J'ai imprimé l'aide sur le site ...
J'ai télécharger Combofix
J'ai fermé Antivir, et IE
et voilà
ComboFix 09-03-19.02 - Christelle 2009-03-22 19:06:02.1 - NTFSx86
Lancé depuis: c:\documents and settings\Christelle\Bureau\combofix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\patch.exe
c:\windows\system32\_004233_.tmp.dll
c:\windows\system32\_004234_.tmp.dll
c:\windows\system32\_004235_.tmp.dll
c:\windows\system32\_004236_.tmp.dll
c:\windows\system32\_004243_.tmp.dll
c:\windows\system32\_004244_.tmp.dll
c:\windows\system32\_004245_.tmp.dll
c:\windows\system32\_004247_.tmp.dll
c:\windows\system32\_004248_.tmp.dll
c:\windows\system32\_004251_.tmp.dll
c:\windows\system32\_004252_.tmp.dll
c:\windows\system32\_004254_.tmp.dll
c:\windows\system32\_004255_.tmp.dll
c:\windows\system32\_004256_.tmp.dll
c:\windows\system32\_004258_.tmp.dll
c:\windows\system32\_004261_.tmp.dll
c:\windows\system32\_004262_.tmp.dll
c:\windows\system32\_004266_.tmp.dll
c:\windows\system32\_004267_.tmp.dll
c:\windows\system32\_004269_.tmp.dll
c:\windows\system32\_004272_.tmp.dll
c:\windows\system32\_004274_.tmp.dll
c:\windows\system32\_004275_.tmp.dll
c:\windows\system32\_004276_.tmp.dll
c:\windows\system32\_004277_.tmp.dll
c:\windows\system32\_004280_.tmp.dll
c:\windows\system32\_004281_.tmp.dll
c:\windows\system32\_004282_.tmp.dll
c:\windows\system32\_004283_.tmp.dll
c:\windows\system32\_004284_.tmp.dll
c:\windows\system32\_004289_.tmp.dll
c:\windows\system32\_004291_.tmp.dll
c:\windows\system32\_006712_.tmp.dll
c:\windows\system32\_006713_.tmp.dll
c:\windows\system32\_006714_.tmp.dll
c:\windows\system32\_006715_.tmp.dll
c:\windows\system32\_006722_.tmp.dll
c:\windows\system32\_006723_.tmp.dll
c:\windows\system32\_006724_.tmp.dll
c:\windows\system32\_006725_.tmp.dll
c:\windows\system32\_006727_.tmp.dll
c:\windows\system32\_006728_.tmp.dll
c:\windows\system32\_006731_.tmp.dll
c:\windows\system32\_006732_.tmp.dll
c:\windows\system32\_006734_.tmp.dll
c:\windows\system32\_006735_.tmp.dll
c:\windows\system32\_006736_.tmp.dll
c:\windows\system32\_006738_.tmp.dll
c:\windows\system32\_006741_.tmp.dll
c:\windows\system32\_006742_.tmp.dll
c:\windows\system32\_006746_.tmp.dll
c:\windows\system32\_006747_.tmp.dll
c:\windows\system32\_006749_.tmp.dll
c:\windows\system32\_006752_.tmp.dll
c:\windows\system32\_006754_.tmp.dll
c:\windows\system32\_006755_.tmp.dll
c:\windows\system32\_006756_.tmp.dll
c:\windows\system32\_006757_.tmp.dll
c:\windows\system32\_006758_.tmp.dll
c:\windows\system32\_006761_.tmp.dll
c:\windows\system32\_006762_.tmp.dll
c:\windows\system32\_006763_.tmp.dll
c:\windows\system32\_006764_.tmp.dll
c:\windows\system32\_006765_.tmp.dll
c:\windows\system32\_006770_.tmp.dll
c:\windows\system32\_006772_.tmp.dll
c:\windows\system32\rnaph.dll
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_WKSPATCH
-------\Service_vspf
-------\Service_vspf_hk
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-22 au 2009-03-22 ))))))))))))))))))))))))))))))))))))
.
