oui oui voila ce qu'il me marque sur la partie droite :

File/Folder C:\WINDOWS\System32\drivers\hidr.exe not found.
File/Folder C:\WINDOWS\System32\wintems.exe not found.

Created on 12/16/2007 16:58:42

et apres un message d'erreur pour la creation du texte ...

Ok, on va faire autrement, shoote ces 2 lignes dans hijackthis (coche et fais fix checked) :

O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\System32\drivers\hidr.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\System32\wintems.exe

gros probleme il n'existe plus -_-''''

voici le nouveau log :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:07:00, on 16/12/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Yoann\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.planetis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Icône AOL.lnk = C:\Program Files\AOL 7.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7672 bytes

Huh, et il est parti tout seul ? Elibagla ne mentionne rien à ce sujet.
Redémarre et vois si ça revient dans HJT (sans forcément reposter un log) et si Antivir va mieux.

toujour aucune trace de nos deux fichiers avec Hijackthis est pour la mise a jour d'antivir je suis en train de la faire ...

Ha, bah ça semble réglé, je m'étonne qu'aucun des programme ne le fasse figurer dans le rapport, ou fausse manip, je ne sais pas.

Il y a des choses là dedans ?
C:\_OTMoveIt\MovedFiles

l'existe meme pas se fichier et pour la mise a jour c'etait tros beau ...


16.12.2007 17:19:58 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
16.12.2007 17:19:58 - Backup Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\BACKUP\
16.12.2007 17:19:58 - Temp Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_4765502e\
16.12.2007 17:19:59 - Start the Update GUI... Displaymode: 0

16.12.2007 17:19:58 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
16.12.2007 17:19:58 - Backup Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\BACKUP\
16.12.2007 17:19:58 - Temp Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_4765502e\
16.12.2007 17:19:59 - Start the Update GUI... Displaymode: 0

16.12.2007 17:20:15 - Keyfile: OK [FULL Mode]

16.12.2007 17:20:15 - Avira AntiVir PersonalEdition Classic

16.12.2007 17:20:44 - Connection failed while downloading the file http://dl2.avgate.net/upd/idx/master.idx.
16.12.2007 17:20:44 - Switching to next update server
16.12.2007 17:21:05 - Connection failed while downloading the file http://dl5.avgate.net/upd/idx/master.idx.
16.12.2007 17:21:05 - Switching to next update server
16.12.2007 17:21:26 - Connection failed while downloading the file http://dl3.avgate.net/upd/idx/master.idx.
16.12.2007 17:21:26 - Switching to next update server
16.12.2007 17:21:48 - Connection failed while downloading the file http://dl6.avgate.net/upd/idx/master.idx.
16.12.2007 17:21:48 - Switching to next update server
16.12.2007 17:21:59 - Master IDX file has changed
16.12.2007 17:22:32 - Keyfile: OK [FULL Mode]

16.12.2007 17:23:08 - Critical error: Connection failed while downloading the file http://dl1.avgate.net/upd/idx/classic-nt-en.idx.

Ce qu'il faut, c'est déterminer si Bagle a régénéré son driver (qui le rend invisible) ou est mort, j'ai des doutes là. Bagle shoote les antivirus, mais là on dirait plus un souci de connexion au serveur.

Je vais t'embêter avec un nouveau log diaghelp.

et voila ^^


DiagHelp version v1.4 - http://www.malekal.com
excute le 16/12/2007 à 17:28:48.34


Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CHCP.COM-17EDBDC9.pf -->16/12/2007 17:28:46
C:\WINDOWS\prefetch\FIREFOX.EXE-06188867.pf -->16/12/2007 17:23:31
C:\WINDOWS\prefetch\NOTEPAD.EXE-2F2D61E1.pf -->16/12/2007 17:23:24
C:\WINDOWS\prefetch\AVSCAN.EXE-0A98540D.pf -->16/12/2007 17:23:13
C:\WINDOWS\prefetch\REGSVR32.EXE-396DEA2C.pf -->16/12/2007 17:23:05
C:\WINDOWS\prefetch\AVGNT.EXE-08C8F6E1.pf -->16/12/2007 17:23:04
C:\WINDOWS\prefetch\UPDATE.EXE-380C6CAC.pf -->16/12/2007 17:19:59
C:\WINDOWS\prefetch\PREUPD.EXE-16574861.pf -->16/12/2007 17:19:56
C:\WINDOWS\prefetch\AVCENTER.EXE-05983540.pf -->16/12/2007 17:19:44
C:\WINDOWS\prefetch\WMIPRVSE.EXE-0D449B4F.pf -->16/12/2007 17:18:26

C:\WINDOWS\System32\drivers\avipbb.sys -->06/11/2007 23:22:52
C:\WINDOWS\System32\drivers\avgntdd.sys -->09/08/2007 13:04:11
C:\WINDOWS\System32\drivers\avgntmgr.sys -->18/07/2007 14:22:19
C:\WINDOWS\System32\drivers\ssmdrv.sys -->01/03/2007 10:34:36
C:\WINDOWS\System32\drivers\GEARAspiWDM.sys -->19/09/2006 14:44:04
C:\WINDOWS\System32\drivers\ZDPSp50a64.sys -->18/01/2006 14:09:40
C:\WINDOWS\System32\drivers\ZDPSp50.sys -->18/01/2006 14:09:40

