Bonjour,

je pense avoir récupéré pas mal de choses pas très sympas ce qui fait que mon UC tourne au minimum à 50% avec Winlogon qui tourne et un antivirus qui se met en alerte toute les 20 min.
Voici le log, merci de votre aide.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:24:25, on 18/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\JMRaidTool.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
c:\progra~1\fichie~1\instal~1\update~1\isuspm.exe
C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\agent.exe
C:\Program Files\D-Tools\daemon.exe
c:\windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: Shell=c:\windows\explorer.exe
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [GBB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [DriveIcons] C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: gebayyw - C:\WINDOWS\
O20 - Winlogon Notify: vtsqr - C:\WINDOWS\
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - (no file)
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - g:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe

--
End of file - 9356 bytes

C'est de la rapidité cela merci .

Voici le premier rapport.
ComboFix 07-10-19.1 - Petisca 2007-10-19 23:54:59.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1345 [GMT 2:00]
Running from: C:\Documents and Settings\Petisca\Bureau\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Petisca\Application Data\install.dat
C:\Documents and Settings\Petisca\Application Data\install.dat
C:\Documents and Settings\Petisca\Application Data\microsoft\internet explorer\Desktop.htt
C:\Program Files\bravesentry
C:\Program Files\bravesentry\BraveSentry0.bs
C:\Program Files\bravesentry\BraveSentry1.bs
C:\WINDOWS\desktop.html
C:\WINDOWS\system32\cssrss.exe
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\vx.tll
C:\WINDOWS\system32\winsub.xml

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\Driver


((((((((((((((((((((((((((((( Fichiers créés 2007-09-19 to 2007-10-19 ))))))))))))))))))))))))))))))))))))
.

2007-10-18 23:47 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-18 23:06 <REP> d-------- C:\Program Files\Trend Micro
2007-10-18 22:35 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-10-18 19:21 <REP> d-------- C:\Program Files\Ubisoft
2007-10-17 22:52 83,456 --a------ C:\syskdar.exe
2007-10-14 13:57 0 --a------ C:\WINDOWS\ativpsrm.bin
2007-10-10 21:14 360 --a------ C:\WINDOWS\system32\drivers\atmapi.sys
2007-10-10 21:09 177,664 --a------ C:\WINDOWS\nview.dll
2007-10-10 21:09 81,920 --a------ C:\sysddiv.exe
2007-10-10 07:30 6,635 --a------ C:\WINDOWS\system32\atmlmbuz.dat
2007-10-10 07:30 5,645 --a------ C:\WINDOWS\system32\winrmrk.dat
2007-10-10 07:30 5,444 --a------ C:\WINDOWS\system32\mciwaxe.dat
2007-10-10 07:30 0 --a------ C:\WINDOWS\system32\batmcter.dat
2007-10-10 07:25 52,949 --a------ C:\WINDOWS\system32\dpuGdI11.dat
2007-10-10 07:25 9,857 --a------ C:\WINDOWS\system32\dsprpzes.dat
2007-10-10 07:25 7,144 --a------ C:\WINDOWS\system32\ATL7YJL.dat
2007-10-10 07:25 430 --a------ C:\WINDOWS\system32\wmvawvdy.dat
2007-10-10 07:25 0 --a------ C:\WINDOWS\system32\safrdku.dat
2007-09-29 15:48 <REP> d-------- C:\WINDOWS\system32\NtmsData
2007-09-29 05:21 9,854,976 --a------ C:\WINDOWS\system32\atioglx2.dll
2007-09-29 05:07 356,352 --a------ C:\WINDOWS\system32\ATIDEMGX.dll
2007-09-29 04:47 172,032 --a------ C:\WINDOWS\system32\atiok3x2.dll
2007-09-29 04:36 3,107,788 --a------ C:\WINDOWS\system32\ativva5x.dat
2007-09-29 04:36 972,072 --a------ C:\WINDOWS\system32\ativva6x.dat
2007-09-28 20:37 <REP> d-------- C:\Program Files\directx
2007-09-28 18:48 <REP> d-------- C:\Program Files\rFactor

