supprimer virus,nettoyage complet...

dois partir reviens tantot. merci encore

Télécharge
ToolsCleaner (de A.Rothstein) sur ton Bureau.
http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
Clique sur Recherche et laisse le scan se terminer.
Clique sur Suppression pour finaliser.
tu peux, si tu le souhaites, te servir des Options facultatives.
Clique sur Quitter, pour que le rapport puisse se créer.
Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

Télécharge combofix.exe (par sUBs) sur ton Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

désactive ton antivirus, antispyware, et Spybot (résident) durant l'utilisation de ComboFix . Merci. Tu le réactiveras ensuite.

Double clique combofix.exe.
Tape sur la touche Y (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse
NOTE : Le rapport se trouve également ici : C:\Combofix.txt

-->- Recherche:
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Nom\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Nom\Bureau\MsnFix: trouvé !
C:\Documents and Settings\Nom\Local Settings\Temporary Internet Files\Content.IE5\2X5CMHFF\MSNFix[1]\MsnFix: trouvé !
C:\Documents and Settings\Nom\Local Settings\Temporary Internet Files\Content.IE5\W4HJAXOL\MSNFix[1]\MsnFix: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
---------------------------------
-->- Suppression:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Nom\Bureau\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Combofix: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\Nom\Bureau\MsnFix: supprimé !
C:\Documents and Settings\Nom\Local Settings\Temporary Internet Files\Content.IE5\2X5CMHFF\MSNFix[1]\MsnFix: supprimé !
C:\Documents and Settings\Nom\Local Settings\Temporary Internet Files\Content.IE5\W4HJAXOL\MSNFix[1]\MsnFix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

ComboFix 08-04-04.1 - Nom 2008-04-05 14:44:13.7 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.249 [GMT 2:00]
Endroit: C:\Documents and Settings\Nom\Local Settings\Temporary Internet Files\Content.IE5\052LGL01\ComboFix[1].exe
* Création d'un nouveau point de restauration
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-05 to 2008-04-05 ))))))))))))))))))))))))))))))))))))
.
2008-04-05 14:19 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-05 14:19 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-05 14:19 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-05 14:19 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-05 14:19 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-05 14:19 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-05 14:19 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-05 14:19 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-05 14:18 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-05 14:18 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-04 11:49 . 2008-04-04 11:49 d-------- C:\Documents and Settings\Nom\belgacom
2008-04-02 18:55 . 2008-04-02 18:55 244 --ah----- C:\sqmnoopt00.sqm
2008-04-02 18:55 . 2008-04-02 18:55 232 --ah----- C:\sqmdata00.sqm
2008-04-02 18:44 . 2008-04-02 18:44 0 --a------ C:\WINDOWS\system32\real.MSNFix
2008-04-02 14:16 . 2008-04-02 14:15 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-04-02 14:15 . 2008-04-02 14:16 d-------- C:\Program Files\Casc'ADSL
2008-04-02 09:50 . 2008-04-02 09:50 d-------- C:\Program Files\SupportSoft
2008-04-02 09:50 . 2008-04-02 09:50 d-------- C:\Program Files\CCleaner
2008-04-02 09:50 . 2008-04-02 09:50 d-------- C:\Documents and Settings\Application Data\SupportSoft
2008-04-02 09:50 . 2008-04-05 13:38 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-04-02 09:49 . 2008-04-02 09:49 d-------- C:\Program Files\Windows Live Favorites
2008-04-02 09:49 . 2008-04-02 09:49 d-------- C:\Program Files\Uniblue
2008-03-31 14:26 . 2008-03-31 14:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-31 14:26 . 2008-03-31 14:26 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-27 16:21 . 2008-03-27 16:21 d-------- C:\Documents and Settings\Nom\Application Data\Uniblue
2008-03-21 17:29 . 2008-03-21 17:39 2,524 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-18 16:50 . 2008-03-18 16:52 d-------- C:\Documents and Settings\Nom\Application Data\DMCache
2008-03-18 15:46 . 2008-03-18 15:46 d-------- C:\Program Files\microsoft frontpage
2008-03-11 21:11 . 2008-03-11 22:45 d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-10 15:50 . 2008-03-10 15:51 d-------- C:\Documents and Settings\All Users\Application Data\IM
2008-03-10 15:44 . 2008-03-10 15:44 d-------- C:\Documents and Settings\All Users\Application Data\IncrediMail
2008-03-09 16:49 . 2008-03-09 16:49 d-------- C:\Program Files\xtreme
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-05 12:39 --------- d-----w C:\Program Files\Trend Micro
2008-04-02 08:24 --------- d-----w C:\Program Files\eMule
2008-04-02 08:15 --------- d-----w C:\Documents and Settings\Nom\Application Data\LimeWire
2008-04-02 08:12 --------- d-----w C:\Program Files\LimeWire
2008-04-02 07:50 --------- d-----w C:\Program Files\QuickTime
2008-04-02 07:50 --------- d-----w C:\Program Files\Google
2008-04-02 07:49 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-04-02 07:49 --------- d-----w C:\Program Files\Windows Live
2008-04-02 07:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-31 12:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-31 12:32 --------- d-----w C:\Program Files\Belgacom
2008-03-11 20:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-04 09:10 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-22 21:08 --------- d-----w C:\Program Files\P2P_Torrent
2008-02-22 14:29 360,064 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2008-02-15 08:59 --------- d-----w C:\Documents and Settings\Nom\Application Data\Lavasoft
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-09 14:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2004-08-09 22:30 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
2007-08-10 21:05 66,936 --sha-w C:\WINDOWS\dlinfo_0.drv
.
------- Sigcheck -------
2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 18:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2008-02-22 16:29 360064 ed06c31200714e734118f9a47f5df5ce C:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-02-22 16:29 360064 ed06c31200714e734118f9a47f5df5ce C:\WINDOWS\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"NBJ"="C:\PROGRA~1\Ahead\NEROBA~1\NBJ.exe" [2005-05-19 20:38 1957888]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 01:55 110592 C:\WINDOWS\system32\bthprops.cpl]
"Belgacom"="C:\Program Files\Belgacom\bin\sprtcmd.exe" [2006-06-22 10:34 192512]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-16 11:45 63712]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll
"vidc.LEAD"= LCODCCMP.DLL
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C86 Series]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 MaBtPort;MA Bluetooth VCOM Driver;C:\WINDOWS\system32\DRIVERS\mabtport.sys [2005-07-22 09:07]
R3 MaBtVad;Mobile Action Bluetooth Audio;C:\WINDOWS\system32\DRIVERS\MaBtVad.sys [2005-08-23 06:04]
S3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 20:54]
S3 MaRdPnp;MaRdPnp;C:\WINDOWS\system32\DRIVERS\MaRdP2K.sys [2005-03-25 09:28]
S3 pohci13F;pohci13F;C:\DOCUME~1\Nom\LOCALS~1\Temp\pohci13F.sys []
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-23 12:05:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-05 14:49:32
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-05 14:54:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-05 12:53:59
Pre-Run: 57,570,914,304 octets libres
Post-Run: 57,558,310,912 octets libres
.
2008-03-14 18:15:11 --- E O F ---