C:\WINDOWS\System32\Status.MPF -->16/12/2007 17:15:45
C:\WINDOWS\System32\tmp.txt -->16/12/2007 10:25:51
C:\WINDOWS\System32\tmp.reg -->16/12/2007 10:25:51
C:\WINDOWS\System32\wpa.dbl -->14/12/2007 17:40:37
C:\WINDOWS\System32\IEDFix.exe -->13/12/2007 19:40:20
C:\WINDOWS\System32\FNTCACHE.DAT -->25/11/2007 10:25:00
C:\WINDOWS\System32\QuickTimeVR.qtx -->14/11/2007 23:43:22
C:\WINDOWS\System32\QuickTime.qts -->14/11/2007 23:43:22
C:\WINDOWS\System32\perfh00C.dat -->14/11/2007 18:16:13
C:\WINDOWS\System32\perfh009.dat -->14/11/2007 18:16:13
C:\WINDOWS\System32\perfc00C.dat -->14/11/2007 18:16:13
C:\WINDOWS\System32\perfc009.dat -->14/11/2007 18:16:13
C:\WINDOWS\System32\PerfStringBackup.INI -->14/11/2007 17:45:40
C:\WINDOWS\System32\CONFIG.NT -->08/11/2007 20:14:49
C:\WINDOWS\System32\jupdate-1.6.0_03-b05.log -->24/10/2007 18:06:31
C:\WINDOWS\System32\WhoisCL.exe -->17/10/2007 18:23:24
C:\WINDOWS\System32\WS2Fix.exe -->03/10/2007 23:36:46
C:\WINDOWS\System32\javaws.exe -->24/09/2007 22:31:42
C:\WINDOWS\System32\javacpl.cpl -->24/09/2007 22:31:42
C:\WINDOWS\System32\javaw.exe -->24/09/2007 21:30:30
C:\WINDOWS\System32\java.exe -->24/09/2007 21:30:28
C:\WINDOWS\System32\VCCLSID.exe -->05/09/2007 23:22:24
C:\WINDOWS\System32\msinet.OCX -->20/07/2007 08:05:38
C:\WINDOWS\System32\CmdLineExt03.dll -->22/02/2007 17:24:34
C:\WINDOWS\System32\nscompat.tlb -->09/02/2007 23:07:49

C:\WINDOWS\0.log -->16/12/2007 17:16:46
C:\WINDOWS\wiadebug.log -->16/12/2007 17:16:08
C:\WINDOWS\WindowsUpdate.log -->16/12/2007 17:16:05
C:\WINDOWS\wiaservc.log -->16/12/2007 17:15:33
C:\WINDOWS\bootstat.dat -->16/12/2007 17:14:03
C:\WINDOWS\SchedLgU.Txt -->16/12/2007 17:13:15
C:\WINDOWS\QTFont.qfn -->16/12/2007 16:15:48
C:\WINDOWS\QTFont.for -->16/12/2007 16:15:48
C:\WINDOWS\wmsetup.log -->04/12/2007 19:07:42
C:\WINDOWS\setupapi.log -->01/12/2007 19:50:38
C:\WINDOWS\DPINST.LOG -->20/11/2007 14:34:10
C:\WINDOWS\mozver.dat -->04/11/2007 10:42:46
C:\WINDOWS\nsreg.dat -->01/11/2007 22:46:54
C:\WINDOWS\win.ini -->01/11/2007 22:05:24
C:\WINDOWS\tsoc.log -->13/08/2007 10:32:43

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed


ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - http://www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 1436
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x01000000 0xf8000 6.00.2600.0000 C:\WINDOWS\Explorer.EXE
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
0x77290000 0x64000 6.00.2750.0167 C:\WINDOWS\system32\SHLWAPI.dll
0x77390000 0x802000 6.00.2600.0000 C:\WINDOWS\system32\SHELL32.dll
0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll
0x71500000 0xfd000 6.00.2737.1600 C:\WINDOWS\System32\BROWSEUI.dll
0x71700000 0x148000 6.00.2750.0167 C:\WINDOWS\System32\SHDOCVW.dll
0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\System32\UxTheme.dll
0x71950000 0xe4000 6.00.2600.0000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\comctl32.dll
0x7c620000 0x81000 2001.12.4414.0053 C:\WINDOWS\System32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\System32\COMRes.dll
0x5b950000 0x71000 6.00.2600.0000 C:\WINDOWS\System32\themeui.dll
0x746e0000 0x8f000 6.00.2600.0000 C:\WINDOWS\System32\MLANG.dll
0x76ac0000 0x15000 3.00.9238.0000 C:\WINDOWS\System32\ATL.DLL
0x74aa0000 0x43000 6.00.2600.0000 C:\WINDOWS\System32\webcheck.dll
0x74a60000 0x9000 6.00.2600.0000 C:\WINDOWS\System32\BatMeter.dll
0x74a40000 0x7000 6.00.2600.0000 C:\WINDOWS\System32\POWRPROF.dll
0x76250000 0x8a000 5.131.2600.1123 C:\WINDOWS\system32\CRYPT32.dll
0x10000000 0x8000 9.40.0000.0000 C:\PROGRA~1\MOUSEW~1\SYSTEM\LgMousHk.dll
0x017a0000 0x2c6000 3.01.4000.2435 C:\WINDOWS\System32\msi.dll
0x01340000 0x17000 9.05.0000.1098 C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcInj.dll
0x00ea0000 0x7000 1.00.0000.0001 C:\PROGRA~1\Wanadoo\Inactivity.dll
0x723a0000 0x13000 6.00.2600.0000 C:\WINDOWS\System32\browselc.dll
0x63000000 0x96000 6.00.2737.0800 C:\WINDOWS\system32\WININET.dll
0x1a400000 0x7b000 6.00.2745.2300 C:\WINDOWS\system32\urlmon.dll
0x1f7b0000 0x31000 3.520.7713.0000 C:\WINDOWS\System32\ODBC32.dll
0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll
0x1f850000 0x18000 3.520.7713.0000 C:\WINDOWS\System32\odbcint.dll
0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\System32\WINTRUST.dll
0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - http://www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 624
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x6f000 \??\C:\WINDOWS\system32\winlogon.exe
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
0x76250000 0x8a000 5.131.2600.1123 C:\WINDOWS\system32\CRYPT32.dll
0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\system32\WINTRUST.dll
0x77390000 0x802000 6.00.2600.0000 C:\WINDOWS\system32\SHELL32.dll
0x77290000 0x64000 6.00.2750.0167 C:\WINDOWS\system32\SHLWAPI.dll
0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\COMCTL32.dll
0x1f7b0000 0x31000 3.520.7713.0000 C:\WINDOWS\system32\ODBC32.dll
0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll
0x008f0000 0xe4000 6.00.2600.0000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
0x1f850000 0x18000 3.520.7713.0000 C:\WINDOWS\system32\odbcint.dll
0x76b70000 0x1f000 6.00.2600.0000 C:\WINDOWS\system32\SHSVCS.dll
0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\system32\uxtheme.dll
0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll
0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\system32\COMRes.dll
0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll
0x7c620000 0x81000 2001.12.4414.0053 C:\WINDOWS\system32\CLBCATQ.DLL


Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 04F0-DE04

Répertoire de C:\WINDOWS\system32

28/08/2001 11:00 4 096 csrss.exe
1 fichier(s) 4 096 octets
0 Rép(s) 7 621 492 736 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 04F0-DE04

Répertoire de C:\WINDOWS\Downloaded Program Files

30/10/2007 20:27 <REP> .
30/10/2007 20:27 <REP> ..
07/09/2004 12:27 65 desktop.ini
13/04/2007 02:14 382 344 GAME_UNO1.dll
17/01/2007 15:44 316 GAME_UNO1.INF
22/02/2007 23:41 304 544 MessengerStatsPAClient.dll
20/01/2000 15:25 1 162 Microsoft XML Parser for Java.osd
16/11/2006 12:35 63 056 MusicManagerUnInstaller.exe
09/11/2006 14:36 5 019 swflash.inf
30/06/2003 22:41 1 689 WMV9VCM.inf
8 fichier(s) 758 195 octets

Total des fichiers listés :
8 fichier(s) 758 195 octets
2 Rép(s) 7 621 492 736 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..


Liste des fichiers en exception sur le pare-feu XP SP2

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"



exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001



Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-16 17:29:43
Windows 5.1.2600 NTFS

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (http://www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
228 - svchost.exe
600 - csrss.exe
624 - winlogon.exe
668 - services.exe
680 - lsass.exe
836 - svchost.exe
860 - svchost.exe
952 - svchost.exe
992 - svchost.exe
1096 - LEXPPS.EXE
1100 - spoolsv.exe
1148 - LVPrcSrv.exe
1180 - avguard.exe
1436 - explorer.exe
1508 - hkcmd.exe
1516 - EM_EXEC.EXE
1528 - MpfTray.exe
1648 - alg.exe
1664 - InCD.exe
1704 - LVCOMSX.EXE
1748 - avgnt.exe
1792 - btwdins.exe
1824 - MpfAgent.exe
1836 - FTRTSVC.exe
1888 - iTunesHelper.ex
1904 - incdsrv.exe
1932 - BTTray.exe
2016 - slserv.exe
2072 - iPodService.exe
2876 - cmd.exe
3340 - GestionnaireInt
3512 - ComComp.exe
3632 - Toaster.exe
3644 - Inactivity.exe
3656 - PollingModule.e
3780 - firefox.exe
3828 - ALERTM~1.EXE
3996 - Watch.exe