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-19 21:58 --------- d-----w C:\Documents and Settings\Petisca\Application Data\Skype
2007-10-18 19:10 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-10-18 17:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-14 14:45 --------- d-----w C:\Program Files\Java
2007-10-14 08:19 --------- d-----w C:\Program Files\MSN Messenger
2007-10-10 19:09 578,048 ----a-w C:\WINDOWS\system32\user32.dll
2007-10-07 17:12 --------- d-----w C:\Documents and Settings\Petisca\Application Data\AdobeUM
2007-10-04 05:28 --------- d-----w C:\Program Files\DAP
2007-09-29 13:51 --------- d-----w C:\Program Files\MRConverter
2007-09-29 05:46 47,376 ----a-w C:\WINDOWS\system32\drivers\ativvpxx.vp
2007-09-29 03:06 268,800 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-09-29 03:05 2,456,064 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-09-29 02:58 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-09-29 02:58 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-09-29 02:58 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-09-29 02:58 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-09-29 02:57 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-09-29 02:56 483,328 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-09-29 02:55 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-09-29 02:49 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-09-29 02:47 3,130,720 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-09-29 02:36 1,593,600 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-09-29 02:23 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-09-29 02:22 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-09-29 02:20 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-09-29 02:19 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-09-29 02:14 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-09-28 19:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
2007-09-28 18:43 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-09-28 18:43 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-09-28 18:43 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-09-20 20:33 --------- d-----w C:\Program Files\DivX
2007-09-20 17:39 --------- d-----w C:\Documents and Settings\Petisca\Application Data\Canon
2007-09-19 19:48 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-09-17 19:21 --------- d-----w C:\Program Files\AGEIA Technologies
2007-09-17 19:20 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-09-17 19:12 --------- d-----w C:\Program Files\Reality Pump
2007-09-17 18:23 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-09-17 18:23 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-09-17 18:22 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-09-17 18:22 739,840 ----a-w C:\WINDOWS\system32\DivX.dll
2007-09-17 06:05 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
2007-09-17 06:05 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
2007-09-15 09:24 --------- d-----w C:\Program Files\Playlogic
2007-09-11 23:14 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-08 22:31 --------- d-----w C:\Documents and Settings\Petisca\Application Data\Apple Computer
2007-09-08 22:26 --------- d-----w C:\Program Files\iTunes
2007-09-08 22:26 --------- d-----w C:\Program Files\iPod
2007-09-02 08:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2007-08-26 07:52 821,536 ----a-w C:\WINDOWS\system32\drivers\avg7core.sys.~
2007-08-25 21:48 --------- d-----w C:\Program Files\D-Tools
2007-08-21 00:26 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-08-21 00:26 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-08-15 22:33 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-08-15 22:33 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-08-15 22:33 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-08-15 22:33 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-08-15 22:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-08-15 22:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-08-15 22:31 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-08-15 22:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-08-15 22:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-08-15 22:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-08-15 22:30 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-27 22:07 783,224 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-07-27 21:57 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-02-09 23:41 784 ------w C:\Documents and Settings\Petisca\Application Data\mpauth.dat
2007-03-08 11:23:57 501,541 --sh--w C:\WINDOWS\system32\rqstv.bak1
2007-03-09 11:24:13 528,813 --sh--w C:\WINDOWS\system32\rqstv.bak2
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 C:\WINDOWS\SkyTel.exe]
"GBB36X Configure"="C:\WINDOWS\system32\JMRaidTool.exe" [2006-07-12 11:58]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 10:56 C:\WINDOWS\RTHDCPL.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 22:05]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 12:54]
"HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe" [2003-04-01 17:41]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"DriveIcons"="C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe" [2006-03-16 22:07]
"Autoconfigurateur WiFi Neuf"="C:\Program Files\Neuf\Kit\WiFi\9wifi.exe" [2007-02-14 13:06]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-02-17 08:15]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-07 16:55]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:54]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 23:22]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 20:04]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2006-12-14 18:34]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-12-28 00:42]
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:07]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-03-30 13:34]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebayyw]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtsqr]

R0 Jgogo;JMicron Hot-Plug Driver;C:\WINDOWS\system32\drivers\Jgogo.sys
R0 jraid;jraid;C:\WINDOWS\system32\drivers\jraid.sys
R3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys
R3 PRISM_ICB;SMC2802W 2.4GHz 54Mbps Wireless PCI Card;C:\WINDOWS\system32\DRIVERS\smc2802w.sys
S3 GcKernel;Pilote de filtre Microsoft SideWinder Value Add;C:\WINDOWS\system32\DRIVERS\GcKernel.sys
S3 HIDSwvd;Minipilote de périphérique Microsoft SideWinder HID virtuel;C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
S3 pohci13F;pohci13F;\??\C:\DOCUME~1\Petisca\LOCALS~1\Temp\pohci13F.sys

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-10-13 17:29:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-19 23:57:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\0ÿ7ÿ0ÿ{6FC7EF43-9704-4DF4-9B09-E7C9C69015A0}ÿcguesmas@worldonline.frÿserviceclients@mypixmania.comÿcedricÿVIPix : Vous gagnez à être reconnuÿ1123258106ÿ1123256807ÿ16777216ÿ0ÿ3ÿ8890 0 bytes hidden from API
C:\WINDOWS\system32\0ÿ0ÿ0ÿ{3F2749C3-23B7-41C3-B043-5E2969E08ECF}ÿcguesmas@worldonline.frÿcommande@grosbill.comÿcedricÿGrosbill Micro : Commande 2286375 expédiée.ÿ1162818631ÿ1162818651ÿ16777216ÿ0ÿ3ÿ5305 0 bytes hidden from API

scan completed successfully
hidden files: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MarkFun_NT]
"ImagePath"="\??\C:\Program Files\Gigabyte\ET5\markfun.w32"
.
Completion time: 2007-10-19 23:58:58 - machine was rebooted
.
--- E O F ---

et le nouveau Hijack this

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:02:36, on 20/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\JMRaidTool.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: Shell=c:\windows\explorer.exe
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [GBB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [DriveIcons] C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: gebayyw - C:\WINDOWS\
O20 - Winlogon Notify: vtsqr - C:\WINDOWS\
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - (no file)
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - g:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe

--
End of file - 9004 bytes

Bonne lecture je n'y comprends rien pour ma part.

