Virus virtumonde [Résolu]

Salut,

Mon ordi est infecté par le virus virtumonde.Kaspersky n'arrive pas à le détecter.
Merci de bien vouloir m'aider.

Rapport Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 21:57:41, on 21/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\sgqabmpj.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Moi\Bureau\Film\Programmes Divers\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
R3 - URLSearchHook: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
O3 - Toolbar: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawfl [...] awflow.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/adva [...] module.exe
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - http://www.bobtv.fr/download/cfweb [...] module.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: CLKERN.DLL,
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\sgqabmpj.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Salut,

Il a du refaire un scan vundo à cause du fichier sqqabmpj.exe.Mais je ne crois pas qu'il l'ait suprimé.

Rapport Vundofix:

VundoFix V6.7.7

Checking Java version...

Java version is 1.4.2.5
Old versions of java are exploitable and should be removed.

Scan started at 22:48:18 21/12/2007

Listing files found while scanning....

C:\WINDOWS\system32\qrqss.ini
C:\WINDOWS\system32\qrqss.ini2
C:\WINDOWS\system32\sgqabmpj.exe
C:\WINDOWS\system32\ssqrq.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\qrqss.ini
C:\WINDOWS\system32\qrqss.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\qrqss.ini2
C:\WINDOWS\system32\qrqss.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\sgqabmpj.exe
C:\WINDOWS\system32\sgqabmpj.exe Could not be deleted.

Attempting to delete C:\WINDOWS\system32\ssqrq.dll
C:\WINDOWS\system32\ssqrq.dll Has been deleted!

Performing Repairs to the registry.
Done!

Rapport Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 13:28:28, on 22/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\sgqabmpj.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Documents and Settings\Moi\Bureau\Film\Programmes Divers\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
R3 - URLSearchHook: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1A6165C1-5435-427B-B6B9-5CF59D11A99F} - C:\WINDOWS\system32\ssqrq.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
O2 - BHO: (no name) - {FF64059D-4D2A-4D6B-AA0F-2EE4A2FE3856} - C:\WINDOWS\system32\urqqppn.dll (file missing)
O3 - Toolbar: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
O3 - Toolbar: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawfl [...] awflow.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/adva [...] module.exe
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - http://www.bobtv.fr/download/cfweb [...] module.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: CLKERN.DLL,
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: urqqppn - urqqppn.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\sgqabmpj.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

re,

Merci pour la rapidité de tes réponses.

Rapport Combofix:

ComboFix 07-12-21.4 - Moi 2007-12-22 13:59:26.1 - NTFSx86
Running from: C:\Documents and Settings\Moi\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Fichiers communs\Yazzle1281OinAdmin.exe
C:\Program Files\Fichiers communs\Yazzle1281OinUninstaller.exe
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\sgqabmpj.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-22 to 2007-12-22 ))))))))))))))))))))))))))))))))))))
.