voilà qui est fait maintenant je n'ai plus d'alertes enfin pour le moment et tout à l'air de bien fonctionner. a plus tard pour la suite et encore un grand merci chrifleur.

bonjour
oui mais cette fois on va aller au bout du bout afin d'être sures que tout est complètement propre, si tu veux bien; afin que tu ne reviennes pas infectée dans quelques jours....
va sur virus total
http://www.virustotal.com/
ou sur Jotti
http://virusscan.jotti.org/
et fais examiner ces fichiers qui me semblent + que suspects
C:\WINDOWS\iun6002.exe
C:\DOCUMENTS AND SETTINGS\Nom\LOCALS SETTINGS\Temp\pohci13F.sys
et poste les rapports

Fichier iun6002.exe reçu le 2008.04.05 23:44:04 (CET)
Situation actuelle: terminé
Résultat: 0/32 (0.00%)




AntivirusVersionDernière mise à jourRésultat

AhnLab-V3	2008.4.4.1	2008.04.04	-
AntiVir	7.6.0.81	2008.04.05	-
Authentium	4.93.8	2008.04.05	-
Avast	4.7.1098.0	2008.04.05	-
AVG	7.5.0.516	2008.04.05	-
BitDefender	7.2	2008.04.05	-
CAT-QuickHeal	9.50	2008.04.05	-
ClamAV	0.92.1	2008.04.05	-
DrWeb	4.44.0.09170	2008.04.05	-
eSafe	7.0.15.0	2008.04.01	-
eTrust-Vet	31.3.5672	2008.04.04	-
Ewido	4.0	2008.04.05	-
F-Prot	4.4.2.54	2008.04.05	-
F-Secure	6.70.13260.0	2008.04.05	-
FileAdvisor	1	2008.04.05	-
Fortinet	3.14.0.0	2008.04.05	-
Ikarus	T3.1.1.20.0	2008.04.05	-
Kaspersky	7.0.0.125	2008.04.05	-
McAfee	5267	2008.04.04	-
Microsoft	1.3408	2008.04.05	-
NOD32v2	3004	2008.04.05	-
Norman	5.80.02	2008.04.04	-
Panda	9.0.0.4	2008.04.05	-
Prevx1	V2	2008.04.05	-
Rising	20.38.60.00	2008.04.03	-
Sophos	4.28.0	2008.04.05	-
Sunbelt	3.0.1032.0	2008.04.05	-
Symantec	10	2008.04.05	-
TheHacker	6.2.92.266	2008.04.05	-
VBA32	3.12.6.4	2008.04.05	-
VirusBuster	4.3.26:9	2008.04.05	-
Webwasher-Gateway	6.6.2	2008.04.05	-

Information additionnelle

File size: 737280 bytes

MD5...: 456462905091db042141487fe030e3c9

SHA1..: bb57b4850528c3c8d9bf159fb5b9f414ddc7d5d7

SHA256: a93dc5e28d74ef40dd5d694aff7fb5f24c27dac4b59adae008cfdc5ca65587b0

SHA512: fdd82c126189454352b44c756be06e3e93ee26a93b56d99c3eb5254cac3f6d6e d71556765b76e65bd75efad461972044ce829443c006fc0816a28f7b4493296f