Voici le premier rapport.

ComboFix 07-10-19.1 - Petisca 2007-10-20 22:55:15.5 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1500 [GMT 2:00]
Running from: C:\Documents and Settings\Petisca\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Petisca\Bureau\CFScript.txt
* Created a new restore point

FILE::
C:\sysddiv.exe
C:\syskdar.exe
C:\WINDOWS\ativpsrm.bin
C:\WINDOWS\nview.dll
C:\WINDOWS\system32\ATL7YJL.dat
C:\WINDOWS\system32\atmlmbuz.dat
C:\WINDOWS\system32\batmcter.dat
C:\WINDOWS\system32\dpuGdI11.dat
C:\WINDOWS\system32\drivers\atmapi.sys
C:\WINDOWS\system32\dsprpzes.dat
C:\WINDOWS\system32\mciwaxe.dat
C:\WINDOWS\system32\rqstv.bak1
C:\WINDOWS\system32\rqstv.bak2
C:\WINDOWS\system32\safrdku.dat
C:\WINDOWS\system32\winrmrk.dat
C:\WINDOWS\system32\wmvawvdy.dat
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\sysddiv.exe
C:\syskdar.exe
C:\WINDOWS\ativpsrm.bin
C:\WINDOWS\nview.dll
C:\WINDOWS\nview.dll
C:\WINDOWS\system32\ATL7YJL.dat
C:\WINDOWS\system32\atmlmbuz.dat
C:\WINDOWS\system32\batmcter.dat
C:\WINDOWS\system32\dpuGdI11.dat
C:\WINDOWS\system32\drivers\atmapi.sys
C:\WINDOWS\system32\dsprpzes.dat
C:\WINDOWS\system32\mciwaxe.dat
C:\WINDOWS\system32\rqstv.bak1
C:\WINDOWS\system32\rqstv.bak2
C:\WINDOWS\system32\safrdku.dat
C:\WINDOWS\system32\winrmrk.dat
C:\WINDOWS\system32\wmvawvdy.dat

.
((((((((((((((((((((((((((((( Fichiers créés 2007-09-20 to 2007-10-20 ))))))))))))))))))))))))))))))))))))
.

2007-10-18 23:06 <REP> d-------- C:\Program Files\Trend Micro
2007-10-18 19:21 <REP> d-------- C:\Program Files\Ubisoft
2007-09-28 20:37 <REP> d-------- C:\Program Files\directx
2007-09-28 18:48 <REP> d-------- C:\Program Files\rFactor

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-20 20:57 --------- d-----w C:\Documents and Settings\Petisca\Application Data\Skype
2007-10-20 20:42 52,224 ----a-w C:\WINDOWS\cm.exe
2007-10-20 19:58 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-10-18 17:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-14 14:45 --------- d-----w C:\Program Files\Java
2007-10-14 08:19 --------- d-----w C:\Program Files\MSN Messenger
2007-10-10 19:09 578,048 ----a-w C:\WINDOWS\system32\user32.dll
2007-10-07 17:12 --------- d-----w C:\Documents and Settings\Petisca\Application Data\AdobeUM
2007-10-04 05:28 --------- d-----w C:\Program Files\DAP
2007-09-29 13:51 --------- d-----w C:\Program Files\MRConverter
2007-09-29 05:46 47,376 ----a-w C:\WINDOWS\system32\drivers\ativvpxx.vp
2007-09-29 03:21 9,854,976 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-09-29 03:07 356,352 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-09-29 03:06 268,800 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-09-29 03:05 2,456,064 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-09-29 02:58 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-09-29 02:58 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-09-29 02:58 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-09-29 02:58 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-09-29 02:57 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-09-29 02:56 483,328 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-09-29 02:55 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-09-29 02:49 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-09-29 02:47 3,130,720 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-09-29 02:47 172,032 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-09-29 02:36 1,593,600 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-09-29 02:23 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-09-29 02:22 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-09-29 02:20 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-09-29 02:19 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-09-29 02:14 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-09-28 19:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
2007-09-28 18:43 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-09-28 18:43 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-09-28 18:43 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-09-20 20:33 --------- d-----w C:\Program Files\DivX
2007-09-20 17:39 --------- d-----w C:\Documents and Settings\Petisca\Application Data\Canon
2007-09-19 19:48 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-09-17 19:21 --------- d-----w C:\Program Files\AGEIA Technologies
2007-09-17 19:20 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-09-17 19:12 --------- d-----w C:\Program Files\Reality Pump
2007-09-17 18:23 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-09-17 18:23 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-09-17 18:22 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-09-17 18:22 739,840 ----a-w C:\WINDOWS\system32\DivX.dll
2007-09-17 06:05 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
2007-09-17 06:05 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
2007-09-15 09:24 --------- d-----w C:\Program Files\Playlogic
2007-09-11 23:14 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-08 22:31 --------- d-----w C:\Documents and Settings\Petisca\Application Data\Apple Computer
2007-09-08 22:26 --------- d-----w C:\Program Files\iTunes
2007-09-08 22:26 --------- d-----w C:\Program Files\iPod
2007-09-02 08:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2007-08-26 07:52 821,536 ----a-w C:\WINDOWS\system32\drivers\avg7core.sys.~
2007-08-25 21:48 --------- d-----w C:\Program Files\D-Tools
2007-08-21 00:26 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-08-21 00:26 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-08-15 22:33 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-08-15 22:33 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-08-15 22:33 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-08-15 22:33 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-08-15 22:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-08-15 22:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-08-15 22:31 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-08-15 22:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-08-15 22:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-08-15 22:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-08-15 22:30 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-27 22:07 783,224 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-07-27 21:57 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-02-09 23:41 784 ------w C:\Documents and Settings\Petisca\Application Data\mpauth.dat
.