Total number of processes = 39
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (http://www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D0000 - \WINDOWS\system32\ntoskrnl.exe
806B5000 - \WINDOWS\system32\hal.dll
FCA21000 - \WINDOWS\system32\KDCOM.DLL
FC931000 - \WINDOWS\system32\BOOTVID.dll
FC4D4000 - ACPI.sys
FCA23000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS
FC521000 - pci.sys
FC531000 - isapnp.sys
FCA25000 - intelide.sys
FC7A1000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
FC541000 - MountMgr.sys
FC4B5000 - ftdisk.sys
FC7A9000 - PartMgr.sys
FC551000 - VolSnap.sys
FC49F000 - atapi.sys
FC561000 - disk.sys
FC571000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
FC48D000 - sr.sys
FC581000 - avgntmgr.sys
FC479000 - KSecDD.sys
FC3F6000 - Ntfs.sys
FC3CE000 - NDIS.sys
FC3B4000 - Mup.sys
FC641000 - \SystemRoot\System32\DRIVERS\p3.sys
FBD98000 - \SystemRoot\System32\DRIVERS\i81xnt5.sys
FC651000 - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
FC661000 - \SystemRoot\System32\DRIVERS\i8042prt.sys
FC671000 - \SystemRoot\System32\DRIVERS\L8042Pr2.sys
FC681000 - \SystemRoot\System32\DRIVERS\LMouFlt2.sys
FC7F1000 - \SystemRoot\System32\DRIVERS\mouclass.sys
FCA3F000 - \SystemRoot\System32\DRIVERS\LKbdFlt2.sys
FC7F9000 - \SystemRoot\System32\DRIVERS\kbdclass.sys
FC801000 - \SystemRoot\System32\DRIVERS\fdc.sys
FC691000 - \SystemRoot\System32\DRIVERS\serial.sys
FC9C5000 - \SystemRoot\System32\DRIVERS\serenum.sys
FBD85000 - \SystemRoot\System32\DRIVERS\parport.sys
FC9C9000 - \SystemRoot\System32\DRIVERS\gameenum.sys
FCBDC000 - \SystemRoot\system32\drivers\msmpu401.sys
FBD64000 - \SystemRoot\system32\drivers\portcls.sys
FC6C1000 - \SystemRoot\system32\drivers\drmk.sys
FBD44000 - \SystemRoot\system32\drivers\ks.sys
FC6D1000 - \SystemRoot\System32\Drivers\Imapi.SYS
FC6E1000 - \SystemRoot\System32\DRIVERS\cdrom.sys
FC6F1000 - \SystemRoot\System32\DRIVERS\redbook.sys
FC809000 - \SystemRoot\System32\DRIVERS\InCDPass.sys
FC811000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
FC819000 - \SystemRoot\System32\DRIVERS\usbuhci.sys
FBD25000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS
FBD0D000 - \SystemRoot\system32\drivers\ac97intc.sys
FBCE0000 - \SystemRoot\System32\DRIVERS\slntamr.sys
FC9D1000 - \SystemRoot\System32\DRIVERS\SlWdmSup.sys
FBCCB000 - \SystemRoot\System32\DRIVERS\Mtlmnt5.sys
FC821000 - \SystemRoot\System32\Drivers\Modem.SYS
FBBFE000 - \SystemRoot\System32\DRIVERS\btkrnl.sys
FCBE8000 - \SystemRoot\System32\DRIVERS\audstub.sys
FC761000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys
FC9E5000 - \SystemRoot\System32\DRIVERS\ndistapi.sys
FB948000 - \SystemRoot\System32\DRIVERS\ndiswan.sys
FC771000 - \SystemRoot\System32\DRIVERS\raspppoe.sys
FC781000 - \SystemRoot\System32\DRIVERS\raspptp.sys
FC9F1000 - \SystemRoot\System32\DRIVERS\TDI.SYS
FB86F000 - \SystemRoot\System32\DRIVERS\psched.sys
FC791000 - \SystemRoot\System32\DRIVERS\msgpc.sys
FC829000 - \SystemRoot\System32\DRIVERS\ptilink.sys
FC831000 - \SystemRoot\System32\DRIVERS\raspti.sys
FC839000 - \SystemRoot\System32\DRIVERS\wanatw4.sys
FC5B1000 - \SystemRoot\System32\DRIVERS\termdd.sys
FCBF8000 - \SystemRoot\System32\DRIVERS\swenum.sys
FB84D000 - \SystemRoot\System32\DRIVERS\update.sys
FC5C1000 - \SystemRoot\System32\Drivers\NDProxy.SYS
FC869000 - \SystemRoot\System32\DRIVERS\flpydisk.sys
FC621000 - \SystemRoot\System32\DRIVERS\usbhub.sys
FCA63000 - \SystemRoot\System32\DRIVERS\USBD.SYS
FC871000 - \SystemRoot\System32\DRIVERS\usbccgp.sys
F76A2000 - \SystemRoot\System32\DRIVERS\WlanBZXP.sys
FC6A1000 - \SystemRoot\system32\drivers\lvusbsta.sys
F7378000 - \SystemRoot\System32\DRIVERS\LV302AV.SYS
FC6B1000 - \SystemRoot\System32\DRIVERS\STREAM.SYS
FCA67000 - \SystemRoot\System32\DRIVERS\lv302af.sys
FC701000 - \SystemRoot\system32\drivers\usbaudio.sys
F7165000 - \??\C:\WINDOWS\system32\drivers\Lvckap.sys
FC731000 - \SystemRoot\SYSTEM32\DRIVERS\avgntdd.sys
FCA75000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
FCC46000 - \SystemRoot\System32\Drivers\Null.SYS
FCA77000 - \SystemRoot\System32\Drivers\Beep.SYS
FC891000 - \SystemRoot\System32\drivers\vga.sys
FCA79000 * ????P????????????????????????????????? --[Hidden]--
FCA7B000 * ???- --[Hidden]--
FCA7D000 - \SystemRoot\System32\Drivers\InCDrec.SYS
F7108000 * ??????????????????V?????V?????????????? --[Hidden]--
FC899000 * --[Hidden]--
FC8A1000 * --[Hidden]--
FC9D5000 * --[Hidden]--
FC741000 - \SystemRoot\System32\DRIVERS\ipsec.sys
F70B8000 - \SystemRoot\System32\DRIVERS\tcpip.sys
FC751000 - \SystemRoot\System32\Drivers\MpFirewall.sys
F7093000 - \SystemRoot\System32\DRIVERS\netbt.sys
FB938000 - \SystemRoot\System32\DRIVERS\netbios.sys
FC8A9000 - \SystemRoot\System32\DRIVERS\ssmdrv.sys
F706B000 - \SystemRoot\System32\DRIVERS\rdbss.sys
F700B000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys
FB928000 - \SystemRoot\System32\Drivers\Fips.SYS
FB918000 - \SystemRoot\System32\DRIVERS\wanarp.sys
FB908000 - \SystemRoot\System32\DRIVERS\avipbb.sys
FB8D8000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F6EEA000 - \SystemRoot\System32\Drivers\dump_atapi.sys
FCA83000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \??\C:\WINDOWS\system32\win32k.sys
F77A9000 - \??\C:\WINDOWS\system32\watchdog.sys
BFF80000 - \SystemRoot\System32\drivers\dxg.sys
FCB0A000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9B8000 - \SystemRoot\System32\i81xdnt5.dll
F6D6A000 - \SystemRoot\System32\drivers\afd.sys
F6ABF000 - \SystemRoot\System32\DRIVERS\mrxdav.sys
F6A5B000 - \SystemRoot\system32\drivers\wdmaud.sys
F6E32000 - \SystemRoot\system32\drivers\sysaudio.sys
FCA4D000 - \SystemRoot\System32\Drivers\ParVdm.SYS
FC7E9000 - \??\C:\WINDOWS\System32\drivers\btserial.sys
F67AF000 - \SystemRoot\System32\DRIVERS\secdrv.sys
F66EC000 - \SystemRoot\System32\DRIVERS\srv.sys
F63CE000 - \SystemRoot\System32\DRIVERS\ipnat.sys
FC849000 - \??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
FC8E9000 - \SystemRoot\System32\Drivers\ZDPSp50.sys
F62C0000 - \??\C:\WINDOWS\System32\PCANDIS5.SYS
FCC63000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 125

Liste des programmes installes

ABBYY FineReader 5.0 Sprint
Adobe Flash Player 9 ActiveX
Adobe Shockwave Player
Ahead InCD
Ahead NeroMediaPlayer
Ahead NeroVision Express
AOL France
Apple Software Update
Audacity 1.2.6
Avira AntiVir PersonalEdition Classic
Barre d'outils MSN
Browser Optimizer Dcads
Browser Optimizer Superiorads
CDex extraction audio
Correctif Windows XP - Article Base de Connaissances 834707
Correctif Windows XP - KB823559
Correctif Windows XP - KB828741
Correctif Windows XP - KB835732
Correctif Windows XP - KB842773
EA.com Update
ESD U10039_00 V2
Free Ipod Video Converter V 2.4
Gestionnaire Internet
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HijackThis 2.0.2
iTunes
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 3
Le Maître de l'Olympe - Zeus.
Lecteur Windows Media 10
Lexmark X1100 Series
LimeWire PRO 4.12.3
livebox
McAfee Personal Firewall Plus
MediaBar
MFCDLL Shared Library - Retail Version
Micrografx Picture Publisher 7
Microsoft (R) C Runtime Library
Microsoft (R) C++ Runtime Library
Microsoft .NET Framework (French) v1.0.3705
Microsoft .NET Framework (French) v1.0.3705
Microsoft Office 2000 Premium
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (2.0.0.11)
MSXML 3.0
MSXML4 Parser
Nero - Burning Rom
Package du correctif Windows XP [voir Q329115 pour plus de détails]
Programme de gestion Camera de Logitech®
QuickTime
Réussir ses CV et Lettres de Motivation
Sagem Wi-Fi 11g USB adapter (driver)
Sagem Wi-Fi 11g USB adapter (utility)
TextBridge Classic
VideoLAN VLC media player 0.8.6d
Viewpoint Media Player (Remove Only)
WarBreeds
WebFldrs XP
WIDCOMM Bluetooth Software
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format Runtime
Windows XP Hotfix (SP1) [See Q321178 for more information]
Windows XP Hotfix (SP1) [See Q329048 for more information]
Windows XP Hotfix (SP1) [See Q329390 for more information]
Windows XP Hotfix (SP1) [See Q329441 for more information]
Windows XP Hotfix (SP1) [See Q329834 for more information]
Windows XP Hotfix (SP1) Q329170
Windows XP Hotfix (SP1) Q810577
Windows XP Hotfix (SP1) Q810833
Windows XP Hotfix (SP1) Q815021
Windows XP Hotfix (SP1) Q817606
WinRAR archiver
XRELAIS 3.1 ( Evaluation )



Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 04F0-DE04

Répertoire de C:\Program Files

15/12/2007 20:22 <REP> .
15/12/2007 20:22 <REP> ..
03/12/2006 18:19 <REP> ABBYY FineReader 5.0 Sprint
03/12/2006 18:18 <REP> ABBYY FineReader 6.0
07/09/2004 20:37 <REP> Ahead
05/11/2007 23:24 <REP> Alwil Software
01/12/2007 12:19 <REP> Apple Software Update
31/03/2007 22:01 <REP> asc
07/11/2007 18:53 <REP> Avira
07/09/2004 12:26 <REP> ComPlus Applications
05/11/2007 23:57 <REP> DivX
11/09/2004 09:45 <REP> EACOM
13/11/2007 21:43 <REP> Fichiers communs
08/11/2007 19:50 <REP> Google
14/11/2007 18:15 <REP> Internet Explorer
01/12/2007 12:28 <REP> iPod
05/12/2007 15:39 <REP> Ipod Video Converter
01/12/2007 12:28 <REP> iTunes
24/10/2007 18:06 <REP> Java
27/09/2006 10:23 <REP> LHSP
07/09/2004 19:19 <REP> McAfee.com
06/10/2006 12:17 <REP> Micro Application
05/02/2005 11:31 <REP> Micrografx
09/09/2004 14:45 <REP> microsoft frontpage
13/08/2007 10:34 <REP> Microsoft Games
09/09/2004 14:46 <REP> Microsoft Office
09/09/2004 14:49 <REP> Microsoft Visual Studio
07/09/2004 12:36 <REP> MouseWare
07/09/2004 12:27 <REP> Movie Maker
16/12/2007 17:23 <REP> Mozilla Firefox
07/09/2004 12:24 <REP> MSN
15/06/2005 14:01 <REP> MSN Apps
07/09/2004 12:24 <REP> MSN Gaming Zone
20/11/2007 14:33 <REP> MSN Messenger
04/12/2007 22:54 <REP> NCH Software
04/12/2007 22:43 <REP> NCH Swift Sound
08/01/2007 19:55 <REP> NetMeeting
28/07/2007 14:09 <REP> Network Associates
07/09/2004 12:26 <REP> Outlook Express
01/12/2007 12:24 <REP> QuickTime
29/12/2006 21:45 <REP> SAGEM
29/12/2006 21:45 <REP> SAGEM WiFi manager
14/11/2007 18:05 <REP> SDSComposants
29/12/2006 21:41 <REP> Securitoo
07/09/2004 12:25 <REP> Services en ligne
05/02/2005 11:38 <REP> TextBridge Classic
07/09/2004 19:25 <REP> Viewpoint
16/12/2007 17:30 <REP> Wanadoo
13/02/2007 11:17 <REP> WIDCOMM
06/11/2007 17:37 <REP> Windows Media Player
07/09/2004 12:24 <REP> Windows NT
23/02/2007 14:32 <REP> WinRAR
07/09/2004 12:30 <REP> xerox
0 fichier(s) 0 octets
53 Rép(s) 7 622 332 416 octets libres
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 04F0-DE04

Répertoire de C:\Program Files\fichiers communs

13/11/2007 21:43 <REP> .
13/11/2007 21:43 <REP> ..
07/09/2007 22:11 <REP> Adobe
09/08/2007 15:51 <REP> Adobe Systems Shared
07/09/2004 20:37 <REP> Ahead
07/09/2004 19:25 <REP> aolshare
26/10/2007 15:42 <REP> BOONTY Shared
09/09/2004 14:49 <REP> Designer
30/12/2006 11:24 <REP> InstallShield
30/12/2006 10:49 <REP> Java
02/01/2007 12:13 <REP> Logitech
20/11/2007 14:33 <REP> Microsoft Shared
07/09/2004 12:26 <REP> MSSoap
07/09/2004 19:14 <REP> Network Associates
30/05/2005 08:28 <REP> NSV
30/05/2005 08:25 <REP> Nullsoft
07/09/2004 12:19 <REP> ODBC
27/01/2007 17:01 <REP> Real
07/09/2004 12:26 <REP> Services
07/09/2004 12:19 <REP> SpeechEngines
09/09/2004 14:48 <REP> System
0 fichier(s) 0 octets
21 Rép(s) 7 622 332 416 octets libres
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 04F0-DE04

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

07/09/2004 12:35 <REP> .
07/09/2004 12:35 <REP> ..
18/05/2001 16:57 561 209 MSONSEXT.DLL
03/06/1999 13:09 122 937 MSOWS409.DLL
07/03/2001 08:00 127 033 MSOWS40c.DLL
18/03/1999 05:37 593 977 RAGENT.DLL
4 fichier(s) 1 405 156 octets
2 Rép(s) 7 622 328 320 octets libres