PEiD..: Armadillo v1.71

PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x45ec75 timedatestamp.....: 0x402aa809 (Wed Feb 11 22:09:13 2004) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x8436e 0x85000 6.52 1237ff6301825d5921b7f9a2f5139816 .rdata 0x86000 0x18156 0x19000 4.42 f6348df4f813de13cfb1e801130e5f79 .data 0x9f000 0x1193c 0xe000 5.13 596eac4f3dcfd1be5b3c6efaf752d891 .rsrc 0xb1000 0x6778 0x7000 3.64 d209a606411a3420b49c6373aa0bc2dc ( 14 imports ) > WINMM.dll: waveOutGetNumDevs > VERSION.dll: VerLanguageNameA, GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA > KERNEL32.dll: GetCPInfo, GetOEMCP, RtlUnwind, RaiseException, HeapFree, HeapAlloc, HeapReAlloc, GetTimeZoneInformation, GetSystemTime, GetLocalTime, ExitProcess, GetStartupInfoA, GetCommandLineA, GetACP, HeapSize, SetUnhandledExceptionFilter, GetEnvironmentVariableA, GlobalFlags, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, LCMapStringA, LCMapStringW, UnhandledExceptionFilter, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetStringTypeA, GetStringTypeW, IsBadCodePtr, SetStdHandle, CompareStringA, CompareStringW, SetEnvironmentVariableA, SetErrorMode, LocalReAlloc, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetVersion, GetCurrentThreadId, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, LockResource, FindResourceA, LoadResource, SystemTimeToFileTime, GetFileTime, FileTimeToSystemTime, WideCharToMultiByte, InterlockedDecrement, GetFullPathNameA, MoveFileA, UnlockFile, LockFile, FlushFileBuffers, DuplicateHandle, DosDateTimeToFileTime, LocalFileTimeToFileTime, SetFileTime, GetTickCount, IsBadStringPtrA, FileTimeToLocalFileTime, FileTimeToDosDateTime, lstrcmpiA, LocalAlloc, LocalLock, LocalUnlock, GlobalReAlloc, IsDBCSLeadByte, lstrcatA, TlsGetValue, IsBadReadPtr, TlsFree, TlsSetValue, TlsAlloc, MultiByteToWideChar, GetPrivateProfileIntA, GlobalMemoryStatus, GetVolumeInformationA, GetComputerNameA, MoveFileExA, WritePrivateProfileStringA, GetPrivateProfileStringA, TerminateProcess, Sleep, GetDiskFreeSpaceA, lstrcmpA, GetCurrentDirectoryA, LoadLibraryExA, GetLogicalDriveStringsA, GetShortPathNameA, CopyFileA, FormatMessageA, LocalFree, CreateProcessA, GetPrivateProfileSectionNamesA, GetPrivateProfileSectionA, GlobalAlloc, GlobalLock, GlobalHandle, GlobalUnlock, GlobalFree, GetCurrentThread, GetCurrentProcess, GetWindowsDirectoryA, GetSystemDirectoryA, GetSystemDefaultLangID, GetDriveTypeA, MulDiv, InterlockedIncrement, FindNextFileA, FindFirstFileA, FindClose, RemoveDirectoryA, SetCurrentDirectoryA, CreateDirectoryA, GetFileAttributesA, SetFileAttributesA, WriteFile, ReadFile, CreateFileA, GetFileSize, SetFilePointer, SetEndOfFile, DeleteFileA, GetTempPathA, GetTempFileNameA, lstrcpyA, lstrlenA, lstrcpynA, ExpandEnvironmentStringsA, GetProcessVersion, GetModuleFileNameA, OpenProcess, CloseHandle, GetModuleHandleA, LoadLibraryA, GetProcAddress, GetEnvironmentStrings, FreeEnvironmentStringsA, GetCurrentProcessId, FreeLibrary, GetVersionExA, GetLastError, SetLastError, HeapDestroy > USER32.dll: UnpackDDElParam, ReuseDDElParam, SetMenu, LoadMenuA, DestroyMenu, ReleaseCapture, TranslateAcceleratorA, LoadAcceleratorsA, SetRectEmpty, GetMessageA, ValidateRect, GetCursorPos, PtInRect, FillRect, DrawFocusRect, GrayStringA, DrawTextA, TabbedTextOutA, EndPaint, BeginPaint, ClientToScreen, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, MapWindowPoints, GetSysColor, GetFocus, AdjustWindowRectEx, ScreenToClient, EqualRect, DeferWindowPos, BeginDeferWindowPos, CopyRect, EndDeferWindowPos, IsWindowVisible, UnregisterClassA, GetTopWindow, GetCapture, WinHelpA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetKeyState, SetWindowsHookExA, CallNextHookEx, GetClassLongA, BringWindowToTop, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetMessagePos, GetLastActivePopup, GetForegroundWindow, GetWindow, SystemParametersInfoA, GetWindowPlacement, SetActiveWindow, CreateDialogIndirectParamA, GetParent, SetFocus, IsWindowEnabled, ShowWindow, MoveWindow, GetDlgCtrlID, IsDialogMessageA, SendDlgItemMessageA, GetDlgItem, UnhookWindowsHookEx, GetWindowTextLengthA, LoadStringA, WaitForInputIdle, SetDlgItemTextA, SetWindowTextA, SetForegroundWindow, EndDialog, DialogBoxParamA, GetActiveWindow, GetClassNameA, CharUpperA, OemToCharA, CharNextA, CharPrevA, CharUpperBuffA, SetCursor, IsIconic, DrawIcon, DestroyIcon, ExitWindowsEx, LoadCursorA, UpdateWindow, RedrawWindow, GetDesktopWindow, GetWindowTextA, EnumWindows, GetWindowThreadProcessId, PostMessageA, ShowOwnedPopups, GetSysColorBrush, SetPropA, SetWindowPos, MessageBoxA, MsgWaitForMultipleObjects, GetSystemMetrics, EnableWindow, InvalidateRect, GetClientRect, GetDC, ReleaseDC, GetWindowRect, LoadIconA, SendMessageTimeoutA, TranslateMessage, DispatchMessageA, PeekMessageA, PostQuitMessage, IsWindow, GetWindowLongA, DefWindowProcA, SetWindowLongA, GetClassInfoA, RegisterClassA, CreateWindowExA, SendMessageA, DestroyWindow, wsprintfA, RegisterWindowMessageA, GetNextDlgTabItem > GDI32.dll: SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SelectObject, RestoreDC, SaveDC, CreateCompatibleDC, BitBlt, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, ScaleWindowExtEx, SetWindowExtEx, DeleteObject, StretchDIBits, RealizePalette, SelectPalette, Rectangle, GetDeviceCaps, CreateFontA, CreateBitmap, SetTextColor, GetClipBox, GetBkColor, SetBkColor, SetBkMode, CreateICA, DeleteDC, GetTextMetricsA, RemoveFontResourceA, CreatePalette, GetStockObject, AddFontResourceA, CreateSolidBrush, CreateFontIndirectA, GetObjectA, ScaleViewportExtEx > comdlg32.dll: GetFileTitleA, GetOpenFileNameA, GetSaveFileNameA > WINSPOOL.DRV: DocumentPropertiesA, OpenPrinterA, ClosePrinter > ADVAPI32.dll: GetServiceDisplayNameA, RegOpenKeyExA, RegCreateKeyExA, RegDeleteValueA, RegDeleteKeyA, LookupPrivilegeValueA, AdjustTokenPrivileges, LookupAccountSidA, GetUserNameA, OpenThreadToken, OpenProcessToken, GetTokenInformation, AllocateAndInitializeSid, EqualSid, FreeSid, UnlockServiceDatabase, OpenSCManagerA, EnumServicesStatusA, QueryServiceStatus, ControlService, StartServiceA, DeleteService, CloseServiceHandle, CreateServiceA, OpenServiceA, RegCloseKey, RegConnectRegistryA, RegEnumValueA, RegEnumKeyExA, RegQueryInfoKeyA, RegSetValueExA, RegQueryValueExA > SHELL32.dll: DragFinish, SHChangeNotify, ShellExecuteA, SHBrowseForFolderA, SHGetFileInfoA, SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, DragQueryFileA > COMCTL32.dll: - > ole32.dll: CoInitialize, CoUninitialize, CoCreateInstance > OLEAUT32.dll: -, - > WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, - > NETAPI32.dll: Netbios ( 0 exports )