((((((((((((((((((((((((((((( snapshot@2007-10-19_23.58.22.35 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-16 05:29:00 70,940 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-10-20 06:03:55 70,940 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-10-16 05:29:00 84,000 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2007-10-20 06:03:55 84,000 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2007-10-16 05:29:00 421,934 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-10-20 06:03:55 421,934 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2007-10-16 05:29:00 489,076 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2007-10-20 06:03:55 489,076 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2007-10-20 20:57:09 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_18c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 C:\WINDOWS\SkyTel.exe]
"GBB36X Configure"="C:\WINDOWS\system32\JMRaidTool.exe" [2006-07-12 11:58]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 10:56 C:\WINDOWS\RTHDCPL.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 22:05]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 12:54]
"HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe" [2003-04-01 17:41]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"DriveIcons"="C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe" [2006-03-16 22:07]
"Autoconfigurateur WiFi Neuf"="C:\Program Files\Neuf\Kit\WiFi\9wifi.exe" [2007-02-14 13:06]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-02-17 08:15]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-07 16:55]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:54]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 23:22]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 20:04]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2006-12-14 18:34]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-12-28 00:42]
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:07]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-03-30 13:34]

R0 Jgogo;JMicron Hot-Plug Driver;C:\WINDOWS\system32\drivers\Jgogo.sys
R0 jraid;jraid;C:\WINDOWS\system32\drivers\jraid.sys
R3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys
R3 PRISM_ICB;SMC2802W 2.4GHz 54Mbps Wireless PCI Card;C:\WINDOWS\system32\DRIVERS\smc2802w.sys
S3 GcKernel;Pilote de filtre Microsoft SideWinder Value Add;C:\WINDOWS\system32\DRIVERS\GcKernel.sys
S3 HIDSwvd;Minipilote de périphérique Microsoft SideWinder HID virtuel;C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
S3 pohci13F;pohci13F;\??\C:\DOCUME~1\Petisca\LOCALS~1\Temp\pohci13F.sys

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-10-20 17:29:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-20 22:57:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\0ÿ7ÿ0ÿ{6FC7EF43-9704-4DF4-9B09-E7C9C69015A0}ÿcguesmas@worldonline.frÿserviceclients@mypixmania.comÿcedricÿVIPix : Vous gagnez à être reconnuÿ1123258106ÿ1123256807ÿ16777216ÿ0ÿ3ÿ8890 0 bytes hidden from API
C:\WINDOWS\system32\0ÿ0ÿ0ÿ{3F2749C3-23B7-41C3-B043-5E2969E08ECF}ÿcguesmas@worldonline.frÿcommande@grosbill.comÿcedricÿGrosbill Micro : Commande 2286375 expédiée.ÿ1162818631ÿ1162818651ÿ16777216ÿ0ÿ3ÿ5305 0 bytes hidden from API

scan completed successfully
hidden files: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MarkFun_NT]
"ImagePath"="\??\C:\Program Files\Gigabyte\ET5\markfun.w32"
.
Completion time: 2007-10-20 22:58:20 - machine was rebooted
C:\ComboFix2.txt ... 2007-10-19 23:58
.
--- E O F ---

Et le HIJACK THIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:01:05, on 20/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
c:\windows\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\JMRaidTool.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\DAP\DAP.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [GBB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [DriveIcons] C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - (no file)
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - g:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe

--
End of file - 8929 bytes

merci de t'occuper de ce soucis.

C:\WINDOWS\cm.exe moved successfully.
File/Folder C:\WINDOWS\system32\0ÿ7ÿ0ÿ not found.
File/Folder C:\WINDOWS\system32\0ÿ7ÿ0ÿ{6FC7EF43-9704-4DF4-9B09-E7C9C69015A0} not found.
File/Folder C:\WINDOWS\system32\0ÿ0ÿ0ÿ{3F2749C3-23B7-41C3-B043-5E2969E08ECF} not found.