c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.5.0.20\iTunesSetupAdmin.exe
c:\Documents and Settings\Jean-François\Bureau\Jean-françois\esd12version98NTXP2000\_ISDEL.EXE
c:\Documents and Settings\Jean-François\Bureau\Jean-françois\esd12version98NTXP2000\SETUP.EXE
c:\Documents and Settings\Yoann\Application Data\LimeWire\.NetworkShare\LimeWireWin4.14.12.exe
c:\Documents and Settings\Yoann\Bureau\fsbl.exe
c:\Documents and Settings\Yoann\Bureau\HiJackThis.exe
c:\Documents and Settings\Yoann\Bureau\OTMoveIt.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\catchme.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\diff.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\dumphive.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\find2.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\Fport.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\grep.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\gzip.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\KProcCheck.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\LFiles.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\md5sums.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\pslist.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\sigcheck.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\streams.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\swreg.exe
c:\Documents and Settings\Yoann\Bureau\DiagHelp\tar.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\dumphive.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\exit.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\GenericRenosFix.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\HostsChk.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\IEDFix.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\Process.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\Reboot.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\restart.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\SmiUpdate.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\SrchSTS.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\swreg.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\swsc.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\swxcacls.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\unzip.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\VCCLSID.exe
c:\Documents and Settings\Yoann\Bureau\Smithfraudfix\SmitfraudFix\WS2Fix.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\Ad-Aware SE Personal\Ad-Aware.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\Ad-Aware SE Personal\unregaaw.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\Ad-Aware SE Personal\UNWISE.EXE
c:\Documents and Settings\Yoann\Bureau\yoann\divers\Ad-Aware SE Personal\Lang\pllangs.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\Ad-Aware SE Personal\Lang\Plugins\Langs\UNWISE.EXE
c:\Documents and Settings\Yoann\Bureau\yoann\divers\audacity\audacity-win-1.2.6.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\audacity\Audacity\audacity.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\audacity\Audacity\unins000.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\cdex\cdex_170b2_enu_nonunicode.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\cdex\CDex_170b2\CDex.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\cdex\CDex_170b2\uninstall.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\Itunes\iTunes75Setup.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\LimeWireWin\Limewire Lime Wire Pro 4.12.3.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\LimeWireWin\LimeWireWin(2).exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\LimeWireWin\LimeWire\LimeWire.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\LimeWireWin\LimeWire\uninstall.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\X-relais\install X-relais\instmsia.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\X-relais\install X-relais\instmsiw.exe
c:\Documents and Settings\Yoann\Bureau\yoann\divers\X-relais\install X-relais\setup.exe
c:\Documents and Settings\Yoann\Bureau\yoann\dossier yoann\Install_Messenger.exe
c:\Documents and Settings\Yoann\Bureau\yoann\free ipod converter\Setup_FreeIpodConverter.exe
c:\Documents and Settings\Yoann\Bureau\yoann\free ipod converter\Ipod Video Converter\IPODConverter.exe
c:\Documents and Settings\Yoann\Bureau\yoann\free ipod converter\Ipod Video Converter\unins000.exe
c:\Documents and Settings\Yoann\Bureau\yoann\VLC\uninstall.exe
c:\Documents and Settings\Yoann\Bureau\yoann\VLC\vlc.exe
c:\Documents and Settings\Yoann\Bureau\yoann\VLC\instal VLC\vlc-0.8.6d-win32.exe
c:\Documents and Settings\Yoann\Local Settings\Application Data\Shareaza\Incomplete\ARSENAL Taste The Power.exe
c:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\BACKUP\FAILSAFE\avewin32.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_YOANN.tar.gz a l'adresse http://upload.malekal.com

Ok, ils sont là, planqués au chaud, et il y a du monde.

Artillerie lourde (ne pas l'interrompre) :

Télécharge combofix.exe de sUBs et sauvegarde le sur ton bureau.

• Double-clique combofix.exe afin de l'exécuter et suis les instructions.
• Lorsque l'analyse sera complétée, un rapport apparaîtra.
• Copie-colle ce rapport dans ta prochaine réponse.

je suis pret a tenir toute la nuit capitaine

parcontre pourquoi il ma fait un autre raccourcis de IE sur mon bureau apres le redemarage??? et il y a etait server car firefox ma demander si je le voulais en navigateur de defaut (ce qui etait deja fait avant)^^

voici le log ^^:

ComboFix 07-12-16.3 - Yoann 2007-12-16 17:59:27.1 - NTFSx86
Running from: C:\Documents and Settings\Yoann\Bureau\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-16 to 2007-12-16 ))))))))))))))))))))))))))))))))))))
.

2007-12-16 17:31 . 2007-12-16 17:31 452,836 --a------ C:\upload_moi_YOANN.tar.gz
2007-12-16 16:15 . 2007-12-16 16:15 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-16 16:15 . 2007-12-16 16:15 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-16 10:25 . 2007-12-16 10:25 3,052 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-16 10:24 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-12-16 10:24 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-12-16 10:24 . 2007-12-13 19:40 77,824 --a------ C:\WINDOWS\system32\IEDFix.exe
2007-12-16 10:24 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-12-16 10:24 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-12-16 10:24 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-12-14 22:09 . 2007-12-14 22:09 <REP> d-------- C:\Documents and Settings\Yoann\Incomplete
2007-12-14 22:08 . 2007-12-15 17:58 <REP> d-------- C:\Documents and Settings\Yoann\Application Data\LimeWire
2007-12-05 15:59 . 2003-04-18 14:29 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2007-12-05 15:59 . 2003-01-26 11:41 40,960 --a------ C:\WINDOWS\system32\SSubTmr6.dll
2007-12-05 15:38 . 2007-12-05 15:39 <REP> d-------- C:\Program Files\Ipod Video Converter
2007-12-04 22:37 . 2007-12-04 22:43 <REP> d-------- C:\Program Files\NCH Swift Sound
2007-12-04 22:37 . 2007-12-04 22:37 <REP> d-------- C:\Documents and Settings\Yoann\Application Data\NCH Swift Sound
2007-12-04 22:37 . 2007-12-04 22:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
2007-12-04 22:37 . 2007-12-04 22:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
2007-12-04 22:35 . 2007-12-04 22:54 <REP> d-------- C:\Program Files\NCH Software
2007-12-04 21:57 . 2005-05-14 21:09 2,179,072 --a------ C:\WINDOWS\system32\mfc71d.dll
2007-12-04 21:57 . 2006-07-11 19:06 544,768 --a------ C:\WINDOWS\system32\msvcr71d.dll
2007-12-04 21:57 . 2006-05-12 09:37 490,496 --a------ C:\WINDOWS\system32\MP4Splitter.ax
2007-12-04 21:57 . 2007-07-20 08:05 132,880 --a------ C:\WINDOWS\system32\msinet.OCX
2007-12-04 21:57 . 1999-03-25 20:00 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL
2007-12-04 21:57 . 2005-09-28 02:31 24,576 --a------ C:\WINDOWS\system32\ControlSubX.ocx
2007-12-04 21:57 . 1998-07-13 00:00 21,504 --a------ C:\WINDOWS\system32\TABCTFR.DLL
2007-12-04 21:57 . 1998-07-13 00:00 15,360 --a------ C:\WINDOWS\system32\inetfr.DLL
2007-12-04 21:55 . 1998-07-13 00:00 141,312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL
2007-12-04 21:55 . 1998-07-13 00:00 59,904 --a------ C:\WINDOWS\system32\Mscc2fr.dll
2007-12-04 21:55 . 1998-07-12 20:00 32,768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL
2007-12-04 21:55 . 1998-07-13 01:00 20,992 --a------ C:\WINDOWS\system32\CMCT2FR.DLL
2007-12-04 20:19 . 2004-05-25 17:06 417,792 --a------ C:\WINDOWS\system32\ac3filter.ax
2007-12-04 20:19 . 2005-02-27 21:48 356,352 --a------ C:\WINDOWS\system32\RealMediaSplitter.ax
2007-12-04 20:19 . 2004-01-10 17:02 258,048 --a------ C:\WINDOWS\system32\GplMpgDec.ax
2007-12-04 20:01 . 2007-12-04 20:01 <REP> d-------- C:\Documents and Settings\Yoann\Application Data\vlc
2007-12-01 12:29 . 2007-12-01 12:29 <REP> d-------- C:\Documents and Settings\Yoann\Application Data\Apple Computer
2007-12-01 12:28 . 2007-12-01 12:28 <REP> d-------- C:\Program Files\iPod
2007-12-01 12:26 . 2007-12-01 12:28 <REP> d-------- C:\Program Files\iTunes
2007-12-01 12:21 . 2007-12-01 12:24 <REP> d-------- C:\Program Files\QuickTime
2007-12-01 12:21 . 2007-12-01 12:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-01 12:19 . 2007-12-01 12:19 <REP> d-------- C:\Program Files\Apple Software Update
2007-12-01 12:19 . 2007-12-01 12:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-11-20 14:33 . 2007-11-20 14:33 <REP> d-------- C:\Program Files\MSN Messenger