2007-12-21 22:48 . 2007-12-22 13:18 <REP> d-------- C:\VundoFix Backups
2007-12-20 11:18 . 2007-12-20 11:18 990,033 ---hs---- C:\WINDOWS\system32\pqkgopqp.ini
2007-12-19 23:11 . 2007-12-21 17:02 143 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-12-18 17:57 . 2004-08-04 00:54 116,736 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2007-12-18 17:57 . 2001-08-23 17:47 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll
2007-12-18 17:57 . 2001-08-23 17:47 17,408 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll
2007-12-18 17:56 . 2001-08-23 17:47 99,865 --a--c--- C:\WINDOWS\system32\dllcache\xlog.exe
2007-12-18 17:56 . 2001-08-23 17:47 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe
2007-12-18 17:56 . 2004-08-03 22:29 19,455 --a--c--- C:\WINDOWS\system32\dllcache\wvchntxx.sys
2007-12-18 17:56 . 2001-08-17 20:11 16,970 --a--c--- C:\WINDOWS\system32\dllcache\xem336n5.sys
2007-12-18 17:56 . 2004-08-03 22:29 12,063 --a--c--- C:\WINDOWS\system32\dllcache\wsiintxx.sys
2007-12-18 17:56 . 2001-08-23 17:47 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe
2007-12-18 17:55 . 2001-08-17 21:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys
2007-12-18 17:55 . 2004-08-03 22:31 154,624 --a--c--- C:\WINDOWS\system32\dllcache\wlluc48.sys
2007-12-18 17:55 . 2001-08-23 17:05 35,402 --a--c--- C:\WINDOWS\system32\dllcache\wlandrv2.sys
2007-12-18 17:55 . 2004-08-03 23:07 8,832 --a--c--- C:\WINDOWS\system32\dllcache\wmiacpi.sys
2007-12-18 17:53 . 2001-08-17 21:28 604,253 --a--c--- C:\WINDOWS\system32\dllcache\vmodem.sys
2007-12-18 17:53 . 2001-08-17 21:28 397,502 --a--c--- C:\WINDOWS\system32\dllcache\vpctcom.sys
2007-12-18 17:53 . 2001-08-17 20:14 249,402 --a--c--- C:\WINDOWS\system32\dllcache\vinwm.sys
2007-12-18 17:53 . 2001-08-17 21:28 64,605 --a--c--- C:\WINDOWS\system32\dllcache\vvoice.sys
2007-12-18 17:53 . 2004-08-05 11:00 48,256 --a--c--- C:\WINDOWS\system32\dllcache\w32.dll
2007-12-18 17:53 . 2001-08-17 21:49 24,576 --a--c--- C:\WINDOWS\system32\dllcache\viairda.sys
2007-12-18 17:53 . 2001-08-17 20:13 19,528 --a--c--- C:\WINDOWS\system32\dllcache\w840nd.sys
2007-12-18 17:53 . 2001-08-17 20:13 19,016 --a--c--- C:\WINDOWS\system32\dllcache\w926nd.sys
2007-12-18 17:53 . 2001-08-17 20:13 16,925 --a--c--- C:\WINDOWS\system32\dllcache\w940nd.sys
2007-12-18 17:52 . 2001-08-17 21:28 765,884 --a--c--- C:\WINDOWS\system32\dllcache\usrti.sys
2007-12-18 17:52 . 2001-08-17 21:28 687,999 --a--c--- C:\WINDOWS\system32\dllcache\usrwdxjs.sys
2007-12-18 17:52 . 2001-08-17 21:28 224,802 --a--c--- C:\WINDOWS\system32\dllcache\usr1807a.sys
2007-12-18 17:52 . 2001-08-17 21:28 113,762 --a--c--- C:\WINDOWS\system32\dllcache\usrpda.sys
2007-12-18 17:52 . 2004-08-03 23:07 42,240 --a--c--- C:\WINDOWS\system32\dllcache\viaagp.sys
2007-12-18 17:52 . 2004-08-04 00:54 11,325 --a--c--- C:\WINDOWS\system32\dllcache\vchnt5.dll
2007-12-18 17:52 . 2001-08-17 21:28 7,556 --a--c--- C:\WINDOWS\system32\dllcache\usroslba.sys
2007-12-18 17:52 . 2004-08-03 22:59 5,376 --a--c--- C:\WINDOWS\system32\dllcache\viaide.sys
2007-12-18 17:51 . 2001-08-17 21:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2007-12-18 17:51 . 2001-08-17 21:28 794,399 --a--c--- C:\WINDOWS\system32\dllcache\usr1806v.sys
2007-12-18 17:51 . 2001-08-17 21:28 793,598 --a--c--- C:\WINDOWS\system32\dllcache\usr1806.sys
2007-12-18 17:51 . 2004-08-03 23:10 78,464 --a--c--- C:\WINDOWS\system32\dllcache\usbvideo.sys
2007-12-18 17:51 . 2004-08-04 00:43 32,384 --a--c--- C:\WINDOWS\system32\dllcache\usb101et.sys
2007-12-18 17:51 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-12-18 17:51 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2007-12-18 17:51 . 2004-08-03 23:08 20,480 --a--c--- C:\WINDOWS\system32\dllcache\usbuhci.sys
2007-12-18 17:51 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2007-12-18 17:51 . 2004-08-03 23:04 12,672 --a--c--- C:\WINDOWS\system32\dllcache\usb8023x.sys
2007-12-18 17:50 . 2001-08-23 17:47 94,720 --a--c--- C:\WINDOWS\system32\dllcache\umaxud32.dll
2007-12-18 17:50 . 2001-08-23 17:47 70,144 --a--c--- C:\WINDOWS\system32\dllcache\umaxu12.dll