Created on 10/20/2007 23:20:27

Voici le rapport

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Sunday, October 21, 2007 8:39:50 AM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 20/10/2007
Enregistrements dans la base antivirus Kaspersky : 441258
-------------------------------------------------------------------------------

Paramètres d'analyse:
Analyser avec la base antivirus suivante: étendue
Analyser les archives: vrai
Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\
M:\
N:\
O:\
P:\
Q:\

Statistiques de l'analyse:
Total d'objets analysés: 82416
Nombre de virus trouvés: 26
Nombre d'objets infectés: 97 / 0
Nombre d'objets suspects: 0
Durée de l'analyse: 02:31:48

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\Destinator6.1.1 Trafficsam.rar.bac_a03684/setup.exe Infecté : P2P-Worm.Win32.Kapucen.b ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\Destinator6.1.1 Trafficsam.rar.bac_a03684 RAR: infecté - 1 ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\Destinator6.1.1 Trafficsam.rar.bac_a03684 CryptFF.b: infecté - 1 ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a02512/{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}/Message Store/Attachments/edonkey0.52.exe/data0017/unknown2.bin Infecté : not-a-virus:AdWare.Win32.Ucmore.e ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a02512/{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}/Message Store/Attachments/edonkey0.52.exe/data0017/UCMTSAIE.DLL Infecté : not-a-virus:AdWare.Win32.Ucmore.d ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a02512/{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}/Message Store/Attachments/edonkey0.52.exe/data0017/IUCMORE.DLL Infecté : not-a-virus:AdWare.Win32.Ucmore ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a02512/{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}/Message Store/Attachments/edonkey0.52.exe/data0017 Infecté : not-a-virus:AdWare.Win32.Ucmore ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a02512/{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}/Message Store/Attachments/edonkey0.52.exe Infecté : not-a-virus:AdWare.Win32.Ucmore ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a02512 CAB: infecté - 5 ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a02512 CryptFF.b: infecté - 5 ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a03684/{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}/Message Store/Attachments/edonkey0.52.exe/data0017/unknown2.bin Infecté : not-a-virus:AdWare.Win32.Ucmore.e ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a03684/{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}/Message Store/Attachments/edonkey0.52.exe/data0017/UCMTSAIE.DLL Infecté : not-a-virus:AdWare.Win32.Ucmore.d ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a03684/{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}/Message Store/Attachments/edonkey0.52.exe/data0017/IUCMORE.DLL Infecté : not-a-virus:AdWare.Win32.Ucmore ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a03684/{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}/Message Store/Attachments/edonkey0.52.exe/data0017 Infecté : not-a-virus:AdWare.Win32.Ucmore ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a03684/{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}/Message Store/Attachments/edonkey0.52.exe Infecté : not-a-virus:AdWare.Win32.Ucmore ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a03684 CAB: infecté - 5 ignoré
C:\Documents and Settings\Petisca\.housecall6.6\Quarantine\IncrediMail Data.cab.bac_a03684 CryptFF.b: infecté - 5 ignoré
C:\Documents and Settings\Petisca\Application Data\$_hpcst$.hpc L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\Ahead\Nero Home\bl.db L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\Ahead\Nero Home\bl.db-journal L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\Ahead\Nero Home\is2.db L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\Ahead\Nero Home\is2.db-journal L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\IM\Identities\{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}\Message Store\Attachments\edonkey0.52.exe/data0017/unknown2.bin Infecté : not-a-virus:AdWare.Win32.Ucmore.e ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\IM\Identities\{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}\Message Store\Attachments\edonkey0.52.exe/data0017/UCMTSAIE.DLL Infecté : not-a-virus:AdWare.Win32.Ucmore.d ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\IM\Identities\{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}\Message Store\Attachments\edonkey0.52.exe/data0017/IUCMORE.DLL Infecté : not-a-virus:AdWare.Win32.Ucmore ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\IM\Identities\{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}\Message Store\Attachments\edonkey0.52.exe/data0017 Infecté : not-a-virus:AdWare.Win32.Ucmore ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\IM\Identities\{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}\Message Store\Attachments\edonkey0.52.exe NSIS: infecté - 4 ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Historique\History.IE5\MSHist012007102120071022\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Temp\Perflib_Perfdata_a6c.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Temp\WCESLog.log L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Temp\~DFBD06.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Mes documents\My Completed Downloads\stella.avi.dap L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\Mes documents\RevelationV2\SetupRevelationV2.exe/WISE0012.BIN Infecté : not-a-virusSWTool.Win32.SnadBoy.2011 ignoré
C:\Documents and Settings\Petisca\Mes documents\RevelationV2\SetupRevelationV2.exe/WISE0013.BIN Infecté : not-a-virusSWTool.Win32.SnadBoy.2011 ignoré
C:\Documents and Settings\Petisca\Mes documents\RevelationV2\SetupRevelationV2.exe WiseSFX: infecté - 2 ignoré
C:\Documents and Settings\Petisca\Mes documents\rip\edonkey0.52.exe/data0017/unknown2.bin Infecté : not-a-virus:AdWare.Win32.Ucmore.e ignoré
C:\Documents and Settings\Petisca\Mes documents\rip\edonkey0.52.exe/data0017/UCMTSAIE.DLL Infecté : not-a-virus:AdWare.Win32.Ucmore.d ignoré
C:\Documents and Settings\Petisca\Mes documents\rip\edonkey0.52.exe/data0017/IUCMORE.DLL Infecté : not-a-virus:AdWare.Win32.Ucmore ignoré
C:\Documents and Settings\Petisca\Mes documents\rip\edonkey0.52.exe/data0017 Infecté : not-a-virus:AdWare.Win32.Ucmore ignoré
C:\Documents and Settings\Petisca\Mes documents\rip\edonkey0.52.exe NSIS: infecté - 4 ignoré
C:\Documents and Settings\Petisca\Mes documents\rip\setup_nwmp.exe/data0003 Infecté : Trojan-Clicker.Win32.VB.da ignoré
C:\Documents and Settings\Petisca\Mes documents\rip\setup_nwmp.exe/data0005 Infecté : Trojan-Clicker.Win32.VB.da ignoré
C:\Documents and Settings\Petisca\Mes documents\rip\setup_nwmp.exe Inno: infecté - 2 ignoré
C:\Documents and Settings\Petisca\ntuser.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Petisca\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\report\Protection résidente.txt L'objet est verrouillé ignoré
C:\Program Files\DAP\Log\DAP_REPORT.LOG L'objet est verrouillé ignoré
C:\qoobox\Quarantine\C\sysddiv.exe.vir Infecté : Backdoor.Win32.Agent.ccz ignoré
C:\qoobox\Quarantine\C\syskdar.exe.vir Infecté : Backdoor.Win32.Agent.bza ignoré
C:\qoobox\Quarantine\C\WINDOWS\desktop.html.vir Infecté : not-virus:Hoax.Win32.Renos.cy ignoré