Bit9 info: http://fileadvisor.bit9.com/services/extinfo.aspx?md5=456462905091db042141487fe030e3c9

0 bytes size received / Se ha recibido un archivo vaciovoilà ce que ça affiche pour le deuxieme

The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file
tjs pour le deuxième sur l'autre site

voilà sinon je suppose que c'était bien ça le rapport?

pour le premier, il serait donc propre
pour le second, puisqu'il est vide pas de problème pour le virer, il ne m'inspire pas confiance et c'est la 2ème fois qu'il sort!

désactive ton antivirus, antispyware, et Spybot (résident) durant l'utilisation de ComboFix . Merci. Tu le réactiveras ensuite.

Ouvre le bloc-note
(Démarrer>programmes>Accessoires>Bloc-note) et copie-colle le texte en
citation :

Citation :

Driver::
pohci13F
Folder::
C:\WINDOWS\system32\real.MSNFix
File::
C:\WINDOWS\system32\tmp.reg
C:\DOCUME~1\Nom\LOCALS~1\Temp\pohci13F.sys
C:\WINDOWS\system32\real.MSNFix

Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt



Comme l'image le montre, fait glisser CFScript.txt sur Combofix.exe

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici >
C:\ComboFix.txt

re je n'ai plus combofix ou le telecharger déjà? merci

Télécharge combofix.exe (par
sUBs) sur ton Bureau


http://download.bleepingcomputer.com/sUBs/ComboFix.exe


désactive ton antivirus, antispyware, et Spybot
(résident) durant l'utilisation de ComboFix . Merci. Tu le réactiveras ensuite.

Tu c me dire comment faire pour télécharger directement sur le bureau stp? merci

1. Faites un clic droit sur le lien de ComboFix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-- et choisir ->

• Avec Firefox -> Enregistrer la cible du lien sous...
  
• Avec Internet Explorer -> Enregistrer la cible sous..
  
