Problème win32 non valide (Spybot et avast)

Salut à tous, je n'arrive plus à ouvris spybot ni avast à chaque fois j'ai le même message me disant que ces applications ne sont pas des applications win32 valides.
J'ai vu le message : http://www.sur-la-toile.com/discussion-103129-1-Mon-antivirus-ne-marche-plus-aidez-moi-.html

Elibagla me parle d'un fichier bagle.dldr


Mon Mar 03 15:07:46 2008
EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
Por favor, envienos una muestra del fichero
C:\Muestras\WINTEMS.EXE.Muestra EliBagle v11.09
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

Mon Mar 03 15:08:13 2008
EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.EXE --> Eliminado Bagle.dldr

Nº Total de Directorios: 6053
Nº Total de Ficheros: 82253
Nº de Ficheros Analizados: 12381
Nº de Ficheros Infectados: 1
Nº de Ficheros Limpiados: 1

Mon Mar 03 15:34:06 2008
EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
Por favor, envienos una muestra del fichero
C:\Muestras\WINTEMS.EXE.Muestra EliBagle v11.09
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
Reinicie para Completar la Limpieza.

Mon Mar 03 15:34:11 2008
EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

et j'ai fait ce qu'indiquait land3 mais combofix "n'est pas une application win32 valide!!"

Voicile rapport Hijack


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:42:02, on 03/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hphmon05.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\Panneau de contrôle ATI\atiptaxx.exe
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Multimedia\main\launchpd.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Documents and Settings\Damien & Anabelle\Local Settings\Temporary Internet Files\Content.IE5\MZ4TK8PR\ELIBAGLA.09032008[1].EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Damien & Anabelle\Local Settings\Temporary Internet Files\Content.IE5\NVVJCG1E\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.orange.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [ReEXEc] C:\Documents and Settings\Damien & Anabelle\Local Settings\Temporary Internet Files\Content.IE5\MZ4TK8PR\ELIBAGLA.09032008[1].EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/16.27/uploader2.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--
End of file - 9434 bytes



(Modifié par stupefix le 03-03-2008 à 15:45)

tu vas supprimer combofix
puis

= Faire un clic droit sur
Combofix
= Faire
Avec Firefox
= enregistrer la cible du lien sous
= choisir :Bureau
et avant d'accepter ==> remplacer : Combofix par: test

Avec internet explorer ==> fichiers ==> enregistrer sous
choisir : Bureau et dans dans « type » , il faut :Page Web complète [*.htm *.html]
et avant d'accepter ==> remplacer : Combofix par:test
----
fermer toutes les applications en cours
puis
=Double-clic sur Test qui est sur le bureau
= Accepter les demandes
= Attendre la fermeture de l’outil ( 5 -10 mn ou plus si infection importante)
=Copier/coller le rapport dans la réponse
Un rapport dans C:\Combofix.txt à mettre dans la réponse

réinstaller l'antivirus

bon je croyais l'avoir enlever mais il est revenu. je vais tout refaire depuis le début. Faut-il désinstaller l'antivirus avant?

il est revenu ?
si ton antivirus fonctionne , c'est étonnant
il est trouvé où dans combofix surement ( qoobox)

justement non, j'ai reinstallé mon antivirus et il ne fonctionnait pas!

Non il le retrouve dans le même que la première foix atix10.exe

Je reccommence toute la manip en commençant par elibagla







(Modifié par stupefix le 03-03-2008 à 16:41)

Ajout du 03-03-2008 à 16:45:

Voilà le premier rapport



Mon Mar 03 15:07:46 2008

EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Acción Directa):

Por favor, envienos una muestra del fichero

C:\Muestras\WINTEMS.EXE.Muestra EliBagle v11.09

a "virus@satinfo.es". Gracias.

C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.

C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle

C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.

C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.

Restaurada Clave: "SafeBoot\Minimal y Network"

Reinicie para Completar la Limpieza.



Mon Mar 03 15:08:13 2008

EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.EXE --> Eliminado Bagle.dldr



Nº Total de Directorios: 6053

Nº Total de Ficheros: 82253

Nº de Ficheros Analizados: 12381

Nº de Ficheros Infectados: 1

Nº de Ficheros Limpiados: 1



Mon Mar 03 15:34:06 2008

EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Acción Directa):

Por favor, envienos una muestra del fichero

C:\Muestras\WINTEMS.EXE.Muestra EliBagle v11.09

a "virus@satinfo.es". Gracias.