2007-12-18 17:50 . 2001-08-23 17:47 50,688 --a--c--- C:\WINDOWS\system32\dllcache\umaxscan.dll
2007-12-18 17:50 . 2001-08-23 17:47 28,672 --a--c--- C:\WINDOWS\system32\dllcache\umaxu40.dll
2007-12-18 17:50 . 2001-08-23 17:47 27,136 --a--c--- C:\WINDOWS\system32\dllcache\umaxu22.dll
2007-12-18 17:49 . 2001-08-23 17:47 216,576 --a--c--- C:\WINDOWS\system32\dllcache\um34scan.dll
2007-12-18 17:49 . 2001-08-23 17:47 212,480 --a--c--- C:\WINDOWS\system32\dllcache\um54scan.dll
2007-12-18 17:49 . 2001-08-23 17:47 50,688 --a--c--- C:\WINDOWS\system32\dllcache\umaxp60.dll
2007-12-18 17:49 . 2001-08-23 17:47 47,616 --a--c--- C:\WINDOWS\system32\dllcache\umaxcam.dll
2007-12-18 17:49 . 2001-08-17 21:52 36,736 --a--c--- C:\WINDOWS\system32\dllcache\ultra.sys
2007-12-18 17:49 . 2001-08-17 21:58 22,912 --a--c--- C:\WINDOWS\system32\dllcache\umaxpcls.sys
2007-12-18 17:48 . 2001-08-23 17:47 525,568 --a--c--- C:\WINDOWS\system32\dllcache\tridxp.dll
2007-12-18 17:48 . 2001-08-17 20:51 166,784 --a--c--- C:\WINDOWS\system32\dllcache\tridxpm.sys
2007-12-18 17:48 . 2001-08-17 20:51 159,232 --a--c--- C:\WINDOWS\system32\dllcache\tridkbm.sys
2007-12-18 17:48 . 2004-08-03 23:07 44,672 --a--c--- C:\WINDOWS\system32\dllcache\uagp35.sys
2007-12-18 17:48 . 2004-08-05 11:00 14,336 --a--c--- C:\WINDOWS\system32\dllcache\tsprof.exe
2007-12-18 17:48 . 2001-08-17 21:48 11,520 --a--c--- C:\WINDOWS\system32\dllcache\twotrack.sys
2007-12-18 17:47 . 2001-08-23 17:46 440,576 --a--c--- C:\WINDOWS\system32\dllcache\tridkb.dll
2007-12-18 17:47 . 2001-08-23 17:46 315,520 --a--c--- C:\WINDOWS\system32\dllcache\trid3d.dll
2007-12-18 17:47 . 2001-08-17 20:51 222,336 --a--c--- C:\WINDOWS\system32\dllcache\trid3dm.sys
2007-12-18 17:47 . 2004-08-04 00:55 82,432 --a--c--- C:\WINDOWS\system32\dllcache\tp4mon.exe
2007-12-18 17:47 . 2001-08-23 17:46 43,520 --a--c--- C:\WINDOWS\system32\dllcache\tp4res.dll
2007-12-18 17:47 . 2001-08-17 20:12 34,375 --a--c--- C:\WINDOWS\system32\dllcache\tpro4.sys
2007-12-18 17:47 . 2001-08-23 17:47 31,744 --a--c--- C:\WINDOWS\system32\dllcache\tp4.dll
2007-12-18 17:46 . 2001-08-17 22:01 241,664 --a--c--- C:\WINDOWS\system32\dllcache\tosdvd02.sys
2007-12-18 17:46 . 2001-08-17 22:02 230,912 --a--c--- C:\WINDOWS\system32\dllcache\tosdvd03.sys
2007-12-18 17:46 . 2001-08-17 20:14 123,995 --a--c--- C:\WINDOWS\system32\dllcache\tjisdn.sys
2007-12-18 17:46 . 2001-08-17 20:10 28,232 --a--c--- C:\WINDOWS\system32\dllcache\tos4mo.sys
2007-12-18 17:46 . 2001-08-23 17:00 4,992 --a--c--- C:\WINDOWS\system32\dllcache\toside.sys
2007-12-18 17:45 . 2004-08-05 11:00 185,344 --a--c--- C:\WINDOWS\system32\dllcache\thawbrkr.dll
2007-12-18 17:45 . 2004-08-03 23:00 149,376 --a--c--- C:\WINDOWS\system32\dllcache\tffsport.sys
2007-12-18 17:45 . 2001-08-17 20:51 138,528 --a--c--- C:\WINDOWS\system32\dllcache\tgiulnt5.sys
2007-12-18 17:45 . 2001-08-23 17:46 81,408 --a--c--- C:\WINDOWS\system32\dllcache\tgiul50.dll
2007-12-18 17:45 . 2001-08-17 20:13 37,961 --a--c--- C:\WINDOWS\system32\dllcache\tdk100b.sys
2007-12-18 17:45 . 2004-08-05 11:00 21,896 --a--c--- C:\WINDOWS\system32\dllcache\tdipx.sys
2007-12-18 17:45 . 2004-08-05 11:00 19,464 --a--c--- C:\WINDOWS\system32\dllcache\tdspx.sys
2007-12-18 17:45 . 2001-08-17 20:13 17,129 --a--c--- C:\WINDOWS\system32\dllcache\tdkcd31.sys
2007-12-18 17:45 . 2004-08-05 11:00 13,192 --a--c--- C:\WINDOWS\system32\dllcache\tdasync.sys
2007-12-18 17:44 . 2001-08-23 17:46 172,768 --a--c--- C:\WINDOWS\system32\dllcache\t2r4disp.dll
2007-12-18 17:44 . 2001-08-17 20:50 36,640 --a--c--- C:\WINDOWS\system32\dllcache\t2r4mini.sys
2007-12-18 17:44 . 2001-08-17 22:07 32,640 --a--c--- C:\WINDOWS\system32\dllcache\symc8xx.sys
2007-12-18 17:44 . 2001-08-17 21:49 30,464 --a--c--- C:\WINDOWS\system32\dllcache\tbatm155.sys
2007-12-18 17:44 . 2001-08-17 21:52 7,040 --a--c--- C:\WINDOWS\system32\dllcache\tandqic.sys
2007-12-18 17:42 . 2001-08-23 16:57 286,848 --a--c--- C:\WINDOWS\system32\dllcache\stlnata.sys
2007-12-18 17:42 . 2004-08-05 11:00 101,888 --a--c--- C:\WINDOWS\system32\dllcache\srusbusd.dll