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-16 17:09 --------- d-----w C:\Program Files\Wanadoo
2007-11-14 18:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Micrelec
2007-11-14 17:05 --------- d-----w C:\Program Files\SDSComposants
2007-11-13 20:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Altova
2007-11-08 18:50 --------- d-----w C:\Program Files\Google
2007-11-07 17:53 --------- d-----w C:\Program Files\Avira
2007-11-06 22:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2007-11-05 22:57 --------- d-----w C:\Program Files\DivX
2007-11-05 22:24 --------- d-----w C:\Program Files\Alwil Software
2007-11-05 22:19 --------- d-----w C:\Documents and Settings\Muriel\Application Data\McAfee.com Personal Firewall
2007-10-26 14:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\BOONTY
2007-10-26 14:42 --------- d-----w C:\Program Files\Fichiers communs\BOONTY Shared
2007-10-24 17:06 --------- d-----w C:\Program Files\Java
2007-10-17 17:23 10,752 ----a-w C:\WINDOWS\system32\WhoisCL.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2001-08-07 23:25]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2001-08-07 22:36]
"EM_EXEC"="C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2001-08-24 08:40]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2003-08-19 07:42]
"NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 11:50]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-09-01 14:32]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2005-12-09 15:32]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" []
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-06 23:22]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]
"combofix"="C:\WINDOWS\system32\cmd.exe" [2001-08-28 11:00]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"= shdocvw.dll [ ]

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys
R3 LVPrcMon;Logitech LVPrcMon Driver;\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\System32\DRIVERS\WlanBZXP.sys
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS
S3 V90drv;v90drv;C:\WINDOWS\System32\DRIVERS\v90drv.sys
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\C:\WINDOWS\System32\ZDCndis5.SYS
S3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\System32\ZDPNDIS5.SYS

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-01 11:19:27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2004-09-07 11:59:12 C:\WINDOWS\Tasks\Rappel d'enregistrement 1.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-16 18:10:47
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-16 18:12:21 - machine was rebooted

Je te prépare un script.

@ toute

Crée un fichier texte nommé CFScript.txt
Double clique pour l'ouvrir, et copie colle ceci dedans :

Folder::
C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Dcads Games Collection

File::
C:\WINDOWS\System32\dcads-remove.exe
C:\WINDOWS\System32\superiorads-uninst.exe
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

RootKit::
C:\WINDOWS\System32\drivers\hidr.exe
C:\WINDOWS\System32\wintems.exe

DirLook::
C:\_OTMoveIt\MovedFiles

Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture

• Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
• Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
• Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

et voila la repport ^^



ComboFix 07-12-16.3 - Yoann 2007-12-17 17:52:55.2 - NTFSx86
Running from: C:\Documents and Settings\Yoann\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Yoann\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\WINDOWS\System32\dcads-remove.exe
C:\WINDOWS\System32\superiorads-uninst.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B51CD000.dat
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\WINDOWS\System32\drivers\hidr.exe
C:\WINDOWS\System32\wintems.exe

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-17 to 2007-12-17 ))))))))))))))))))))))))))))))))))))
.

