysicalDisk0_MBR.bin
2011-10-31 22:27 . 2011-10-31 22:42 -------- d-----w- C:\ZHP
2011-10-31 22:26 . 2011-10-31 22:42 -------- d-----w- c:\program files\ZHPDiag
2011-10-31 15:09 . 2011-10-31 15:09 -------- d-----w- c:\documents and settings\leydier\Local Settings\Application Data\FixItCenter
2011-10-31 14:48 . 2011-10-31 14:48 -------- d-----w- c:\windows\MATS
2011-10-31 14:48 . 2011-10-31 14:48 -------- d-----w- c:\program files\Microsoft Fix it Center
2011-10-31 14:43 . 2011-10-31 14:43 -------- d-----w- c:\documents and settings\leydier\Application Data\ElevatedDiagnostics
2011-10-31 13:10 . 2011-10-31 13:25 11368 ----a-w- C:\FixitRegBackup.reg
2011-10-30 14:43 . 2011-10-30 14:43 -------- d-----w- c:\windows\system32\wbem\Repository
2011-10-30 12:56 . 2011-10-30 14:41 -------- d-----w- c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}(2)
2011-10-30 12:37 . 2011-10-30 12:37 -------- d-----w- c:\documents and settings\leydier\Application Data\TuneUp Software
2011-10-30 12:37 . 2011-10-30 14:41 -------- d-----w- c:\program files\TuneUp Utilities 2011
2011-10-30 12:36 . 2011-10-30 14:41 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2011-10-30 12:08 . 2011-10-30 12:08 -------- d-----w- c:\documents and settings\leydier\Application Data\Uniblue
2011-10-29 22:17 . 2011-10-30 14:42 -------- d-----w- c:\program files\Microsoft Security Client
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-06 19:48 . 2011-07-10 08:03 6668624 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-09-26 09:41 . 2011-09-26 09:41 614400 ------w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 1979-12-31 23:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 1979-12-31 23:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 09:12 . 1979-12-31 23:00 606208 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 14:10 . 1979-12-31 23:00 1859072 ----a-w- c:\windows\system32\win32k.sys
2011-09-02 06:22 . 2011-06-21 06:18 404640 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-17 21:24 . 1979-12-31 23:00 832512 ----a-w- c:\windows\system32\wininet.dll
2011-08-17 21:24 . 1979-12-31 23:00 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-08-17 21:24 . 2010-12-28 09:15 78336 ------w- c:\windows\system32\ieencode.dll
2011-08-17 21:24 . 1979-12-31 23:00 17408 ----a-w- c:\windows\system32\corpol.dll
2011-08-17 13:49 . 1979-12-31 23:00 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2011-08-17 12:22 . 2010-12-28 09:15 389120 ------w- c:\windows\system32\html.iec
2011-08-12 11:51 . 2010-12-28 10:54 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2001-10-25 15:14 . 2010-12-21 14:23 372736 -c--a-w- c:\program files\Super_PR.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-11-01_00.59.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-01 01:06 . 2011-11-01 01:06 18944 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f9f6ed920c3f3d419a2c2ca689ee74cf\Microsoft.PowerShell.Security.resources.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 31744 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\ea08066566f0fa46bc79ed28d0fea9ef\Microsoft.PowerShell.Commands.Utility.resources.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 37376 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\c39024e478399b41b97bd5ed061d6dcb\Microsoft.PowerShell.ConsoleHost.resources.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 20992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\5ac9fb729c8c0a47bb6009f11691e77d\Microsoft.PowerShell.Commands.Management.resources.ni.dll
+ 2011-11-01 01:05 . 2011-11-01 01:05 81920 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\94414d43c583824f8c0cab50021717ad\Microsoft.Build.Framework.ni.dll
+ 2011-11-01 01:05 . 2011-11-01 01:05 15360 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\7cf819c35cb15a41a7d72ec60fd30b51\dfsvc.ni.exe
+ 2011-11-01 01:04 . 2011-11-01 01:04 26624 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\785099e0752d364d876506db119ad7e5\Accessibility.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 684032 c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1C.tmp\System.Transactions.dll