2009-03-22 19:13 . 2009-03-22 19:13 54,156 --ah----- c:\windows\QTFont.qfn
2009-03-22 19:13 . 2009-03-22 19:13 1,409 --a------ c:\windows\QTFont.for
2009-03-22 18:54 . 2009-03-22 18:55 <REP> d-------- C:\32788R22FWJFW
2009-03-22 18:46 . 2009-03-22 18:46 <REP> d-------- c:\program files\7-Zip
2009-03-22 14:33 . 2009-03-22 14:33 <REP> d-------- C:\_OTMoveIt
2009-03-22 14:15 . 2009-03-22 16:21 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion(2)
2009-03-22 12:20 . 2009-03-22 17:07 1,374 --a------ c:\windows\imsins.BAK
2009-03-21 19:32 . 2009-03-22 16:21 <REP> d-------- c:\program files\Ad-remover
2009-03-21 12:42 . 2009-03-21 12:42 <REP> d-------- C:\rsit
2009-03-21 12:07 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-21 12:07 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-21 11:19 . 2009-03-21 11:18 410,984 --a------ c:\windows\system32\deploytk.dll
2009-03-21 10:46 . 2009-03-21 10:46 <REP> d-------- c:\windows\LastGood(3)
2009-03-21 10:43 . 2009-03-21 10:43 <REP> d-------- c:\windows\LastGood(2)
2009-03-20 22:59 . 2009-03-21 12:07 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-20 22:59 . 2009-03-20 22:59 <REP> d-------- c:\documents and settings\Christelle\Application Data\Malwarebytes
2009-03-20 22:59 . 2009-03-20 22:59 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-18 21:22 . 2009-03-18 21:22 <REP> d-------- c:\documents and settings\All Users\Application Data\WotT
2009-03-18 20:27 . 2009-03-18 20:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Gogii
2009-03-17 22:22 . 2009-03-17 22:22 <REP> d-------- c:\documents and settings\Christelle\Application Data\Boolat Games
2009-03-15 22:04 . 2009-03-15 22:04 <REP> d-------- c:\documents and settings\All Users\Application Data\Alawar Stargaze
2009-03-15 22:00 . 2009-03-15 22:00 <REP> d-------- c:\documents and settings\All Users\Application Data\PlayPond
2009-03-15 21:58 . 2009-03-15 21:59 <REP> d-------- c:\documents and settings\All Users\Application Data\TonkyPonky
2009-03-14 22:20 . 2009-03-14 22:20 <REP> d-------- c:\documents and settings\Christelle\Application Data\Oberon Media
2009-03-14 21:17 . 2009-03-14 21:17 <REP> d-------- c:\documents and settings\All Users\Application Data\Intenium
2009-03-14 19:36 . 2009-03-14 19:36 <REP> d-------- c:\documents and settings\All Users\Application Data\EscapeTheMuseum
2009-03-13 22:48 . 2009-03-13 22:48 <REP> d-------- c:\documents and settings\Christelle\Application Data\ZEMNOTT
2009-03-13 21:20 . 2009-03-13 21:20 <REP> d-------- c:\documents and settings\Christelle\Application Data\MiniIT Games
2009-03-08 21:59 . 2009-03-08 21:59 <REP> d-------- c:\documents and settings\All Users\Application Data\Fugazo
2009-03-08 18:24 . 2009-03-08 18:24 <REP> d-------- c:\documents and settings\All Users\Application Data\SugarGames
2009-03-07 15:43 . 2009-03-07 15:43 <REP> d-------- c:\documents and settings\Christelle\Application Data\EleFun Games
2009-03-06 19:04 . 2009-03-06 19:04 <REP> d-------- c:\documents and settings\Christelle\Application Data\ITTNord
2009-03-04 20:30 . 2009-03-04 20:30 <REP> d-------- c:\documents and settings\Christelle\Application Data\blg
2009-03-04 20:30 . 2009-03-04 20:30 <REP> d-------- c:\documents and settings\All Users\Application Data\blg
2009-02-25 22:28 . 2004-08-04 06:31 20,992 --a------ c:\windows\system32\drivers\RTL8139.sys
2009-02-25 22:28 . 2004-08-04 06:31 20,992 --a--c--- c:\windows\system32\dllcache\rtl8139.sys
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-22 18:15 --------- d-----w c:\program files\Wanadoo
2009-03-22 16:43 --------- d-----w c:\program files\Yahoo!