C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.

C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle

C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.

C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.

Reinicie para Completar la Limpieza.



Mon Mar 03 15:34:11 2008

EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\



Nº Total de Directorios: 6063

Nº Total de Ficheros: 82956

Nº de Ficheros Analizados: 12384

Nº de Ficheros Infectados: 0

Nº de Ficheros Limpiados: 0



Mon Mar 03 15:52:29 2008

EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Acción Directa):

Por favor, envienos una muestra del fichero

C:\Muestras\WINTEMS.EXE.Muestra EliBagle v11.09

a "virus@satinfo.es". Gracias.

C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.

C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.

C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.

Reinicie para Completar la Limpieza.



Mon Mar 03 15:52:46 2008

EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\



Nº Total de Directorios: 6048

Nº Total de Ficheros: 82921

Nº de Ficheros Analizados: 12370

Nº de Ficheros Infectados: 0

Nº de Ficheros Limpiados: 0



Mon Mar 03 16:13:00 2008

EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Acción Directa):

Por favor, envienos una muestra del fichero

C:\Muestras\WINTEMS.EXE.Muestra EliBagle v11.09

a "virus@satinfo.es". Gracias.

C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.

C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle

C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.

C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.

Restaurada Clave: "SafeBoot\Minimal y Network"

Reinicie para Completar la Limpieza.



Mon Mar 03 16:13:04 2008

EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.EXE --> Eliminado Bagle.dldr



Nº Total de Directorios: 5924

Nº Total de Ficheros: 82236

Nº de Ficheros Analizados: 12175

Nº de Ficheros Infectados: 1

Nº de Ficheros Limpiados: 1

Exploración Detenida por el Usuario.



Mon Mar 03 16:35:58 2008

EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Acción Directa):

Por favor, envienos una muestra del fichero

C:\Muestras\WINTEMS.EXE.Muestra EliBagle v11.09

a "virus@satinfo.es". Gracias.

C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.

C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle

C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.

C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.

Restaurada Clave: "SafeBoot\Minimal y Network"

Reinicie para Completar la Limpieza.



Mon Mar 03 16:36:02 2008

EliBagle v11.09 (c)2008 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.EXE --> Eliminado Bagle.dldr



Nº Total de Directorios: 6043

Nº Total de Ficheros: 83188

Nº de Ficheros Analizados: 12365

Nº de Ficheros Infectados: 1

Nº de Ficheros Limpiados: 1

Ajout du 03-03-2008 à 16:46:

Je passe maintenant à combofix

ok et tu mets son rapport

le voici



ComboFix 08-03-03.12 - Damien & Anabelle 2008-03-03 16:49:11.1 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.51 [GMT 1:00]

Endroit: C:\Documents and Settings\Damien & Anabelle\Bureau\test.exe

* Création d'un nouveau point de restauration



[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]

.



(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.



