Trojan vbs et pages d'adresses ip qui s'ouvrent

Bonsoir

A chaque demarrage de mon ordinateur je vois afficher un message d'avast j'ai un trojan vbs et quand je veux supprimer il est introuvable pareil lorsque je me connecte sur internet des pages qui ont des adresses ip s'ouvrent tout seul. J'ai utilisé spybot search et destroy, avg antispyware et j'ai meme essayer de vider mes fichiers temporaires en mode sans echec rien a faire c'est toujours pareil. Pourriez vous m'aider svp.

Voici le rapport

Logfile of HijackThis v1.99.1
Scan saved at 21:48:16, on 23/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\IDA\ida.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\FRA\LOCALS~1\Temp\Rar$EX00.688\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/i [...] .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = SOS Connexion - Le web en toute simplicité
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\pvebcogu.dll",setvm
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - Unknown owner - C:\Program Files\Securitoo\av_fw\fswsclds.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\PROGRA~1\FICHIE~1\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

il m'ecrive 404 no found pour l'url

Je viens d'avoir un message d'avast un logiciel malveillant est present Win32: BHO-CK [Trj]

Voici le rapport

"C:\Program Files\install.log"
"C:\WINDOWS\system32\vbzip11.dll"
C:\WINDOWS\system32\pmkjh.dll
C:\WINDOWS\system32\abubxhxl.dll
C:\WINDOWS\system32\auvwslxx.dll
C:\WINDOWS\system32\enrshllb.dll
C:\WINDOWS\system32\frtsuwoj.dll
C:\WINDOWS\system32\iixvfrbd.dll
C:\WINDOWS\system32\jvxlxgnr.dll
C:\WINDOWS\system32\kqgsrlyj.dll
C:\WINDOWS\system32\mwxchrih.dll
C:\WINDOWS\system32\nfjrljxq.dll
C:\WINDOWS\system32\orftiwwk.dll
C:\WINDOWS\system32\qihccfqo.dll
C:\WINDOWS\system32\qxogciog.dll
C:\WINDOWS\system32\seswiqph.dll
C:\WINDOWS\system32\thbfldju.dll
C:\WINDOWS\system32\tnetjeks.dll
C:\WINDOWS\system32\ualwdegc.dll
C:\WINDOWS\system32\urjeolxx.dll
C:\WINDOWS\system32\vaurbhay.dll
C:\WINDOWS\system32\vsmmwccb.dll
C:\WINDOWS\system32\wwpcmxdb.dll
C:\WINDOWS\system32\xenuapuo.dll
C:\WINDOWS\system32\bkmgeaox.dll
C:\WINDOWS\system32\pfcutbui.dll
C:\WINDOWS\system32\qgwwsuvu.dll

mon ordinateur s'est rebooté tout seul et j'ai eu un nouveau rapport de Combofix
Voici le rapport de Combo fix

"FRA" - 07-04-23 22:03:22 Service Pack 2
ComboFix 07-04-22.6V - Running from: "C:\Program Files\Mozilla Firefox\"


(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\pmkjh.dll
C:\WINDOWS\system32\abubxhxl.dll
C:\WINDOWS\system32\auvwslxx.dll
C:\WINDOWS\system32\enrshllb.dll
C:\WINDOWS\system32\frtsuwoj.dll
C:\WINDOWS\system32\iixvfrbd.dll
C:\WINDOWS\system32\jvxlxgnr.dll
C:\WINDOWS\system32\kqgsrlyj.dll
C:\WINDOWS\system32\mwxchrih.dll
C:\WINDOWS\system32\nfjrljxq.dll
C:\WINDOWS\system32\orftiwwk.dll
C:\WINDOWS\system32\qihccfqo.dll
C:\WINDOWS\system32\qxogciog.dll
C:\WINDOWS\system32\seswiqph.dll
C:\WINDOWS\system32\thbfldju.dll
C:\WINDOWS\system32\tnetjeks.dll
C:\WINDOWS\system32\ualwdegc.dll
C:\WINDOWS\system32\urjeolxx.dll
C:\WINDOWS\system32\vaurbhay.dll
C:\WINDOWS\system32\vsmmwccb.dll
C:\WINDOWS\system32\wwpcmxdb.dll
C:\WINDOWS\system32\xenuapuo.dll
C:\WINDOWS\system32\bkmgeaox.dll
C:\WINDOWS\system32\pfcutbui.dll
C:\WINDOWS\system32\qgwwsuvu.dll
C:\WINDOWS\system32\sjccvnbc.dll
C:\WINDOWS\system32\sxlvljte.dll
C:\WINDOWS\system32\quhcpfhx.dll
C:\WINDOWS\system32\toptccky.dll
C:\WINDOWS\system32\hjkmp.ini
C:\WINDOWS\system32\hirhcxwm.ini
C:\WINDOWS\system32\sttss.bak1
C:\WINDOWS\system32\sttss.bak2
C:\WINDOWS\system32\sttss.ini
C:\WINDOWS\system32\sttss.ini2
C:\WINDOWS\system32\sttss.tmp
C:\WINDOWS\system32\sstts.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\install.log
C:\WINDOWS\system32\vbzip11.dll