+ 2011-11-01 01:24 . 2011-11-01 01:24 237568 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\eca7663c94d03d4c90c8b820235a6ec2\System.Web.RegularExpressions.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 729088 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\a144e4bdc3569642ac59e0344fe8766b\System.Security.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 184320 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\d1dd020f38eaf74fb02c597905bc4847\System.Management.Automation.resources.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 294912 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\7bb22a8afa9adc4281f33be8ac6c5229\System.EnterpriseServices.Wrapper.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 659456 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\7bb22a8afa9adc4281f33be8ac6c5229\System.EnterpriseServices.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 512000 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\09ae7b1538b88e4eaa29d91721bd85c3\System.DirectoryServices.Protocols.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 962560 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\3283d7cd97d0394ea4e37d0ad6c1082a\System.Configuration.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 524288 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\eeab8760adcca94fb3b50468e7b4866a\Microsoft.PowerShell.Commands.Management.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 552960 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\91ef5ebd3b228243aded3b7841b2890a\Microsoft.PowerShell.ConsoleHost.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 176128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\07e1ae01db71a34a94ee1ee9e05777e9\Microsoft.PowerShell.Security.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 163840 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\aa497155dac68e468a2c3f1f3fbd51bf\Microsoft.Build.Utilities.ni.dll
+ 2011-11-01 01:05 . 2011-11-01 01:05 880640 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\59267e45eaec314ea322f39f5c7b7834\Microsoft.Build.Engine.ni.dll
+ 2011-11-01 01:05 . 2011-11-01 01:05 237568 c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\660f691655dcb5478c641b1a2349c16c\CustomMarshalers.ni.dll
+ 2011-11-01 01:05 . 2011-11-01 01:05 860160 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\19f432bc74d65540b4810e634af1b6b5\AspNetMMCExt.ni.dll
+ 2011-11-01 01:24 . 2011-11-01 01:24 1945600 c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP20.tmp\System.Web.Services.dll
+ 2011-11-01 01:24 . 2011-11-01 01:24 2310144 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\8c47c56d21d87b4faa778d21f9a0fc5c\System.Web.Mobile.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 5271552 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\44ba66180535a349b2f1ae77c1b1b6cd\System.Management.Automation.ni.dll
+ 2011-11-01 01:22 . 2011-11-01 01:22 1220608 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\ae6259926f88144abb75c831d52b8396\System.DirectoryServices.ni.dll
+ 2011-11-01 01:07 . 2011-11-01 01:07 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\ae92eca9129986408131ae25ace532ea\System.Deployment.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 1724416 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\598720969af2de428426ccbf82ebbead\Microsoft.VisualBasic.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 1069056 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\9bc5904fe86152478012894d53309a18\Microsoft.PowerShell.Commands.Utility.ni.dll
+ 2011-11-01 01:06 . 2011-11-01 01:06 1691648 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\8070dba44d29ee4090d231b264a378af\Microsoft.Build.Tasks.ni.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2011-06-10 06:24 165256 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2011-06-10 959880]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^PC Clone EX.LNK]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\PC Clone EX.LNK
backup=c:\windows\pss\PC Clone EX.LNKCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 10:55 937920 ----a-w- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-05 17:04 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2010-10-27 17:17 207424 -c--a-w- c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
2001-09-15 00:15 245760 ----a-w- c:\windows\system32\atiptaxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EM_EXEC]
2001-08-24 08:40 35328 -c--a-w- c:\progra~1\MOUSEW~1\system\EM_EXEC.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