C:\qoobox\Quarantine\C\WINDOWS\system32\cssrss.exe.vir Infecté : Trojan-Downloader.Win32.Small.gby ignoré
C:\qoobox\Quarantine\catchme2007-10-20_225713.78.zip/nview.dll Infecté : Backdoor.Win32.Agent.ccy ignoré
C:\qoobox\Quarantine\catchme2007-10-20_225713.78.zip ZIP: infecté - 1 ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP318\A0084753.exe Infecté : Email-Worm.Win32.Nulprot.g ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084769.sys Infecté : Trojan.Win32.KillAV.lz ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084770.sys Infecté : Packed.Win32.Tibs.ap ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084771.exe Infecté : Trojan-Downloader.Win32.Small.fuq ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084772.exe Infecté : Trojan-Downloader.Win32.Small.cxx ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084775.dll Infecté : not-a-virus:FraudTool.Win32.BraveSentry.b ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084776.dll Infecté : not-a-virus:FraudTool.Win32.BraveSentry.b ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084777.dll Infecté : not-a-virus:FraudTool.Win32.BraveSentry.b ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084778.exe Infecté : not-a-virus:FraudTool.Win32.BraveSentry.b ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084779.sys Infecté : Trojan.Win32.Patched.aq ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084780.sys Infecté : Trojan.Win32.Patched.aq ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084781.sys Infecté : Trojan.Win32.KillAV.lz ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084782.exe Infecté : Email-Worm.Win32.Zhelatin.jw ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084785.exe Infecté : not-a-virusorn-Dialer.Win32.GBDialer.j ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084786.exe Infecté : Email-Worm.Win32.Zhelatin.jw ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084790.exe Infecté : Email-Worm.Win32.Zhelatin.jw ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084793.exe Infecté : Packed.Win32.Tibs.ca ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084794.exe Infecté : Email-Worm.Win32.Zhelatin.jw ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084795.exe Infecté : Trojan-Proxy.Win32.Xorpix.bt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084796.exe Infecté : Packed.Win32.Tibs.cb ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084797.exe Infecté : Packed.Win32.Tibs.cb ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084798.exe Infecté : Packed.Win32.Tibs.cb ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084799.exe Infecté : Packed.Win32.Tibs.cb ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084800.exe Infecté : Packed.Win32.Tibs.cb ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084801.exe Infecté : Packed.Win32.Tibs.cb ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084803.exe Infecté : Email-Worm.Win32.Zhelatin.jw ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP319\A0084804.exe Infecté : Email-Worm.Win32.Zhelatin.jw ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP332\A0090264.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP332\A0091253.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP333\A0091294.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP333\A0092293.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP334\A0092305.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP334\A0093290.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP334\A0094293.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP335\A0094316.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP335\A0095296.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP335\A0096293.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP335\A0098299.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP335\A0098453.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP336\A0098485.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP336\A0099431.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP337\A0099446.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP338\A0099463.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP339\A0099489.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP340\A0099527.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP340\A0100423.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP342\A0100777.exe Infecté : Trojan-Downloader.Win32.Small.gby ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP343\A0100840.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP345\A0101844.exe Infecté : Backdoor.Win32.Agent.ccz ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP345\A0101845.exe Infecté : Backdoor.Win32.Agent.bza ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP345\A0101907.exe Infecté : Backdoor.Win32.Agent.bxt ignoré
C:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP346\change.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\Help\access.cni Infecté : Backdoor.Win32.Agent.ccy ignoré
C:\WINDOWS\Help\mwrem.cin Infecté : Backdoor.Win32.Agent.bxs ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\adsnisxi.dat L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\ODiag.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\OSession.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\dllcache\user32.dll Infecté : Trojan.Win32.Patched.bb ignoré
C:\WINDOWS\system32\drivers\sptd.sys L'objet est verrouillé ignoré
C:\WINDOWS\system32\imgutulh.dat L'objet est verrouillé ignoré
C:\WINDOWS\system32\jxyewhy Infecté : Trojan.Win32.Patched.bb ignoré
C:\WINDOWS\system32\mcybbtk Infecté : Trojan.Win32.Patched.bb ignoré
C:\WINDOWS\system32\mdwmvmsp.dat L'objet est verrouillé ignoré
C:\WINDOWS\system32\ohzmolm Infecté : Trojan.Win32.Patched.bb ignoré
C:\WINDOWS\system32\pdhrkk.dat L'objet est verrouillé ignoré
C:\WINDOWS\system32\user32.dll Infecté : Trojan.Win32.Patched.bb ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\Temp\Perflib_Perfdata_18c.dat L'objet est verrouillé ignoré
C:\WINDOWS\Temp\_avast4_\Webshlock.txt L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré
E:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
E:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP346\change.log L'objet est verrouillé ignoré
F:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
F:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP346\change.log L'objet est verrouillé ignoré
G:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
G:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP346\change.log L'objet est verrouillé ignoré
H:\Program Files\eMule\Temp\001.part L'objet est verrouillé ignoré
H:\Program Files\eMule\Temp\002.part L'objet est verrouillé ignoré
H:\Program Files\eMule\Temp\005.part L'objet est verrouillé ignoré
H:\Program Files\eMule\Temp\006.part L'objet est verrouillé ignoré
H:\Program Files\eMule\Temp\008.part L'objet est verrouillé ignoré
H:\Program Files\eMule\Temp\010.part L'objet est verrouillé ignoré
H:\Program Files\eMule\Temp\014.part L'objet est verrouillé ignoré
H:\Program Files\eMule\Temp\016.part L'objet est verrouillé ignoré
H:\Program Files\eMule\Temp\017.part L'objet est verrouillé ignoré
H:\Program Files\eMule\Temp\018.part L'objet est verrouillé ignoré
H:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
H:\System Volume Information\_restore{F11704DA-1449-4199-B539-5840FD2F7C34}\RP346\change.log L'objet est verrouillé ignoré