((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\nm
-------\LEGACY_NM


((((((((((((((((((((((((((((((( Files Created from 2007-03-23 to 2007-04-23 ))))))))))))))))))))))))))))))))))


2007-04-18 00:28 54,663 --a------ C:\WINDOWS\War3Unin.dat
2007-04-18 00:28 2,829 --a------ C:\WINDOWS\War3Unin.pif
2007-04-18 00:28 139,264 --a------ C:\WINDOWS\War3Unin.exe
2007-04-17 23:58 <REP> d-------- C:\Program Files\Warkeys
2007-04-17 18:52 357 --a------ C:\DOCUME~1\FRA\.cb_layout.bin
2007-04-17 18:44 <REP> d-------- C:\DOCUME~1\FRA\.CodeBlocks
2007-04-16 02:51 <REP> d-------- C:\Program Files\PeerGuardian2
2007-04-11 04:33 35,300 --a------ C:\WINDOWS\DIIUnin.dat
2007-04-11 04:33 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-04-11 04:33 102,400 --a------ C:\WINDOWS\DIIUnin.exe
2007-04-11 04:14 <REP> d-------- C:\Program Files\Hero Editor
2007-04-09 14:04 <REP> d-------- C:\DOCUME~1\FRA\APPLIC~1\Dev-Cpp
2007-04-09 14:04 <REP> d-------- C:\Dev-Cpp
2007-04-09 00:13 <REP> d--h----- C:\WINDOWS\PIF
2007-04-07 19:40 4,503 --a------ C:\WINDOWS\system32\npoakfgx.dat
2007-04-07 19:40 324 --a------ C:\WINDOWS\system32\npoakfgx_navps.dat
2007-04-07 19:40 321,536 --a------ C:\WINDOWS\system32\npoakfgx.exe
2007-04-07 19:40 241,066 --a------ C:\WINDOWS\system32\npoakfgx_nav.dat
2007-04-02 22:08 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-04-02 22:05 <REP> d-------- C:\Program Files\Lavasoft
2007-03-29 04:21 <REP> d-------- C:\Program Files\CCleaner
2007-03-25 02:05 <REP> d-------- C:\Program Files\WC3Banlist
2007-03-24 16:32 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-03-24 16:32 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2007-03-24 16:32 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-03-24 16:32 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-03-24 16:32 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2007-03-24 16:32 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2007-03-24 16:32 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2007-03-24 16:15 40,960 -ra------ C:\WINDOWS\CleanDev.exe
2007-03-24 16:15 217,088 -ra------ C:\WINDOWS\select3a.exe
2007-03-24 16:15 127,692 -ra------ C:\WINDOWS\system32\drivers\pfc027.sys
2007-03-24 16:15 11,170 -ra------ C:\WINDOWS\system32\PA207Usd.dll
2007-03-24 16:15 <REP> d-------- C:\WINDOWS\PAC207
2007-03-24 16:14 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-03-24 16:05 <REP> d-------- C:\Program Files\directx
2007-03-24 16:05 <REP> d-------- C:\Program Files\CIF USB CAMERA
2007-03-23 14:55 <REP> d-------- C:\Program Files\Goto Software
2007-03-23 14:55 <REP> d-------- C:\DOCUME~1\FRA\APPLIC~1\VadeRetro
2007-03-23 14:55 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\VadeRetro
2007-03-23 13:07 87,608 --a------ C:\DOCUME~1\FRA\APPLIC~1\ezpinst.exe
2007-03-23 13:07 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-03-23 13:07 47,360 --a------ C:\DOCUME~1\FRA\APPLIC~1\pcouffin.sys
2007-03-23 13:07 <REP> d-------- C:\Program Files\vso
2007-03-23 13:07 <REP> d-------- C:\DOCUME~1\FRA\APPLIC~1\Vso