C:\WINDOWS\system32\drivers\down

C:\WINDOWS\system32\drivers\down\1002546.exe

C:\WINDOWS\system32\drivers\down\1006203.exe

C:\WINDOWS\system32\drivers\down\1049765.exe

C:\WINDOWS\system32\drivers\down\1053421.exe

C:\WINDOWS\system32\drivers\down\117203.exe

C:\WINDOWS\system32\drivers\down\1187171.exe

C:\WINDOWS\system32\drivers\down\1198046.exe

C:\WINDOWS\system32\drivers\down\120515.exe

C:\WINDOWS\system32\drivers\down\123671.exe

C:\WINDOWS\system32\drivers\down\127546.exe

C:\WINDOWS\system32\drivers\down\1285484.exe

C:\WINDOWS\system32\drivers\down\1285734.exe

C:\WINDOWS\system32\drivers\down\1318468.exe

C:\WINDOWS\system32\drivers\down\134093.exe

C:\WINDOWS\system32\drivers\down\142093.exe

C:\WINDOWS\system32\drivers\down\143046.exe

C:\WINDOWS\system32\drivers\down\14704531.exe

C:\WINDOWS\system32\drivers\down\14713906.exe

C:\WINDOWS\system32\drivers\down\14716281.exe

C:\WINDOWS\system32\drivers\down\14722203.exe

C:\WINDOWS\system32\drivers\down\14755281.exe

C:\WINDOWS\system32\drivers\down\14767656.exe

C:\WINDOWS\system32\drivers\down\14770328.exe

C:\WINDOWS\system32\drivers\down\14794031.exe

C:\WINDOWS\system32\drivers\down\14796625.exe

C:\WINDOWS\system32\drivers\down\14804125.exe

C:\WINDOWS\system32\drivers\down\14809921.exe

C:\WINDOWS\system32\drivers\down\14810734.exe

C:\WINDOWS\system32\drivers\down\14811093.exe

C:\WINDOWS\system32\drivers\down\14820406.exe

C:\WINDOWS\system32\drivers\down\14822781.exe

C:\WINDOWS\system32\drivers\down\14862140.exe

C:\WINDOWS\system32\drivers\down\1497921.exe

C:\WINDOWS\system32\drivers\down\153171.exe

C:\WINDOWS\system32\drivers\down\153421.exe

C:\WINDOWS\system32\drivers\down\1582046.exe

C:\WINDOWS\system32\drivers\down\159625.exe

C:\WINDOWS\system32\drivers\down\162515.exe

C:\WINDOWS\system32\drivers\down\162906.exe

C:\WINDOWS\system32\drivers\down\167546.exe

C:\WINDOWS\system32\drivers\down\167812.exe

C:\WINDOWS\system32\drivers\down\169890.exe

C:\WINDOWS\system32\drivers\down\170968.exe

C:\WINDOWS\system32\drivers\down\171031.exe

C:\WINDOWS\system32\drivers\down\173500.exe

C:\WINDOWS\system32\drivers\down\174078.exe

C:\WINDOWS\system32\drivers\down\176156.exe

C:\WINDOWS\system32\drivers\down\178890.exe

C:\WINDOWS\system32\drivers\down\179921.exe

C:\WINDOWS\system32\drivers\down\187046.exe

C:\WINDOWS\system32\drivers\down\190484.exe

C:\WINDOWS\system32\drivers\down\190734.exe

C:\WINDOWS\system32\drivers\down\191328.exe

C:\WINDOWS\system32\drivers\down\192625.exe

C:\WINDOWS\system32\drivers\down\1943531.exe

C:\WINDOWS\system32\drivers\down\196875.exe

C:\WINDOWS\system32\drivers\down\199031.exe

C:\WINDOWS\system32\drivers\down\199703.exe

C:\WINDOWS\system32\drivers\down\203687.exe

C:\WINDOWS\system32\drivers\down\206718.exe

C:\WINDOWS\system32\drivers\down\215890.exe

C:\WINDOWS\system32\drivers\down\219984.exe

C:\WINDOWS\system32\drivers\down\222703.exe

C:\WINDOWS\system32\drivers\down\224281.exe

C:\WINDOWS\system32\drivers\down\228421.exe

C:\WINDOWS\system32\drivers\down\2296125.exe

C:\WINDOWS\system32\drivers\down\231718.exe

C:\WINDOWS\system32\drivers\down\239265.exe

C:\WINDOWS\system32\drivers\down\245000.exe

C:\WINDOWS\system32\drivers\down\246296.exe

C:\WINDOWS\system32\drivers\down\248468.exe

C:\WINDOWS\system32\drivers\down\2509437.exe

C:\WINDOWS\system32\drivers\down\252875.exe

C:\WINDOWS\system32\drivers\down\255343.exe

C:\WINDOWS\system32\drivers\down\255546.exe

C:\WINDOWS\system32\drivers\down\258796.exe