2010-01-18 17:27 139944 ----a-w- c:\program files\Lexmark S300-S400 Series\ezprint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxeamon.exe]
2010-01-18 17:27 770728 -c--a-w- c:\program files\Lexmark S300-S400 Series\lxeamon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2011-06-15 13:16 997920 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 15:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2011-04-22 12:21 247728 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TomTomHOMEService"=2 (0x2)
"lxea_device"=2 (0x2)
"lxeaCATSCustConnectService"=2 (0x2)
"ACDaemon"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\FinalMediaPlayer\\FMPCheckForUpdates.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\lxeacoms.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\scan\\scanman6.exe"=
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\Program Files\\Fichiers communs\\Microsoft Shared\\DW\\DW20.EXE"=
"c:\\Program Files\\Microsoft Fix it Center\\MatsWiz.exe"=
"c:\\Program Files\\Microsoft Fix it Center\\FixitCenter1st.exe"=
"c:\\Program Files\\Microsoft Fix it Center\\FixitCenter.exe"=
"c:\\Program Files\\CCleaner\\CCleaner.exe"=
"c:\\Program Files\\SFR\\Kit\\9launch.exe"=
"c:\\Program Files\\ZHPDiag\\ZHPDiag.exe"=
.
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [19/12/2010 14:26 7040]
R1 MpKsl47605a9e;MpKsl47605a9e;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C823B5DA-6CE6-4115-8AC0-D7E9DC37488B}\MpKsl47605a9e.sys [01/11/2011 20:47 28752]
R1 MpKsl94179b26;MpKsl94179b26;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C823B5DA-6CE6-4115-8AC0-D7E9DC37488B}\MpKsl94179b26.sys [01/11/2011 21:08 28752]
R3 CVIAAUD;NEC VIA 3D Environmental Audio;c:\windows\system32\drivers\cviaaud.sys [01/01/1980 320864]
R3 CVIAHALA;CVIAHALA;c:\windows\system32\drivers\cviahal.sys [01/01/1980 214688]
R3 PxHelper;PxHelper;c:\windows\system32\drivers\PxHelper.sys [19/12/2010 12:17 15776]
S1 MpKsl01167cd6;MpKsl01167cd6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsl01167cd6.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsl01167cd6.sys [?]
S1 MpKsl0e16056f;MpKsl0e16056f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E7BED0D-7738-4DDC-B2AC-B5DB95995737}\MpKsl0e16056f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E7BED0D-7738-4DDC-B2AC-B5DB95995737}\MpKsl0e16056f.sys [?]
S1 MpKsl15a74f0b;MpKsl15a74f0b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C804D43E-1277-4E84-8A48-3B2827FCEC42}\MpKsl15a74f0b.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C804D43E-1277-4E84-8A48-3B2827FCEC42}\MpKsl15a74f0b.sys [?]
S1 MpKsl1a422d4f;MpKsl1a422d4f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9A4682C-4F5D-44EB-B468-8739F8C120FA}\MpKsl1a422d4f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9A4682C-4F5D-44EB-B468-8739F8C120FA}\MpKsl1a422d4f.sys [?]
S1 MpKsl1bfbfc32;MpKsl1bfbfc32;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F60AAE2B-AC6B-4E47-9E1A-195ED50749DC}\MpKsl1bfbfc32.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F60AAE2B-AC6B-4E47-9E1A-195ED50749DC}\MpKsl1bfbfc32.sys [?]
S1 MpKsl2c9fb12f;MpKsl2c9fb12f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A83E1A8B-4886-4693-A8EC-D323A3B0E250}\MpKsl2c9fb12f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A83E1A8B-4886-4693-A8EC-D323A3B0E250}\MpKsl2c9fb12f.sys [?]
S1 MpKsl307e05bc;MpKsl307e05bc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{68A16570-9BE3-4A3E-869E-2A8DB83AB516}\MpKsl307e05bc.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{68A16570-9BE3-4A3E-869E-2A8DB83AB516}\MpKsl307e05bc.sys [?]
S1 MpKsl39b772c2;MpKsl39b772c2;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{353E8CA6-C5F2-4F72-8D8D-06F2B429ECB3}\MpKsl39b772c2.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{353E8CA6-C5F2-4F72-8D8D-06F2B429ECB3}\MpKsl39b772c2.sys [?]
S1 MpKsl53841977;MpKsl53841977;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE7B5757-43A8-410A-9393-D3BD7A9B3862}\MpKsl53841977.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE7B5757-43A8-410A-9393-D3BD7A9B3862}\MpKsl53841977.sys [?]
S1 MpKsl68035b7c;MpKsl68035b7c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3D36E30A-605A-4CB1-8DDE-11465C57C274}\MpKsl68035b7c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3D36E30A-605A-4CB1-8DDE-11465C57C274}\MpKsl68035b7c.sys [?]