• Choisir le Bureau
  
• Cliquez enfin sur -> Enregistrer
  

ComboFix 08-04-06.1 - Nom 2008-04-07 11:47:14.8 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.256 [GMT 2:00]
Endroit: C:\Documents and Settings\Nom\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Nom\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
FILE ::
C:\DOCUME~1\Nom\LOCALS~1\Temp\pohci13F.sys
C:\WINDOWS\system32\real.MSNFix
C:\WINDOWS\system32\tmp.reg
.
TimedOut: progfile.dat
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\real.MSNFix
C:\WINDOWS\system32\real.MSNFix\
C:\WINDOWS\system32\tmp.reg
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-07 to 2008-04-07 ))))))))))))))))))))))))))))))))))))
.
2008-04-05 15:11 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-05 15:11 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-05 15:11 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-05 15:11 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-05 15:11 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-05 15:11 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-05 15:11 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-05 15:11 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-05 15:11 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-05 15:11 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-04 11:49 . 2008-04-04 11:49 d-------- C:\Documents and Settings\Nom\belgacom
2008-04-02 18:55 . 2008-04-02 18:55 244 --ah----- C:\sqmnoopt00.sqm
2008-04-02 18:55 . 2008-04-02 18:55 232 --ah----- C:\sqmdata00.sqm
2008-04-02 14:16 . 2008-04-02 14:15 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-04-02 14:15 . 2008-04-05 15:00 d-------- C:\Program Files\Casc'ADSL
2008-04-02 09:50 . 2008-04-02 09:50 d-------- C:\Program Files\SupportSoft
2008-04-02 09:50 . 2008-04-02 09:50 d-------- C:\Program Files\CCleaner
2008-04-02 09:50 . 2008-04-02 09:50 d-------- C:\Documents and Settings\Application Data\SupportSoft
2008-04-02 09:50 . 2008-04-07 09:02 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-04-02 09:49 . 2008-04-02 09:49 d-------- C:\Program Files\Windows Live Favorites
2008-04-02 09:49 . 2008-04-02 09:49 d-------- C:\Program Files\Uniblue
2008-03-31 14:26 . 2008-03-31 14:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-31 14:26 . 2008-03-31 14:26 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-27 16:21 . 2008-03-27 16:21 d-------- C:\Documents and Settings\Nom\Application Data\Uniblue
2008-03-18 16:50 . 2008-03-18 16:52 d-------- C:\Documents and Settings\Nom\Application Data\DMCache
2008-03-18 15:46 . 2008-03-18 15:46 d-------- C:\Program Files\microsoft frontpage
2008-03-11 21:11 . 2008-03-11 22:45 d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-10 15:50 . 2008-03-10 15:51 d-------- C:\Documents and Settings\All Users\Application Data\IM
2008-03-10 15:44 . 2008-03-10 15:44 d-------- C:\Documents and Settings\All Users\Application Data\IncrediMail
2008-03-09 16:49 . 2008-03-09 16:49 d-------- C:\Program Files\xtreme
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-05 12:39 --------- d-----w C:\Program Files\Trend Micro
2008-04-02 08:24 --------- d-----w C:\Program Files\eMule
2008-04-02 08:15 --------- d-----w C:\Documents and Settings\Nom\Application Data\LimeWire
2008-04-02 08:12 --------- d-----w C:\Program Files\LimeWire
2008-04-02 07:50 --------- d-----w C:\Program Files\QuickTime
2008-04-02 07:50 --------- d-----w C:\Program Files\Google
2008-04-02 07:49 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-04-02 07:49 --------- d-----w C:\Program Files\Windows Live
2008-04-02 07:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-31 12:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-31 12:32 --------- d-----w C:\Program Files\Belgacom
2008-03-11 20:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-04 09:10 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-22 21:08 --------- d-----w C:\Program Files\P2P_Torrent
2008-02-22 14:29 360,064 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2008-02-15 08:59 --------- d-----w C:\Documents and Settings\Nom\Application Data\Lavasoft
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-09 14:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2004-08-09 22:30 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
2007-08-10 21:05 66,936 --sha-w C:\WINDOWS\dlinfo_0.drv
.
------- Sigcheck -------
2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 18:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2008-02-22 16:29 360064 ed06c31200714e734118f9a47f5df5ce C:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-02-22 16:29 360064 ed06c31200714e734118f9a47f5df5ce C:\WINDOWS\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((( snapshot@2008-04-05_14.53.24.10 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-05 12:48:26 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_5d0.dat
+ 2008-04-07 09:52:13 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_5d0.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"NBJ"="C:\PROGRA~1\Ahead\NEROBA~1\NBJ.exe" [2005-05-19 20:38 1957888]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 01:55 110592 C:\WINDOWS\system32\bthprops.cpl]
"Belgacom"="C:\Program Files\Belgacom\bin\sprtcmd.exe" [2006-06-22 10:34 192512]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-16 11:45 63712]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll
"vidc.LEAD"= LCODCCMP.DLL
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C86 Series]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 MaBtPort;MA Bluetooth VCOM Driver;C:\WINDOWS\system32\DRIVERS\mabtport.sys [2005-07-22 09:07]
R3 MaBtVad;Mobile Action Bluetooth Audio;C:\WINDOWS\system32\DRIVERS\MaBtVad.sys [2005-08-23 06:04]
S3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 20:54]
S3 MaRdPnp;MaRdPnp;C:\WINDOWS\system32\DRIVERS\MaRdP2K.sys [2005-03-25 09:28]
S3 pohci13F;pohci13F;C:\DOCUME~1\Nom\LOCALS~1\Temp\pohci13F.sys []
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-23 12:05:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-07 12:57:41
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-07 13:01:43 - machine was rebooted [Nom]
ComboFix-quarantined-files.txt 2008-04-07 11:01:32
Pre-Run: 57,536,540,672 octets libres
Post-Run: 57,541,615,616 octets libres
.
2008-03-14 18:15:11 --- E O F ---

Télécharge OAD ( par !aur3n7) http://sosvirus.changelog.fr/OAD.exe
- Enregistre le sur ton bureau

Double clique sur le OAD pour le lancer
- nom de fichier à rechercher tape ou fais un copier coller de : pohci13F
- Type de recherche : sélectionne l'option 6 puis valide [entrée]
OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il
en ait terminé.
Le rapport de recherche s'affichera automatiquement à l’écran dès qu'il aura
terminé.
- Fais un copier / coller de ce rapport dans ton prochain post.
Note importante : Suivant la taille des disques durs cette recherche
peut prendre plusieurs minutes. Sois patient

lun. 07/04/2008 ---- 15:50:29,66
----------------------------------
§§§§§§ [pohci13F] §§§§§§
----------------------------------
[X] Registre