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-23 21:07 153925 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc.sys
2007-04-23 21:07 -------- d-------- C:\Program Files\lineage ii
2007-04-23 10:44 -------- d-------- C:\Program Files\emule
2007-04-22 19:16 -------- d-------- C:\Program Files\warcraft iii
2007-04-18 18:16 733824 --a------ C:\WINDOWS\system32\aswboot.exe
2007-04-18 18:12 94552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-04-18 18:12 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-04-18 18:10 23416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-04-18 18:09 43176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-04-18 18:07 26888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-04-18 18:06 90112 --a------ C:\WINDOWS\system32\avastss.scr
2007-04-13 21:31 -------- d-------- C:\Program Files\diablo ii
2007-04-13 21:29 43520 --a------ C:\WINDOWS\system32\cmdlineext03.dll
2007-04-11 05:25 73216 --a------ C:\WINDOWS\st6unst.exe
2007-04-11 05:25 249856 --------- C:\WINDOWS\setup1.exe
2007-04-11 05:13 21840 --a--c-t- C:\WINDOWS\system32\sintfnt.dll
2007-04-11 05:13 17212 --a--c-t- C:\WINDOWS\system32\sintf32.dll
2007-04-11 05:13 12067 --a--c-t- C:\WINDOWS\system32\sintf16.dll
2007-04-09 23:45 -------- d-------- C:\Program Files\paint.net
2007-04-09 16:43 -------- d-------- C:\Program Files\winpcap
2007-04-08 23:23 -------- d-------- C:\Program Files\elaborate bytes
2007-03-31 14:29 737280 --a--c--- C:\WINDOWS\iun6002.exe
2007-03-30 05:09 -------- d-------- C:\Program Files\raxco
2007-03-25 14:33 75696 --a--c--- C:\WINDOWS\system32\perfc00c.dat
2007-03-25 14:33 467620 --a--c--- C:\WINDOWS\system32\perfh00c.dat
2007-03-24 16:10 -------- d--h----- C:\Program Files\installshield installation information
2007-03-24 15:58 -------- d-------- C:\Program Files\ida
2007-03-23 13:07 34 --a------ C:\DOCUME~1\FRA\APPLIC~1\pcouffin.log
2007-03-23 13:07 1144 --a------ C:\DOCUME~1\FRA\APPLIC~1\pcouffin.inf
2007-03-23 13:07 1074 --a------ C:\DOCUME~1\FRA\APPLIC~1\pcouffin.cat
2007-03-17 15:44 293376 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-17 02:04 -------- d-------- C:\Program Files\yahoo!
2007-03-17 02:04 -------- d-------- C:\Program Files\common files
2007-03-17 01:41 -------- d-------- C:\Program Files\kalonlineeng
2007-03-13 00:15 -------- d-------- C:\Program Files\multi_media
2007-03-08 17:37 578560 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 17:37 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:37 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:33 1843712 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-05 00:00 -------- d-------- C:\DOCUME~1\FRA\APPLIC~1\installshield
2007-03-04 22:19 -------- d-------- C:\Program Files\winhex
2007-03-04 06:39 -------- d-------- C:\Program Files\lm studio
2007-03-03 18:43 -------- d-------- C:\Program Files\lords of everquest
2007-03-03 18:42 -------- d-------- C:\DOCUME~1\FRA\APPLIC~1\leadertech
2007-03-03 18:40 -------- d-------- C:\Program Files\dreamcatcher
2007-03-03 18:39 -------- d-------- C:\Program Files\gamenext
2007-03-03 18:10 -------- d-------- C:\DOCUME~1\FRA\APPLIC~1\nokia multimedia player
2007-03-03 18:02 -------- d-------- C:\DOCUME~1\FRA\APPLIC~1\nokia
2007-03-03 18:00 -------- d-------- C:\DOCUME~1\FRA\APPLIC~1\pc suite
2007-03-02 18:08 -------- d-------- C:\Program Files\msn messenger
2007-03-01 20:53 -------- d-------- C:\Program Files\logitech
2007-03-01 20:53 -------- d-------- C:\Program Files\Fichiers communs\logitech
2007-02-28 20:52 -------- d-------- C:\Program Files\mympxplayer.org
2007-02-25 16:37 -------- d-------- C:\DOCUME~1\FRA\APPLIC~1\internet download accelerator
2007-02-25 16:07 -------- d-------- C:\Program Files\reghealer
2007-02-23 19:12 -------- d-------- C:\Program Files\kaspersky lab
2007-02-05 22:19 185344 --a------ C:\WINDOWS\system32\upnphost.dll
2007-01-27 21:37 11949 --a--c--- C:\WINDOWS\mozver.dat
2007-01-25 19:31 88952 --a------ C:\WINDOWS\system32\packet.dll
2007-01-25 19:31 68480 --a------ C:\WINDOWS\system32\wanpacket.dll
2007-01-25 19:31 53299 --a------ C:\WINDOWS\system32\pthreadvc.dll
2007-01-25 19:31 240496 --a------ C:\WINDOWS\system32\wpcap.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
{1557B435-8242-4686-9AA3-9265BF7525A4} C:\WINDOWS\system32\gglybmcq.dll [x]
{53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
{812D17ED-E82A-43C8-B40B-BC231D37077b} C:\WINDOWS\system32\toptccky.dll [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"avast!"="\"C:\\Program Files\\Alwil Software\\Avast4\\ashDisp.exe\""
"TkBellExe"="\"C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe\" -osboot"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"FreeRAM XP"="\"C:\\Program Files\\YourWare Solutions\\FreeRAM XP Pro\\FreeRAM XP Pro.exe\" -win"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"=dword:00000001
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=dword:00000001
"NoSimpleStartMenu"=dword:00000000
"HideClock"=dword:00000000
"NoTrayItemsDisplay"=dword:00000000
"NoRecentDocsHistory"=dword:00000000
"ClearRecentDocsOnExit"=dword:00000000
"NoCDBurning"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnnomn

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Synchronizer.lnk]
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\Reader 8.0\\Reader\\AdobeCollabSync.exe "
"item"="Adobe Reader Synchronizer"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\Reader 8.0\\Reader\\reader_sl.exe "
"item"="Lancement rapide d'Adobe Reader"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^LE COMPAGNON CLUB.lnk]
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Club-Internet\\Le Compagnon Club\\bin\\matcli.exe -boot"
"item"="LE COMPAGNON CLUB"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^FRA^Menu Démarrer^Programmes^Démarrage^Club Internet.lnk]
"location"="Startup"
"item"="Club Internet"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^FRA^Menu Démarrer^Programmes^Démarrage^ProcessTamer.lnk]
"location"="Startup"
"item"="ProcessTamer"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgas"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bittorrent"
"hkey"="HKCU"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CFD"
"hkey"="HKLM"
"command"="C:\\Program Files\\BroadJump\\Client Foundation\\CFD.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ccleaner"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\CCleaner\\ccleaner.exe\" /AUTO"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ciné VIP Agent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DOWNLO~1"
"hkey"="HKCU"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DAP"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="fdm"
"hkey"="HKCU"
"command"="C:\\Program Files\\Free Download Manager\\fdm.exe -autorun"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeRAM XP]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="FreeRAM XP Pro"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\YourWare Solutions\\FreeRAM XP Pro\\FreeRAM XP Pro.exe\" -win"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Download Accelerator]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ida"
"hkey"="HKCU"
"command"="C:\\Program Files\\IDA\\ida.exe -autorun"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Logi_MwX"
"hkey"="HKLM"
"command"="Logi_MwX.Exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LyraHD2TrayApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LYRAHD2TrayApp"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mmtask"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mm_tray"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\npoakfgx]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="npoakfgx"
"hkey"="HKLM"
"command"="c:\\windows\\system32\\npoakfgx.exe npoakfgx"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PcSync2"
"hkey"="HKCU"
"command"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SamsungTrayApplication]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LaunchApplication"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Skype"
"hkey"="HKCU"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TeaTimer"
"hkey"="HKCU"
"command"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vade Retro Outlook Express]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Vaderetro_oe"
"hkey"="HKLM"
"command"="\"C:\\PROGRA~1\\Goto Software\\Vade Retro\\Vaderetro_oe.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vaderetro Outlook]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="VrMoRegister"
"hkey"="HKLM"
"command"="\"C:\\PROGRA~1\\Goto Software\\Vade Retro\\VrMoRegister.exe -s\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Registry Repair Pro]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RegistryRepairPro"
"hkey"="HKCU"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"OOD2000"=dword:00000002
"iPod Service"=dword:00000003
"Boonty Games"=dword:00000003
"SPTISRV"=dword:00000003
"WMPNetworkSvc"=dword:00000003
"ImapiService"=dword:00000003
"aawservice"=dword:00000002
"StyleXPService"=dword:00000002
"AVG Anti-Spyware Guard"=dword:00000002