S1 MpKsl6c8c5fba;MpKsl6c8c5fba;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7EBEB62D-C684-4068-BBA6-7BF34577C267}\MpKsl6c8c5fba.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7EBEB62D-C684-4068-BBA6-7BF34577C267}\MpKsl6c8c5fba.sys [?]
S1 MpKsl7e3cac6d;MpKsl7e3cac6d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{482F684A-4B14-40FD-B48B-D28C42CF4E89}\MpKsl7e3cac6d.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{482F684A-4B14-40FD-B48B-D28C42CF4E89}\MpKsl7e3cac6d.sys [?]
S1 MpKsl8478db31;MpKsl8478db31;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4ADC9FB8-0633-4A89-96E8-D065CDF04FA8}\MpKsl8478db31.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4ADC9FB8-0633-4A89-96E8-D065CDF04FA8}\MpKsl8478db31.sys [?]
S1 MpKsl8f34221f;MpKsl8f34221f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D00B33A8-2010-47E0-AE88-4608E8070937}\MpKsl8f34221f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D00B33A8-2010-47E0-AE88-4608E8070937}\MpKsl8f34221f.sys [?]
S1 MpKsl8fbb6121;MpKsl8fbb6121;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55DB2C13-43A4-45A7-BBBB-893A5020F818}\MpKsl8fbb6121.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55DB2C13-43A4-45A7-BBBB-893A5020F818}\MpKsl8fbb6121.sys [?]
S1 MpKsl98b7b3f0;MpKsl98b7b3f0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{AE9AE752-E286-4525-9BAA-3342F8C5ECD5}\MpKsl98b7b3f0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{AE9AE752-E286-4525-9BAA-3342F8C5ECD5}\MpKsl98b7b3f0.sys [?]
S1 MpKslc340bc73;MpKslc340bc73;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{84D3DC1C-1D20-476D-9D9B-9BA06841B6DD}\MpKslc340bc73.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{84D3DC1C-1D20-476D-9D9B-9BA06841B6DD}\MpKslc340bc73.sys [?]
S1 MpKsld4fd4d25;MpKsld4fd4d25;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsld4fd4d25.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{047EBC34-A7BC-493A-817C-A4CD4426A7EA}\MpKsld4fd4d25.sys [?]
S1 MpKslf7f9de36;MpKslf7f9de36;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C0D6660-FA85-49F7-AA61-8855DDF81F6A}\MpKslf7f9de36.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C0D6660-FA85-49F7-AA61-8855DDF81F6A}\MpKslf7f9de36.sys [?]
S1 MpKslfcb37bf8;MpKslfcb37bf8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{86D7DFF5-8AF1-4CE6-9894-DB62A2D407F4}\MpKslfcb37bf8.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{86D7DFF5-8AF1-4CE6-9894-DB62A2D407F4}\MpKslfcb37bf8.sys [?]
S1 mplmvswf;mplmvswf;\??\c:\windows\system32\drivers\mplmvswf.sys --> c:\windows\system32\drivers\mplmvswf.sys [?]
S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [13/06/2011 22:09 267568]
S3 TrueSight;TrueSight;c:\windows\system32\drivers\TrueSight.sys [01/11/2011 00:25 111872]
S4 lxea_device;lxea_device;c:\windows\system32\lxeacoms.exe -service --> c:\windows\system32\lxeacoms.exe -service [?]
S4 lxeaCATSCustConnectService;lxeaCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxeaserv.exe [10/07/2011 09:39 91240]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [22/04/2011 13:21 92592]
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - MPKSL94179B26
.
Contenu du dossier 'Tâches planifiées'
.
2011-11-01 c:\windows\Tasks\ConfigExec.job
- c:\program files\Microsoft Fix it Center\MatsApi.dll [2011-06-13 21:09]
.
2011-11-01 c:\windows\Tasks\DataUpload.job
- c:\program files\Microsoft Fix it Center\MatsApi.dll [2011-06-13 21:09]
.
2011-11-01 c:\windows\Tasks\Final Media Player Update Checker.job
- c:\program files\FinalMediaPlayer\FMPCheckForUpdates.exe [2011-03-16 15:50]
.
2011-11-01 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 13:39]
.
2010-12-19 c:\windows\Tasks\Rappel d'enregistrement 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2010-12-19 02:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
mStart Page = hxxp://wwwmywebsites.com
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-01 21:08
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(2592)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\ArcSoft\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
.
**************************************************************************
.
Heure de fin: 2011-11-01 21:18:02 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-11-01 20:17
ComboFix2.txt 2011-11-01 16:27
ComboFix3.txt 2011-11-01 01:08
.
Avant-CF: 19 527 782 400 octets libres
Après-CF: 19 533 316 096 octets libres
.
- - End Of File - - 5C493E4F91A0A295A84C6BBD4768E867