2009-03-22 15:21 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-22 15:21 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-22 15:18 --------- d-----w c:\program files\SCOL
2009-03-21 10:18 --------- d-----w c:\program files\Java
2009-03-21 09:54 --------- d-----w c:\program files\Oberon Media
2009-03-21 09:47 --------- d-----w c:\documents and settings\All Users\Application Data\Flood Light Games
2009-03-19 20:35 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-19 19:34 --------- d-----w c:\documents and settings\Christelle\Application Data\Flood Light Games
2009-03-15 22:27 --------- d-----w c:\documents and settings\All Users\Application Data\Playrix Entertainment
2009-03-02 21:07 --------- d-----w c:\documents and settings\Christelle\Application Data\Boomzap
2009-02-20 15:44 --------- d-----w c:\documents and settings\Christelle\Application Data\Oberon Games
2009-02-20 15:44 --------- d-----w c:\documents and settings\All Users\Application Data\Oberon Games
2009-02-19 21:47 --------- d-----w c:\documents and settings\Christelle\Application Data\Go Go Gourmet
2009-02-18 19:41 --------- d-----w c:\documents and settings\All Users\Application Data\Mushroom Age
2009-02-16 20:13 --------- d-----w c:\documents and settings\All Users\Application Data\HipSoft
2009-02-16 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\VirtualFarm
2009-02-16 17:42 --------- d-----w c:\documents and settings\Christelle\Application Data\PlayFirst
2009-02-16 17:42 --------- d-----w c:\documents and settings\All Users\Application Data\PlayFirst
2009-02-14 10:06 --------- d-----w c:\documents and settings\All Users\Application Data\FreshGames
2009-02-12 18:10 --------- d-----w c:\documents and settings\Christelle\Application Data\BeachPartyCraze
2009-02-11 22:48 --------- d-----w c:\documents and settings\All Users\Application Data\FarmFrenzy2
2009-02-09 17:23 --------- d-----w c:\documents and settings\All Users\Application Data\JollyBear
2009-02-08 20:46 --------- d-----w c:\documents and settings\Christelle\Application Data\cerasus.media
2009-02-08 19:43 --------- d-----w c:\documents and settings\Christelle\Application Data\Friday's games
2009-02-08 18:32 --------- d-----w c:\documents and settings\All Users\Application Data\SpinTop Games
2009-02-07 17:29 --------- d-----w c:\documents and settings\Christelle\Application Data\Games
2009-02-07 16:06 --------- d-----w c:\documents and settings\Christelle\Application Data\SecretIslandEng
2009-02-07 14:21 --------- d-----w c:\documents and settings\All Users\Application Data\Sandlot Games
2009-02-07 11:10 --------- d-----w c:\documents and settings\Christelle\Application Data\YoudaGames
2009-02-06 18:22 --------- d-----w c:\documents and settings\Christelle\Application Data\GameInvest
2009-01-25 18:41 --------- d-----w c:\program files\CCleaner
2009-01-25 18:36 --------- d-----w c:\documents and settings\Christelle\Application Data\Yahoo!
2009-01-25 18:26 --------- d-----w c:\program files\Avira
2009-01-25 18:26 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-12-11 19:33 102,432 -c----r c:\program files\Fichiers communs\advapi32.exe
2004-09-29 10:17 37 -c--a-w c:\documents and settings\Christelle\Application Data\tvmcwrd.dll
.