C:\WINDOWS\system32\drivers\down\261812.exe

C:\WINDOWS\system32\drivers\down\262656.exe

C:\WINDOWS\system32\drivers\down\2629078.exe

C:\WINDOWS\system32\drivers\down\2632265.exe

C:\WINDOWS\system32\drivers\down\270109.exe

C:\WINDOWS\system32\drivers\down\277109.exe

C:\WINDOWS\system32\drivers\down\279875.exe

C:\WINDOWS\system32\drivers\down\283734.exe

C:\WINDOWS\system32\drivers\down\29295234.exe

C:\WINDOWS\system32\drivers\down\29302015.exe

C:\WINDOWS\system32\drivers\down\29309953.exe

C:\WINDOWS\system32\drivers\down\29313203.exe

C:\WINDOWS\system32\drivers\down\29317015.exe

C:\WINDOWS\system32\drivers\down\29362625.exe

C:\WINDOWS\system32\drivers\down\29379640.exe

C:\WINDOWS\system32\drivers\down\29383781.exe

C:\WINDOWS\system32\drivers\down\29397812.exe

C:\WINDOWS\system32\drivers\down\29401046.exe

C:\WINDOWS\system32\drivers\down\29413906.exe

C:\WINDOWS\system32\drivers\down\29422078.exe

C:\WINDOWS\system32\drivers\down\29422578.exe

C:\WINDOWS\system32\drivers\down\29422984.exe

C:\WINDOWS\system32\drivers\down\29431937.exe

C:\WINDOWS\system32\drivers\down\29434187.exe

C:\WINDOWS\system32\drivers\down\29476546.exe

C:\WINDOWS\system32\drivers\down\297031.exe

C:\WINDOWS\system32\drivers\down\305031.exe

C:\WINDOWS\system32\drivers\down\34097812.exe

C:\WINDOWS\system32\drivers\down\34102500.exe

C:\WINDOWS\system32\drivers\down\34109656.exe

C:\WINDOWS\system32\drivers\down\34116359.exe

C:\WINDOWS\system32\drivers\down\34121953.exe

C:\WINDOWS\system32\drivers\down\34155953.exe

C:\WINDOWS\system32\drivers\down\34175187.exe

C:\WINDOWS\system32\drivers\down\34178406.exe

C:\WINDOWS\system32\drivers\down\34188656.exe

C:\WINDOWS\system32\drivers\down\34191625.exe

C:\WINDOWS\system32\drivers\down\34201718.exe

C:\WINDOWS\system32\drivers\down\34206906.exe

C:\WINDOWS\system32\drivers\down\34207843.exe

C:\WINDOWS\system32\drivers\down\34208859.exe

C:\WINDOWS\system32\drivers\down\34216421.exe

C:\WINDOWS\system32\drivers\down\34219593.exe

C:\WINDOWS\system32\drivers\down\34263296.exe

C:\WINDOWS\system32\drivers\down\363812.exe

C:\WINDOWS\system32\drivers\down\368921.exe

C:\WINDOWS\system32\drivers\down\372640.exe

C:\WINDOWS\system32\drivers\down\375296.exe

C:\WINDOWS\system32\drivers\down\379937.exe

C:\WINDOWS\system32\drivers\down\381812.exe

C:\WINDOWS\system32\drivers\down\391093.exe

C:\WINDOWS\system32\drivers\down\397078.exe

C:\WINDOWS\system32\drivers\down\400515.exe

C:\WINDOWS\system32\drivers\down\400765.exe

C:\WINDOWS\system32\drivers\down\403718.exe

C:\WINDOWS\system32\drivers\down\405843.exe

C:\WINDOWS\system32\drivers\down\415343.exe

C:\WINDOWS\system32\drivers\down\418046.exe

C:\WINDOWS\system32\drivers\down\418187.exe

C:\WINDOWS\system32\drivers\down\419687.exe

C:\WINDOWS\system32\drivers\down\433171.exe

C:\WINDOWS\system32\drivers\down\43904171.exe

C:\WINDOWS\system32\drivers\down\43910828.exe

C:\WINDOWS\system32\drivers\down\43914078.exe

C:\WINDOWS\system32\drivers\down\43920218.exe

C:\WINDOWS\system32\drivers\down\43926796.exe

C:\WINDOWS\system32\drivers\down\43964281.exe

C:\WINDOWS\system32\drivers\down\43974468.exe

C:\WINDOWS\system32\drivers\down\43978812.exe

C:\WINDOWS\system32\drivers\down\43985593.exe

C:\WINDOWS\system32\drivers\down\43989312.exe

C:\WINDOWS\system32\drivers\down\43999062.exe

C:\WINDOWS\system32\drivers\down\44006390.exe

C:\WINDOWS\system32\drivers\down\44008421.exe

C:\WINDOWS\system32\drivers\down\44009093.exe