avons nous fini Zaede, j'imagine que non ???

Bonsoir 2203, non pas encore
Tu as une amélioration?
Redémarre en mode normal et vérifie si tu peux connecter


Télécharge :

Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton bureau à partir de ce lien :

http://www.malwarebytes.org/mbam.php
http://www.malwarebytes.org/


Mets le à jour


- Lance MalwareByte's Anti-Malware

- Onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

- A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

- Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.


- Si MalwareByte's a détecté des infections, clique sur:

Afficher les résultat

Ensuite:

Supprimer la sélection

- Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

- Le rapport peut être retrouvé sous l'onglet Rapports/logs

- Ferme MBAM en cliquant sur Quitter.



Note : MalwareByte's peut être amené à redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Tutoriel pour MalwareByte's ici http://www.malekal.com/tutorial_Mal[...]AntiMalware.php


-Poste le rapport de malwarebyte's

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Version de la base de données: 8071

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

02/11/2011 23:35:54
mbam-log-2011-11-02 (23-35-54).txt

Type d'examen: Examen complet (C:\|G:\|)
Elément(s) analysé(s): 229293
Temps écoulé: 2 heure(s), 42 minute(s), 4 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\Qoobox\quarantine\C\documents and settings\leydier\application data\Toolbar4\8ffa7469-654f-423e-84fe-6a583cb1c284\descargar3.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\program files\rechercherweb toolbar\descargar3.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\system32\config\systemprofile\application data\Toolbar4\8ffa7469-654f-423e-84fe-6a583cb1c284\descargar3.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{672c4fe8-0c48-4a5f-b5fc-a88c14b7c189}\RP308\A0116849.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{672c4fe8-0c48-4a5f-b5fc-a88c14b7c189}\RP308\A0117037.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Bonjour Zaede ,

Bien sur que j'ai de l'amelioration .Deja je ne redoute plus d'arreter mon ordi, ensuite cela fonctionne correctement , un tantinet plus lent mais je languis de faire le vide sur le bureau et de remettre MSE comme anti virus . J'attends tes dernieres recommandations et merci déja pour le bon travail effectué....