2007-12-16 10:25 . 2007-12-16 10:25 3,052 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-16 10:24 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-12-16 10:24 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-12-16 10:24 . 2007-12-13 19:40 77,824 --a------ C:\WINDOWS\system32\IEDFix.exe
2007-12-16 10:24 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-12-16 10:24 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-12-16 10:24 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-12-14 22:09 . 2007-12-14 22:09 <REP> d-------- C:\Documents and Settings\Yoann\Incomplete
2007-12-14 22:08 . 2007-12-15 17:58 <REP> d-------- C:\Documents and Settings\Yoann\Application Data\LimeWire
2007-12-05 15:59 . 2003-04-18 14:29 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2007-12-05 15:59 . 2003-01-26 11:41 40,960 --a------ C:\WINDOWS\system32\SSubTmr6.dll
2007-12-05 15:38 . 2007-12-05 15:39 <REP> d-------- C:\Program Files\Ipod Video Converter
2007-12-04 22:37 . 2007-12-04 22:43 <REP> d-------- C:\Program Files\NCH Swift Sound
2007-12-04 22:37 . 2007-12-04 22:37 <REP> d-------- C:\Documents and Settings\Yoann\Application Data\NCH Swift Sound
2007-12-04 22:37 . 2007-12-04 22:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
2007-12-04 22:37 . 2007-12-04 22:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
2007-12-04 22:35 . 2007-12-04 22:54 <REP> d-------- C:\Program Files\NCH Software
2007-12-04 21:57 . 2005-05-14 21:09 2,179,072 --a------ C:\WINDOWS\system32\mfc71d.dll
2007-12-04 21:57 . 2006-07-11 19:06 544,768 --a------ C:\WINDOWS\system32\msvcr71d.dll
2007-12-04 21:57 . 2006-05-12 09:37 490,496 --a------ C:\WINDOWS\system32\MP4Splitter.ax
2007-12-04 21:57 . 2007-07-20 08:05 132,880 --a------ C:\WINDOWS\system32\msinet.OCX
2007-12-04 21:57 . 1999-03-25 20:00 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL
2007-12-04 21:57 . 2005-09-28 02:31 24,576 --a------ C:\WINDOWS\system32\ControlSubX.ocx
2007-12-04 21:57 . 1998-07-13 00:00 21,504 --a------ C:\WINDOWS\system32\TABCTFR.DLL
2007-12-04 21:57 . 1998-07-13 00:00 15,360 --a------ C:\WINDOWS\system32\inetfr.DLL
2007-12-04 21:55 . 1998-07-13 00:00 141,312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL
2007-12-04 21:55 . 1998-07-13 00:00 59,904 --a------ C:\WINDOWS\system32\Mscc2fr.dll
2007-12-04 21:55 . 1998-07-12 20:00 32,768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL
2007-12-04 21:55 . 1998-07-13 01:00 20,992 --a------ C:\WINDOWS\system32\CMCT2FR.DLL
2007-12-04 20:19 . 2004-05-25 17:06 417,792 --a------ C:\WINDOWS\system32\ac3filter.ax
2007-12-04 20:19 . 2005-02-27 21:48 356,352 --a------ C:\WINDOWS\system32\RealMediaSplitter.ax
2007-12-04 20:19 . 2004-01-10 17:02 258,048 --a------ C:\WINDOWS\system32\GplMpgDec.ax
2007-12-04 20:01 . 2007-12-04 20:01 <REP> d-------- C:\Documents and Settings\Yoann\Application Data\vlc
2007-12-01 12:29 . 2007-12-01 12:29 <REP> d-------- C:\Documents and Settings\Yoann\Application Data\Apple Computer
2007-12-01 12:28 . 2007-12-01 12:28 <REP> d-------- C:\Program Files\iPod
2007-12-01 12:26 . 2007-12-01 12:28 <REP> d-------- C:\Program Files\iTunes
2007-12-01 12:21 . 2007-12-01 12:24 <REP> d-------- C:\Program Files\QuickTime
2007-12-01 12:21 . 2007-12-01 12:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-01 12:19 . 2007-12-01 12:19 <REP> d-------- C:\Program Files\Apple Software Update
2007-12-01 12:19 . 2007-12-01 12:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-11-20 14:33 . 2007-11-20 14:33 <REP> d-------- C:\Program Files\MSN Messenger

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-17 17:00 --------- d-----w C:\Program Files\Wanadoo
2007-11-14 18:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Micrelec
2007-11-14 17:05 --------- d-----w C:\Program Files\SDSComposants
2007-11-13 20:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Altova
2007-11-08 18:50 --------- d-----w C:\Program Files\Google
2007-11-07 17:53 --------- d-----w C:\Program Files\Avira
2007-11-06 22:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2007-11-05 22:57 --------- d-----w C:\Program Files\DivX
2007-11-05 22:24 --------- d-----w C:\Program Files\Alwil Software
2007-11-05 22:19 --------- d-----w C:\Documents and Settings\Muriel\Application Data\McAfee.com Personal Firewall
2007-10-24 17:06 --------- d-----w C:\Program Files\Java
2007-10-17 17:23 10,752 ----a-w C:\WINDOWS\system32\WhoisCL.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\_OTMoveIt\MovedFiles ----

C:\_OTMoveIt\MovedFiles\


((((((((((((((((((((((((((((( snapshot@2007-12-16_18.11.18.28 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-16 16:59:08 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT
+ 2007-12-17 16:52:29 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2001-08-07 23:25]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2001-08-07 22:36]
"EM_EXEC"="C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2001-08-24 08:40]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2003-08-19 07:42]
"NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 11:50]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-09-01 14:32]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2005-12-09 15:32]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" []
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-06 23:22]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"= shdocvw.dll [ ]

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys
R3 LVPrcMon;Logitech LVPrcMon Driver;\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\System32\DRIVERS\WlanBZXP.sys
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS
S3 V90drv;v90drv;C:\WINDOWS\System32\DRIVERS\v90drv.sys
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\C:\WINDOWS\System32\ZDCndis5.SYS
S3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\System32\ZDPNDIS5.SYS

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-01 11:19:27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2004-09-07 11:59:12 C:\WINDOWS\Tasks\Rappel d'enregistrement 1.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-17 18:01:17
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-17 18:04:19 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-16 18:12

Bien, peux-tu poster un nouveau log HJT stp ?
On va faire un 2eme script, le driver est encore là.
Je collecte une liste de fichiers et je te prépare ça. Blacklight et d'autres n'ont pas tout vu, c'est anormal.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:14:32, on 17/12/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Yoann\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.planetis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Icône AOL.lnk = C:\Program Files\AOL 7.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7601 bytes

Shoote cette ligne :

O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)

Télécharge Gmer.
Dézippe le dans un dossier ou sur ton bureau.

Double-clique sur Gmer.exe

NB : Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'exécuter.

Clique sur l'onglet rootkit.
A droite, coche Files et Services.
Clique maintenant sur Scan.

Lorsque le scan est terminé, clique sur Copy.

Ouvre le Bloc-notes puis clique sur le Menu Edition / Coller.
Le rapport doit alors apparaître.
Enregistre le fichier sur ton bureau et copie/colle son contenu dans ta prochaine réponse.

Après, autre script, j'espère le dernier, il me faut le nom du driver (sinon j'utiliserai les standards, j'ai ma liste sous le coude).

j'ai deja toute els cases de cocher je laisse?

Ne coche que files et services (j'aurai dû préciser).

le scan c'est bien fait j'ai cree un nouveau bloc note puis j'ai fait "copy" mais quand je veut el coller sur le bloc note et beh ca me met pas le rapport -_-'