C:\WINDOWS\system32\drivers\down\44018421.exe

C:\WINDOWS\system32\drivers\down\44023046.exe

C:\WINDOWS\system32\drivers\down\44063953.exe

C:\WINDOWS\system32\drivers\down\441578.exe

C:\WINDOWS\system32\drivers\down\444656.exe

C:\WINDOWS\system32\drivers\down\451453.exe

C:\WINDOWS\system32\drivers\down\456140.exe

C:\WINDOWS\system32\drivers\down\456812.exe

C:\WINDOWS\system32\drivers\down\457375.exe

C:\WINDOWS\system32\drivers\down\458500.exe

C:\WINDOWS\system32\drivers\down\462359.exe

C:\WINDOWS\system32\drivers\down\465828.exe

C:\WINDOWS\system32\drivers\down\467765.exe

C:\WINDOWS\system32\drivers\down\484359.exe

C:\WINDOWS\system32\drivers\down\487062.exe

C:\WINDOWS\system32\drivers\down\502218.exe

C:\WINDOWS\system32\drivers\down\502828.exe

C:\WINDOWS\system32\drivers\down\514062.exe

C:\WINDOWS\system32\drivers\down\518625.exe

C:\WINDOWS\system32\drivers\down\532734.exe

C:\WINDOWS\system32\drivers\down\534828.exe

C:\WINDOWS\system32\drivers\down\542562.exe

C:\WINDOWS\system32\drivers\down\570000.exe

C:\WINDOWS\system32\drivers\down\579671.exe

C:\WINDOWS\system32\drivers\down\580734.exe

C:\WINDOWS\system32\drivers\down\582015.exe

C:\WINDOWS\system32\drivers\down\594578.exe

C:\WINDOWS\system32\drivers\down\598640.exe

C:\WINDOWS\system32\drivers\down\617937.exe

C:\WINDOWS\system32\drivers\down\623593.exe

C:\WINDOWS\system32\drivers\down\624609.exe

C:\WINDOWS\system32\drivers\down\649718.exe

C:\WINDOWS\system32\drivers\down\651375.exe

C:\WINDOWS\system32\drivers\down\662062.exe

C:\WINDOWS\system32\drivers\down\694906.exe

C:\WINDOWS\system32\drivers\down\709375.exe

C:\WINDOWS\system32\drivers\down\752062.exe

C:\WINDOWS\system32\drivers\down\759765.exe

C:\WINDOWS\system32\drivers\down\792062.exe

C:\WINDOWS\system32\drivers\down\795031.exe

C:\WINDOWS\system32\drivers\down\830859.exe

C:\WINDOWS\system32\drivers\down\883281.exe

C:\WINDOWS\system32\drivers\down\886453.exe

C:\WINDOWS\system32\drivers\down\906734.exe

C:\WINDOWS\system32\drivers\down\945421.exe

C:\WINDOWS\system32\drivers\down\946421.exe

C:\WINDOWS\system32\drivers\down\969906.exe

C:\WINDOWS\system32\drivers\hldrrr.exe

C:\WINDOWS\system32\drivers\srosa.sys

C:\WINDOWS\system32\mdelk.exe

C:\WINDOWS\system32\wintems.exe



.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))



.

-------\LEGACY_SROSA

-------\srosa





((((((((((((((((((((((((((((( Fichiers créés 2008-02-03 to 2008-03-03 ))))))))))))))))))))))))))))))))))))

.



2008-03-03 16:07 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe

2008-03-03 16:07 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx

2008-03-03 16:07 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr

2008-03-03 16:07 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys

2008-03-03 16:07 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys

2008-03-03 16:07 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys

2008-03-03 16:07 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys

2008-03-03 16:07 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys

2008-03-03 16:04 . 2008-03-03 16:04 <REP> d-------- C:\Program Files\Spybot - Search & Destroy

2008-03-03 15:32 . 2008-03-03 15:32 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab

2008-03-03 15:07 . 2008-03-03 15:07 <REP> d-------- C:\Muestras

2008-03-03 14:51 . 2008-03-03 14:53 <REP> d-------- C:\WINDOWS\BDOSCAN8

2008-03-03 14:18 . 2008-03-03 16:22 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft

2008-03-02 09:58 . 2008-03-02 09:59 <REP> d-------- C:\Program Files\Fichiers communs\COWON

2008-02-21 14:39 . 2008-02-21 14:39 <REP> d-------- C:\Program Files\KaraFun

2008-02-21 14:39 . 2008-02-21 14:39 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Recisio



.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-03-03 15:04 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

2008-03-02 08:59 --------- d-----w C:\Program Files\JetAudio

2008-03-02 08:59 --------- d-----w C:\Documents and Settings\Damien & Anabelle\Application Data\COWON

2008-03-02 08:58 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-02-13 16:17 360,416 ----a-w C:\Documents and Settings\Damien & Anabelle\Application Data\GDIPFONTCACHEV1.DAT

2008-01-29 10:20 --------- d-----w C:\Documents and Settings\Damien & Anabelle\Application Data\FileZilla

2008-01-29 09:38 --------- d-----w C:\Program Files\FileZilla FTP Client

2008-01-28 16:32 --------- d-----w C:\Documents and Settings\Damien & Anabelle\Application Data\OpenOffice.org2

2008-01-20 11:11 --------- d-----w C:\Program Files\GameShadow

2008-01-20 09:40 --------- d-----w C:\Program Files\Eidos

.



((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés



[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]

"ATI Launchpad"="C:\Program Files\ATI Multimedia\main\launchpd.exe" [2002-05-02 09:57 98304]

"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe" [ ]

"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25 1961984]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-03-03 16:53 1460560]



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2004-05-04 15:21 176128]

"HPHUPD05"="C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2004-04-01 11:33 49152]

"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]

"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2003-12-05 15:41 49152]

"HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2004-05-05 06:18 491520]

"C-Media Mixer"="Mixer.exe" [2002-03-25 15:02 1228800 C:\WINDOWS\mixer.exe]

"ATIPTA"="atiptaxx.exe" []

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]

"Norton Ghost 9.0"="C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe" [2004-08-02 17:36 1122304]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-26 15:31 282624]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-03 16:53 79224]



[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]



C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\

Utilitaire r‚seau pour SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe [2006-12-03 20:15:55 835584]



[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]

path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk

backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup



[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Pense-bête.lnk]

path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Pense-bête.lnk

backup=C:\WINDOWS\pss\Pense-bête.lnkCommon Startup



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]

--a------ 2006-11-12 11:48 157592 C:\Program Files\DAEMON Tools\daemon.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 2004-10-13 17:24 1694208 C:\Program Files\Messenger\msmsgs.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

--a------ 2007-01-19 11:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Omnipage]

C:\Program Files\ScanSoft\OmniPagePro11.0\opware32.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ORAHSSStartup]

--a------ 2007-01-04 10:40 462848 C:\Program Files\OrangeHSS\Launcher\Launcher.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orange Desktop Search]

C:\Program Files\Orange HSS\Orange Desktop Search\OrangeDesktopSearch.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2006-12-26 15:31 282624 C:\Program Files\QuickTime\qttask.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystrayORAHSS]

--a------ 2007-01-04 10:45 90112 C:\Program Files\OrangeHSS\Systray\SystrayApp.exe



[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\InstantTouch\\bin\\CmCenterV2.exe"=

"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"=

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"C:\\Program Files\\MSN Messenger\\livecall.exe"=

"F:\\jade2006\\jre\\bin\\java.exe"=

"D:\\emule\\emule.exe"=

"F:\\jade2007\\jre\\bin\\javaw.exe"=

"C:\\Program Files\\Internet Explorer\\iexplore.exe"=



R0 PQV2i;PQV2i;C:\WINDOWS\system32\drivers\PQV2i.sys [2004-08-02 17:04]

R1 PQIMount;PQIMount;C:\WINDOWS\system32\drivers\PQIMount.sys [2004-08-02 17:23]

R2 CINEMSUP;Software Cinemaster NT4.0 Driver;C:\WINDOWS\system32\DRIVERS\CINEMSUP.SYS [2002-01-08 10:16]

R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe [2001-08-23 17:47]

R2 TTDec;ATI WDM Teletext Decoder;C:\WINDOWS\system32\DRIVERS\ATINTTXX.sys [2002-05-30 20:48]

R3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys [2001-08-17 21:28]

R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-07-13 16:37]

S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []



.