-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete

********************
[Registre]
********************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_POHCI13F]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pohci13F]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pohci13F]
"DisplayName"="pohci13F"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pohci13F\Security]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_POHCI13F]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\pohci13F]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\pohci13F]
"DisplayName"="pohci13F"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\pohci13F\Security]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_POHCI13F]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pohci13F]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pohci13F]
"DisplayName"="pohci13F"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pohci13F\Security]
*******************
[Fichier]
*******************

*********************
[Même date]
*********************
Aucun fichier créé à la même date détecté

Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

Ouvre le bloc-note
(Démarrer>programmes>Accessoires>Bloc-note) et copie-colle le texte en
citation :

Citation :

Driver::
pohci13F
Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_POHCI13F]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pohci13F]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_POHCI13F]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\pohci13F]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_POHCI13F]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pohci13F]

Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment
copié.

Sauvegarde ce fichier sous le nom de CFScript.txt




Comme l'image le montre, fait glisser CFScript.txt sur
Combofix.exe
Une fenêtre bleue va apparaître: au message qui apparaît (
Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à
plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste
son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici >
C:\ComboFix.txt

refais OAD avec pohci13F pour contrôle

Bonjour. Je ne sais pas ce qu'il y a mais quand je fais glisser CFScript sur combofix j'ai bien la fenetre bleue qui apparait et ensuite mon écran revient à la normal et c'est tout.

supprime ta version ce Combofix, retélécharge le et recommence avec CFScript
et dis moi....

ComboFix 08-04-09.9 - Nom 2008-04-10 13:55:36.9 - NTFSx86
Endroit: C:\Documents and Settings\Nom\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Nom\Bureau\CFScript.txt
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-10 to 2008-04-10 ))))))))))))))))))))))))))))))))))))
.
2008-04-09 09:21 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-09 09:21 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-09 09:21 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-09 09:21 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-09 09:21 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-09 09:21 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-09 09:21 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-09 09:21 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-09 09:21 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-09 09:21 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-04 11:49 . 2008-04-04 11:49 d-------- C:\Documents and Settings\Nom\belgacom
2008-04-02 18:55 . 2008-04-02 18:55 244 --ah----- C:\sqmnoopt00.sqm
2008-04-02 18:55 . 2008-04-02 18:55 232 --ah----- C:\sqmdata00.sqm
2008-04-02 14:16 . 2008-04-02 14:15 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-04-02 14:15 . 2008-04-05 15:00 d-------- C:\Program Files\Casc'ADSL
2008-04-02 09:50 . 2008-04-02 09:50 d-------- C:\Program Files\SupportSoft
2008-04-02 09:50 . 2008-04-02 09:50 d-------- C:\Program Files\CCleaner
2008-04-02 09:50 . 2008-04-02 09:50 d-------- C:\Documents and Settings\Application Data\SupportSoft
2008-04-02 09:50 . 2008-04-10 13:52 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-04-02 09:49 . 2008-04-02 09:49 d-------- C:\Program Files\Windows Live Favorites
2008-04-02 09:49 . 2008-04-02 09:49 d-------- C:\Program Files\Uniblue
2008-03-31 14:26 . 2008-03-31 14:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-31 14:26 . 2008-03-31 14:26 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-27 16:21 . 2008-03-27 16:21 d-------- C:\Documents and Settings\Nom\Application Data\Uniblue
2008-03-18 16:50 . 2008-03-18 16:52 d-------- C:\Documents and Settings\Nom\Application Data\DMCache
2008-03-18 15:46 . 2008-03-18 15:46 d-------- C:\Program Files\microsoft frontpage
2008-03-11 21:11 . 2008-03-11 22:45 d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-10 15:50 . 2008-03-10 15:51 d-------- C:\Documents and Settings\All Users\Application Data\IM
2008-03-10 15:44 . 2008-03-10 15:44 d-------- C:\Documents and Settings\All Users\Application Data\IncrediMail
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-05 12:39 --------- d-----w C:\Program Files\Trend Micro
2008-04-02 08:24 --------- d-----w C:\Program Files\eMule
2008-04-02 08:15 --------- d-----w C:\Documents and Settings\Nom\Application Data\LimeWire
2008-04-02 08:12 --------- d-----w C:\Program Files\LimeWire
2008-04-02 07:50 --------- d-----w C:\Program Files\QuickTime
2008-04-02 07:50 --------- d-----w C:\Program Files\Google
2008-04-02 07:49 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-04-02 07:49 --------- d-----w C:\Program Files\Windows Live
2008-04-02 07:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-31 12:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-31 12:32 --------- d-----w C:\Program Files\Belgacom
2008-03-11 20:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-09 14:49 --------- d-----w C:\Program Files\xtreme
2008-03-04 09:10 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-22 21:08 --------- d-----w C:\Program Files\P2P_Torrent
2008-02-22 14:29 360,064 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2008-02-15 08:59 --------- d-----w C:\Documents and Settings\Nom\Application Data\Lavasoft
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2004-08-09 22:30 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
2007-08-10 21:05 66,936 --sha-w C:\WINDOWS\dlinfo_0.drv