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0



Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-23 22:16:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


********************************************************************

Completion time: 07-04-23 22:17:22 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 07-04-23 22:17

Bonjour,

Télécharge OTMoveIt (d'OldTimer).

Sauvegarde-le sur ton Bureau.

Sélectionne les fichiers/dossiers suivants :

C:\WINDOWS\system32\pmkjh.dll
C:\WINDOWS\system32\abubxhxl.dll
C:\WINDOWS\system32\auvwslxx.dll
C:\WINDOWS\system32\enrshllb.dll
C:\WINDOWS\system32\frtsuwoj.dll
C:\WINDOWS\system32\iixvfrbd.dll
C:\WINDOWS\system32\jvxlxgnr.dll
C:\WINDOWS\system32\kqgsrlyj.dll
C:\WINDOWS\system32\mwxchrih.dll
C:\WINDOWS\system32\nfjrljxq.dll
C:\WINDOWS\system32\orftiwwk.dll
C:\WINDOWS\system32\qihccfqo.dll
C:\WINDOWS\system32\qxogciog.dll
C:\WINDOWS\system32\seswiqph.dll
C:\WINDOWS\system32\thbfldju.dll
C:\WINDOWS\system32\tnetjeks.dll
C:\WINDOWS\system32\ualwdegc.dll
C:\WINDOWS\system32\urjeolxx.dll
C:\WINDOWS\system32\vaurbhay.dll
C:\WINDOWS\system32\vsmmwccb.dll
C:\WINDOWS\system32\wwpcmxdb.dll
C:\WINDOWS\system32\xenuapuo.dll
C:\WINDOWS\system32\bkmgeaox.dll
C:\WINDOWS\system32\pfcutbui.dll
C:\WINDOWS\system32\qgwwsuvu.dll
C:\WINDOWS\system32\sjccvnbc.dll
C:\WINDOWS\system32\sxlvljte.dll
C:\WINDOWS\system32\quhcpfhx.dll
C:\WINDOWS\system32\toptccky.dll
C:\WINDOWS\system32\hjkmp.ini
C:\WINDOWS\system32\hirhcxwm.ini
C:\WINDOWS\system32\sttss.bak1
C:\WINDOWS\system32\sttss.bak2
C:\WINDOWS\system32\sttss.ini
C:\WINDOWS\system32\sttss.ini2
C:\WINDOWS\system32\sttss.tmp
C:\WINDOWS\system32\sstts.dll

---> Clique-droit puis Copier

Double-clique sur OTMoveIt.exe afin de le lancer.
Fais un Clique-droit sur le cadre de gauche puis choisis Coller.

Clique maintenant sur MoveIt!

NOTE : Si un fichier ou dossier ne peut être supprimé immédiatement, le logiciel te demandera de redémarrer ton PC. Accepte en cliquant sur YES .

Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\

&

Reposte un nouveau rapport HijackThis

Bonsoir,

Relance Vundofix

- Ne clique pas sur Scan for a vundo"
- Clique droit au milieux de la fenêtre
- Clique sur Add more files ?
- Copie/colle les fichiers ci-dessous ( un par case) :

- Clique sur Add files
- Ensuite clique sur Close Windows
- Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
- Si l'outils demande un redémarrage, accepte
- Poste le rapport Vundofix, ainsi qu'un nouveau log HijackThis