Voici le rapport de Kaspersky.

Bonjour,

Allez on continue, voici les 2 rapports.

C:\Documents and Settings\Petisca\.housecall6.6\Quarantine moved successfully.
C:\Documents and Settings\Petisca\Local Settings\Application Data\IM\Identities\{03C3F0F5-B2FA-4F01-8E45-7593A7F79860}\Message Store\Attachments\edonkey0.52.exe moved successfully.
C:\Documents and Settings\Petisca\Mes documents\RevelationV2\SetupRevelationV2.exe moved successfully.
C:\Documents and Settings\Petisca\Mes documents\rip\edonkey0.52.exe moved successfully.
C:\Documents and Settings\Petisca\Mes documents\rip\setup_nwmp.exe moved successfully.
C:\qoobox\Quarantine\Registry_backups moved successfully.
C:\qoobox\Quarantine\C\WINDOWS\system32\drivers moved successfully.
C:\qoobox\Quarantine\C\WINDOWS\system32 moved successfully.
C:\qoobox\Quarantine\C\WINDOWS moved successfully.
C:\qoobox\Quarantine\C\Program Files\BraveSentry moved successfully.
C:\qoobox\Quarantine\C\Program Files moved successfully.
C:\qoobox\Quarantine\C\Documents and Settings\Petisca\Application Data\Microsoft\Internet Explorer moved successfully.
C:\qoobox\Quarantine\C\Documents and Settings\Petisca\Application Data\Microsoft moved successfully.
C:\qoobox\Quarantine\C\Documents and Settings\Petisca\Application Data moved successfully.
C:\qoobox\Quarantine\C\Documents and Settings\Petisca moved successfully.
C:\qoobox\Quarantine\C\Documents and Settings moved successfully.
C:\qoobox\Quarantine\C moved successfully.
C:\qoobox\Quarantine moved successfully.
C:\qoobox\Hiv-backup\Users\00000006 moved successfully.
C:\qoobox\Hiv-backup\Users\00000005 moved successfully.
C:\qoobox\Hiv-backup\Users\00000004 moved successfully.
C:\qoobox\Hiv-backup\Users\00000003 moved successfully.
C:\qoobox\Hiv-backup\Users\00000002 moved successfully.
C:\qoobox\Hiv-backup\Users\00000001 moved successfully.
C:\qoobox\Hiv-backup\Users moved successfully.
Folder move failed. C:\qoobox\Hiv-backup\system scheduled to be moved on reboot.
Folder move failed. C:\qoobox\Hiv-backup\software scheduled to be moved on reboot.
Folder move failed. C:\qoobox\Hiv-backup\SECURITY scheduled to be moved on reboot.
Folder move failed. C:\qoobox\Hiv-backup\SAM scheduled to be moved on reboot.
Folder move failed. C:\qoobox\Hiv-backup\default scheduled to be moved on reboot.
C:\qoobox\Hiv-backup moved successfully.
C:\qoobox\BackEnv moved successfully.
C:\qoobox moved successfully.
C:\WINDOWS\Help\access.cni moved successfully.
C:\WINDOWS\Help\mwrem.cin moved successfully.
C:\WINDOWS\system32\imgutulh.dat moved successfully.
C:\WINDOWS\system32\jxyewhy moved successfully.
C:\WINDOWS\system32\mcybbtk moved successfully.
C:\WINDOWS\system32\mdwmvmsp.dat moved successfully.
File/Folder C:\WINDOWS\system32\ohzmolm I not found.
C:\WINDOWS\system32\pdhrkk.dat moved successfully.