------- Sigcheck -------
2008-04-14 03:34 112640 7e3defe771cb451b0ff630bfa435417e c:\windows\ServicePackFiles\i386\wuauclt.exe
2008-04-14 03:34 112640 7e3defe771cb451b0ff630bfa435417e c:\windows\SoftwareDistribution\Download\d43a20c40794c502928d4b7d8ff0ea20\wuauclt.exe
2008-10-16 14:09 51224 e654b78d2f1d791b30d0ed9a8195ec22 c:\windows\system32\wuauclt.exe
2008-10-16 14:09 51224 e654b78d2f1d791b30d0ed9a8195ec22 c:\windows\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-20 15360]
"WOOKIT"="c:\progra~1\Wanadoo\Shell.exe" [2004-08-23 122880]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2006-01-01 40960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2003-12-26 26112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-08-15 77824]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2006-01-01 40960]
"V0220Mon.exe"="c:\windows\V0220Mon.exe" [2006-06-28 32768]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-10-19 20480]
"WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-21 136600]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2004-12-15 176128]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-20 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2005-02-03 962661]
EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2004-05-09 127488]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\e:\[u]0[/u]autocheck autochk *\[u]0[/u]stera
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
--------- 2004-10-05 17:00 61440 c:\progra~1\Wanadoo\TaskBarIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
--------- 2004-08-23 14:49 20480 c:\progra~1\Wanadoo\Watch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SCOL\\UsmWin.exe"=
"c:\\Program Files\\SCOL\\scolsetup.exe"=
R2 Devx;Devx;c:\windows\system32\drivers\Devx.sys [2004-07-17 4448]
R2 VtPr;VtPr;c:\windows\system32\drivers\VtPr.sys [2004-07-17 3328]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\system32\drivers\sis7012.sys [2001-11-26 165760]
S3 LwAdiHid;Périphériques numériques WingMan Logitech (détection automatique);c:\windows\system32\drivers\LwAdiHid.sys [2004-03-18 20864]
S3 V0220Dev;Live! Cam Video IM;c:\windows\system32\drivers\V0220Dev.sys [2006-12-27 146112]
S3 V0220Vfx;V0220VFX;c:\windows\system32\drivers\V0220Vfx.sys [2006-12-27 6272]
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?]
S4 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-19 33752]
.
Contenu du dossier 'Tâches planifiées'
2009-03-22 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-10-10 23:25]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-Zwv9ROc9P - raswmi.exe
HKLM-Run-o74V3EQ - skeput8.exe
MSConfigStartUp-WooCnxMon - c:\progra~1\Wanadoo\CnxMon.exe
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.orange.fr
mSearch Bar = hxxp://www.myexexex.com/searchbar.php
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?873bf66715e1415bb01048f0d9fb408a
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?873bf66715e1415bb01048f0d9fb408a
IE: { - c:\program files\Messenger\msmsgs.exe
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} - file:///C:/Documents%20and%20Settings/Christelle/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/DinerDash2_fr.1.0.0.70.cab
DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} - file:///C:/Documents%20and%20Settings/Christelle/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/DinerDash.1.0.0.98.cab
DPF: {FDE6B956-B80A-4578-9A10-4C24609412F1} - hxxp://64.158.165.147/output/060571/fr/fullgames/fullgames.exe
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-03-22 19:12:33
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Wanadoo\TaskBarIcon.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\spool\drivers\w32x86\3\E_S10IC2.EXE
c:\progra~1\Wanadoo\GestionnaireInternet.exe
c:\progra~1\Wanadoo\ComComp.exe
c:\progra~1\Wanadoo\Toaster.exe
c:\progra~1\Wanadoo\Inactivity.exe
c:\progra~1\Wanadoo\PollingModule.exe
c:\program files\Wanadoo\Watch.exe
c:\windows\system32\ALERTM~1\ALERTM~1.EXE
.
**************************************************************************
.
Heure de fin: 2009-03-22 19:21:59 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-03-22 18:21:49
Avant-CF: 7 086 342 144 octets libres
Après-CF: 7,012,589,568 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn
286 --- E O F --- 2009-03-22 17:55:39