------- Sigcheck -------
2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 18:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2008-02-22 16:29 360064 ed06c31200714e734118f9a47f5df5ce C:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-02-22 16:29 360064 ed06c31200714e734118f9a47f5df5ce C:\WINDOWS\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((( snapshot@2008-04-05_14.53.24.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-07 02:08:32 124,928 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\advpack.dll
+ 2007-12-19 22:53:23 347,136 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtmsft.dll
+ 2007-12-07 02:08:32 214,528 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtrans.dll
+ 2007-12-07 02:08:32 133,120 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\extmgr.dll
+ 2007-12-07 02:08:32 63,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\icardie.dll
+ 2007-12-06 11:02:31 70,656 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ie4uinit.exe
+ 2007-12-07 02:08:32 153,088 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakeng.dll
+ 2007-12-07 02:08:32 230,400 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieaksie.dll
+ 2007-12-06 04:59:51 161,792 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakui.dll
+ 2007-12-07 02:08:32 383,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieapfltr.dll
+ 2007-12-07 02:08:32 384,512 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iedkcs32.dll
+ 2007-12-07 02:08:33 6,066,176 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieframe.dll
+ 2007-12-07 02:08:33 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iernonce.dll
+ 2007-12-07 02:08:33 267,776 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iertutil.dll
+ 2007-12-06 11:00:58 13,824 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieudinit.exe
+ 2007-12-06 11:03:16 625,664 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iexplore.exe
+ 2007-12-07 02:08:33 27,648 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\jsproxy.dll
+ 2007-12-07 02:08:33 459,264 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeeds.dll
+ 2007-12-07 02:08:33 52,224 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeedsbs.dll
+ 2007-12-08 09:38:36 3,592,192 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtml.dll
+ 2007-12-07 02:08:34 478,208 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtmled.dll
+ 2007-12-07 02:08:34 193,024 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msrating.dll
+ 2007-12-07 02:08:34 671,232 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mstime.dll
+ 2007-12-07 02:08:34 102,912 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\occache.dll
+ 2008-01-11 05:36:55 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\pngfilt.dll
+ 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\updspapi.dll
+ 2007-12-07 02:08:34 105,984 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\url.dll
+ 2007-12-07 02:08:34 1,159,680 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\urlmon.dll
+ 2007-12-07 02:08:34 233,472 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\webcheck.dll
+ 2007-12-07 02:08:34 824,832 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
+ 2008-04-10 12:00:58 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
- 2007-12-07 02:08:32 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2008-03-01 12:58:06 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2007-12-07 02:08:32 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-03-01 12:58:06 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
- 2006-06-26 17:41:32 148,480 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-02-20 05:35:05 148,992 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
- 2004-08-03 22:54:24 45,568 -c--a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
+ 2008-02-20 05:35:05 45,568 -c--a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
- 2007-12-19 22:53:23 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-03-01 12:58:06 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2007-12-07 02:08:32 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-03-01 12:58:06 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2007-12-07 02:08:32 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-03-01 12:58:06 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2007-06-19 13:32:25 282,112 -c--a-w C:\WINDOWS\system32\dllcache\gdi32.dll
+ 2008-02-20 06:51:00 282,624 -c--a-w C:\WINDOWS\system32\dllcache\gdi32.dll
- 2007-12-07 02:08:32 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-03-01 12:58:06 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
- 2007-12-06 11:02:31 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2008-02-29 08:56:41 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2007-12-07 02:08:32 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-03-01 12:58:06 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2007-12-07 02:08:32 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-03-01 12:58:06 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2007-12-06 04:59:51 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2008-02-15 05:44:25 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2007-12-07 02:08:32 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2008-03-01 12:58:07 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2007-12-07 02:08:32 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-03-01 12:58:07 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2007-12-07 02:08:33 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
+ 2008-03-01 12:58:08 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
- 2007-12-07 02:08:33 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-03-01 12:58:08 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2007-12-07 02:08:33 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-03-01 12:58:08 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
- 2007-12-06 11:00:58 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
+ 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
- 2007-12-06 11:03:16 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-02-29 08:57:05 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2007-12-07 02:08:33 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-03-01 12:58:08 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2007-12-07 02:08:33 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-03-01 12:58:08 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
- 2007-12-07 02:08:33 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-03-01 12:58:08 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2007-12-08 09:38:36 3,592,192 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-03-01 16:28:10 3,591,680 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2007-12-07 02:08:34 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-03-01 12:58:09 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2007-12-07 02:08:34 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-03-01 12:58:10 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