**************************************************************************



catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-03-03 16:57:03

Windows 5.1.2600 Service Pack 2 NTFS



Balayage processus cachés ...



Balayage caché autostart entries ...



Balayage des fichiers cachés ...



Scan terminé avec succès

Les fichiers cachés: 0



**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\[u]0[/u]\FTRTSVC.exe

C:\WINDOWS\System32\GEARSec.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

C:\WINDOWS\system32\wdfmgr.exe

.

**************************************************************************

.

Temps d'accomplissement: 2008-03-03 16:59:08 - machine was rebooted

ComboFix-quarantined-files.txt 2008-03-03 15:59:05

.

2008-02-13 09:32:36 --- E O F ---



Ajout du 03-03-2008 à 17:03:

voici le rapport hijack



Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:03:15, on 03/03/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

C:\WINDOWS\System32\GEARSec.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

C:\WINDOWS\system32\pctspk.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe

C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Documents and Settings\Damien & Anabelle\Bureau\HiJackThis.exe



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"

O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe

O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll

O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll

O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab

O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/16.27/uploader2.cab

O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)



--

End of file - 8240 bytes





Que dois je faire maintenant??

passe SDFIx pour savoir comment faire regarde CECI

réinstalle ton antivirus

j'ai passé sdfix voici le rapport


SDFix: Version 1.151

Run by Damien

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-03 17:34:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:acd54eeb
"s2"=dword:9d73564c
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:7b,c7,bd,48,24,7b,db,0e,2c,78,70,3f,38,65,2a,70,64,07,0b,59,2c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,b2,82,4c,39,0b,59,ef,4b,06,d8,c6,95,b2,57,80,92,04,..
"khjeh"=hex:84,8e,6f,51,3f,4b,a7,4f,4d,97,dc,0f,a4,c3,d4,4a,72,65,3e,a9,f5,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:be,26,55,47,7f,a0,d7,2c,75,76,8c,8b,e7,09,dd,64,80,52,a7,25,6e,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:7b,c7,bd,48,24,7b,db,0e,2c,78,70,3f,38,65,2a,70,64,07,0b,59,2c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,b2,82,4c,39,0b,59,ef,4b,06,d8,c6,95,b2,57,80,92,04,..
"khjeh"=hex:84,8e,6f,51,3f,4b,a7,4f,4d,97,dc,0f,a4,c3,d4,4a,72,65,3e,a9,f5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:be,26,55,47,7f,a0,d7,2c,75,76,8c,8b,e7,09,dd,64,80,52,a7,25,6e,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000008d

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


Remaining Services :



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"="C:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe:*:Enabled:Nero ShowTime"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\InstantTouch\\bin\\CmCenterV2.exe"="C:\\Program Files\\InstantTouch\\bin\\CmCenterV2.exe:*:Enabled:CmCenter Module"
"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"="C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe:*:enabled:CSS"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"F:\\jade2006\\jre\\bin\\java.exe"="F:\\jade2006\\jre\\bin\\java.exe:*:Enabled:java"
"D:\\emule\\emule.exe"="D:\\emule\\emule.exe:*:Enabled:eMule"
"F:\\jade2007\\jre\\bin\\javaw.exe"="F:\\jade2007\\jre\\bin\\javaw.exe:*:Enabled:javaw"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files :



Files with Hidden Attributes :

Thu 8 Nov 2007 6,219,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Mon 11 Jun 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 28 Feb 2008 132 A..H. --- "C:\Program Files\ATI Multimedia\RemCtrl\x10prod.sys"
Fri 21 Dec 2007 52,224 ..SHR --- "C:\Program Files\ChessTrainer\ChessTrainer\Setup.exe"
Thu 24 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BITA.tmp"

Finished!

PAr contre mon antivirus avast est mal installé et je n'arive pas à le désinstaller à partir du panneau de configuration
est ce que si je relance l'installation puis réparer je ne vais rien réactiver de méchant
SInon puis je le supprimer à l'arrache! CTRl+SUppr