Created on 10/21/2007 12:44:58
et le second

"C:\WINDOWS\system32\user32.dll" 578048 10/10/2007 21:09
"C:\WINDOWS\system32\dllcache\user32.dll" 578048 10/10/2007 21:09

J'en ai 1 mais je ne garantie pas sa provenance...

Bonjour,

la manip est effectuée.

Fichier user32.dll reçu le 2007.10.21 16:04:35 (CET)

Résultat: 2/32 (6.25%)

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.10.20.0 2007.10.19
AntiVir 7.6.0.27 2007.10.20 -
Authentium 4.93.8 2007.10.20 -
Avast 4.7.1051.0 2007.10.21 -
AVG 7.5.0.488 2007.10.20 -
BitDefender 7.2 2007.10.21 -
CAT-QuickHeal 9.00 2007.10.20 -
ClamAV 0.91.2 2007.10.20 -
DrWeb 4.44.0.09170 2007.10.21 -
eSafe 7.0.15.0 2007.10.15 -
eTrust-Vet 31.2.5225 2007.10.20 -
Ewido 4.0 2007.10.21 -
FileAdvisor 1 2007.10.21 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.3.2.48 2007.10.20 -
F-Secure 6.70.13030.0 2007.10.21 Trojan.Win32.Patched.bb
Ikarus T3.1.1.12 2007.10.21 -
Kaspersky 7.0.0.125 2007.10.21 Trojan.Win32.Patched.bb
McAfee 5145 2007.10.19 -
Microsoft 1.2908 2007.10.21 -
NOD32v2 2604 2007.10.19 -
Norman 5.80.02 2007.10.19 -
Panda 9.0.0.4 2007.10.21 -
Prevx1 V2 2007.10.21 -
Rising 19.45.62.00 2007.10.21 -
Sophos 4.22.0 2007.10.21 -
Sunbelt 2.2.907.0 2007.10.20 -
Symantec 10 2007.10.21 -
TheHacker 6.2.9.103 2007.10.21 -
VBA32 3.12.2.4 2007.10.19 -
VirusBuster 4.3.26:9 2007.10.21 -
Webwasher-Gateway 6.6.1 2007.10.20 -
Information additionnelle
File size: 578048 bytes
MD5: 4004dae1c2d93ed314c296d28ef257f6
SHA1: 33194a8e116d83f4b9122eac769c428741c048b0

Et voila la rapport

PAs de soucis je peux en avoir 1 aussi.

ntivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.10.20.0 2007.10.19 -
AntiVir 7.6.0.27 2007.10.21 -
Authentium 4.93.8 2007.10.20 -
Avast 4.7.1051.0 2007.10.21 -
AVG 7.5.0.488 2007.10.21 -
BitDefender 7.2 2007.10.21 -
CAT-QuickHeal 9.00 2007.10.20 -
ClamAV 0.91.2 2007.10.21 -
DrWeb 4.44.0.09170 2007.10.21 -
eSafe 7.0.15.0 2007.10.15 -
eTrust-Vet 31.2.5225 2007.10.20 -
Ewido 4.0 2007.10.21 -
FileAdvisor 1 2007.10.21 No threat detected, but known vulnerabilities exist
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.3.2.48 2007.10.20 -
F-Secure 6.70.13030.0 2007.10.21 -
Ikarus T3.1.1.12 2007.10.21 -
Kaspersky 7.0.0.125 2007.10.21 -
McAfee 5145 2007.10.19 -
Microsoft 1.2908 2007.10.21 -
NOD32v2 2604 2007.10.19 -
Norman 5.80.02 2007.10.19 -
Panda 9.0.0.4 2007.10.21 -
Prevx1 V2 2007.10.21 -
Rising 19.45.62.00 2007.10.21 -
Sophos 4.22.0 2007.10.21 -
Sunbelt 2.2.907.0 2007.10.20 -
Symantec 10 2007.10.21 -
TheHacker 6.2.9.103 2007.10.21 -
VBA32 3.12.2.4 2007.10.19 -
VirusBuster 4.3.26:9 2007.10.21 -
Webwasher-Gateway 6.6.1 2007.10.21 -

C'est avec le CD,j'ai extrait le dll sur C:
Je me demande si j'ai pas raté la décompression du fichier sur le CD la première fois?

Bref,j'ai déplacé le Dll dans system32, il l'a bien remplacé mais je ne sais pas si c'est ce qu'il fallait faire.

en tout cas un grand merci pour ton aide et ta rapidité, le Pc lag déjà moins et il ne se coupe plus quand ma fille joue à adibou.

Je vais attendre une semaine et si cela passe bien je ferais la copie de ce fichier.