- 2007-12-07 02:08:34 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-03-01 12:58:10 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
- 2007-12-07 02:08:34 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-03-01 12:58:10 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
- 2008-01-11 05:36:55 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-03-01 12:58:10 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-12-07 02:08:34 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-03-01 12:58:10 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
- 2007-12-07 02:08:34 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-03-01 12:58:10 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2007-12-07 02:08:34 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-03-01 12:58:11 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2007-03-08 15:33:58 1,843,712 -c--a-w C:\WINDOWS\system32\dllcache\win32k.sys
+ 2008-03-20 08:09:22 1,845,376 -c--a-w C:\WINDOWS\system32\dllcache\win32k.sys
- 2007-12-07 02:08:34 824,832 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-03-01 12:58:11 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
- 2006-06-26 17:41:32 148,480 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-02-20 05:35:05 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2004-08-03 22:54:24 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
+ 2008-02-20 05:35:05 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
- 2007-12-19 22:53:23 347,136 ------w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-03-01 12:58:06 347,136 ------w C:\WINDOWS\system32\dxtmsft.dll
- 2007-12-07 02:08:32 214,528 ------w C:\WINDOWS\system32\dxtrans.dll
+ 2008-03-01 12:58:06 214,528 ------w C:\WINDOWS\system32\dxtrans.dll
- 2007-12-07 02:08:32 133,120 ------w C:\WINDOWS\system32\extmgr.dll
+ 2008-03-01 12:58:06 133,120 ------w C:\WINDOWS\system32\extmgr.dll
- 2008-03-11 20:45:19 127,704 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-04-10 11:45:11 127,704 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2007-06-19 13:32:25 282,112 ----a-w C:\WINDOWS\system32\gdi32.dll
+ 2008-02-20 06:51:00 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
- 2007-12-07 02:08:32 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
+ 2008-03-01 12:58:06 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2007-12-06 11:02:31 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-02-29 08:56:41 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe
- 2007-12-07 02:08:32 153,088 ------w C:\WINDOWS\system32\ieakeng.dll
+ 2008-03-01 12:58:06 153,088 ------w C:\WINDOWS\system32\ieakeng.dll
- 2007-12-07 02:08:32 230,400 ------w C:\WINDOWS\system32\ieaksie.dll
+ 2008-03-01 12:58:06 230,400 ------w C:\WINDOWS\system32\ieaksie.dll
- 2007-12-06 04:59:51 161,792 ------w C:\WINDOWS\system32\ieakui.dll
+ 2008-02-15 05:44:25 161,792 ------w C:\WINDOWS\system32\ieakui.dll
- 2007-12-07 02:08:32 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-03-01 12:58:07 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2007-12-07 02:08:32 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-03-01 12:58:07 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
- 2007-12-07 02:08:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-03-01 12:58:08 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2007-12-07 02:08:33 44,544 ------w C:\WINDOWS\system32\iernonce.dll
+ 2008-03-01 12:58:08 44,544 ------w C:\WINDOWS\system32\iernonce.dll
- 2007-12-07 02:08:33 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-03-01 12:58:08 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2007-12-06 11:00:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-02-22 10:00:51 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-12-07 02:08:33 27,648 ------w C:\WINDOWS\system32\jsproxy.dll
+ 2008-03-01 12:58:08 27,648 ------w C:\WINDOWS\system32\jsproxy.dll
- 2008-03-05 16:30:54 19,148,408 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-04-06 05:56:20 19,836,024 ----a-w C:\WINDOWS\system32\MRT.exe
- 2007-12-07 02:08:33 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-03-01 12:58:08 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2007-12-07 02:08:33 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-03-01 12:58:08 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2007-12-08 09:38:36 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-03-01 16:28:10 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2007-12-07 02:08:34 478,208 ------w C:\WINDOWS\system32\mshtmled.dll
+ 2008-03-01 12:58:09 478,208 ------w C:\WINDOWS\system32\mshtmled.dll
- 2007-12-07 02:08:34 193,024 ------w C:\WINDOWS\system32\msrating.dll
+ 2008-03-01 12:58:10 193,024 ------w C:\WINDOWS\system32\msrating.dll
- 2007-12-07 02:08:34 671,232 ------w C:\WINDOWS\system32\mstime.dll
+ 2008-03-01 12:58:10 671,232 ------w C:\WINDOWS\system32\mstime.dll
- 2007-12-07 02:08:34 102,912 ------w C:\WINDOWS\system32\occache.dll
+ 2008-03-01 12:58:10 102,912 ------w C:\WINDOWS\system32\occache.dll
- 2008-01-11 05:36:55 44,544 ------w C:\WINDOWS\system32\pngfilt.dll
+ 2008-03-01 12:58:10 44,544 ------w C:\WINDOWS\system32\pngfilt.dll
- 2007-12-07 02:08:34 105,984 ----a-w C:\WINDOWS\system32\url.dll
+ 2008-03-01 12:58:10 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2007-12-07 02:08:34 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-03-01 12:58:10 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2007-12-07 02:08:34 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-03-01 12:58:11 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
- 2007-03-08 15:33:58 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys
+ 2008-03-20 08:09:22 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
- 2007-12-07 02:08:34 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2008-03-01 12:58:11 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2008-04-10 12:00:19 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_5d4.dat
.

-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"NBJ"="C:\PROGRA~1\Ahead\NEROBA~1\NBJ.exe" [2005-05-19 20:38 1957888]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 01:55 110592 C:\WINDOWS\system32\bthprops.cpl]
"Belgacom"="C:\Program Files\Belgacom\bin\sprtcmd.exe" [2006-06-22 10:34 192512]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-16 11:45 63712]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C86 Series]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 MaBtPort;MA Bluetooth VCOM Driver;C:\WINDOWS\system32\DRIVERS\mabtport.sys [2005-07-22 09:07]
R3 MaBtVad;Mobile Action Bluetooth Audio;C:\WINDOWS\system32\DRIVERS\MaBtVad.sys [2005-08-23 06:04]
S3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 20:54]
S3 MaRdPnp;MaRdPnp;C:\WINDOWS\system32\DRIVERS\MaRdP2K.sys [2005-03-25 09:28]
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-23 12:05:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 14:01:28
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-10 14:06:27 - machine was rebooted [Nom]
ComboFix-quarantined-files.txt 2008-04-10 12:06:10
Pre-Run: 57,279,148,032 octets libres
Post-Run: 57,262,039,040 octets libres
.
2008-04-09 10:02:09 --- E O F ---

comment va le PC?