2007-12-18 17:42 . 2001-08-23 17:47 99,840 --a--c--- C:\WINDOWS\system32\dllcache\srusd.dll
2007-12-18 17:42 . 2001-08-23 17:47 53,248 --a--c--- C:\WINDOWS\system32\dllcache\stlncoin.dll
2007-12-18 17:42 . 2001-08-17 20:11 48,736 --a--c--- C:\WINDOWS\system32\dllcache\srwlnd5.sys
2007-12-18 17:42 . 2001-08-23 16:57 17,024 --a--c--- C:\WINDOWS\system32\dllcache\stcusb.sys
2007-12-18 17:41 . 2001-08-23 17:47 106,584 --a--c--- C:\WINDOWS\system32\dllcache\spdports.dll
2007-12-18 17:41 . 2001-08-17 21:51 61,824 --a--c--- C:\WINDOWS\system32\dllcache\speed.sys
2007-12-18 17:41 . 2001-08-23 17:47 24,660 --a--c--- C:\WINDOWS\system32\dllcache\spxupchk.dll
2007-12-18 17:41 . 2001-08-17 22:07 19,072 --a--c--- C:\WINDOWS\system32\dllcache\sparrow.sys
2007-12-18 17:41 . 2001-08-17 21:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys
2007-12-18 17:39 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys
2007-12-18 17:38 . 2001-08-23 17:47 238,592 --a--c--- C:\WINDOWS\system32\dllcache\sisgrv.dll
2007-12-18 17:38 . 2001-08-23 17:46 157,696 --a--c--- C:\WINDOWS\system32\dllcache\sisv256.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 13:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-22 13:10 20,579,360 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-22 13:08 690,720 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2007-12-22 13:08 65,804 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-12-22 13:08 276,668 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-20 18:15 91,492 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2007-12-12 21:38 85,860 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2007-12-01 16:50 --------- d-----w C:\Program Files\MSN Messenger
2007-11-15 23:09 --------- d-----w C:\Program Files\Dream Aquarium
2007-11-14 15:31 --------- d-----w C:\Program Files\Active WebCam
2007-11-14 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\PY_Software
2007-10-23 23:01 --------- d-----w C:\Program Files\eMule
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1A6165C1-5435-427B-B6B9-5CF59D11A99F}]
C:\WINDOWS\system32\ssqrq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 11:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 13:24 C:\WINDOWS\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-02-20 14:00 C:\WINDOWS\agrsmmsg.exe]
"TPSMain"="TPSMain.exe" [2004-08-12 11:13 C:\WINDOWS\system32\TPSMain.exe]
"NDSTray.exe"="NDSTray.exe" []
"TFncKy"="TFncKy.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-01-29 23:02]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 11:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoRun"= 0 (0x0)
"NoDesktop"= 0 (0x0)
"NoClose"= 0 (0x0)
"StartMenuLogOff"= 0 (0x0)
"HideClock"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqqppn]
urqqppn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-06-28 08:14 270648 --a------ C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN Webcam Recorder]
C:\Program Files\MSN Webcam Recorder\ml20gui.exe -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

R0 atiide;atiide;C:\WINDOWS\system32\DRIVERS\atiide.sys [2004-04-14 13:52]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 22:10]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-05 20:20:40 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 14:22:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-22 14:23:37 - machine was rebooted

Re,

Rapport Combofix:

ComboFix 07-12-21.4 - Moi 2007-12-22 14:48:26.2 - NTFSx86
Running from: C:\Documents and Settings\Moi\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Moi\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pqkgopqp.ini
C:\WINDOWS\system32\ssqrq.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pqkgopqp.ini

.
((((((((((((((((((((((((((((( Fichiers créés 2007-11-22 to 2007-12-22 ))))))))))))))))))))))))))))))))))))
.

2007-12-21 22:48 . 2007-12-22 13:18 <REP> d-------- C:\VundoFix Backups
2007-12-18 17:57 . 2004-08-04 00:54 116,736 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2007-12-18 17:57 . 2001-08-23 17:47 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll
2007-12-18 17:57 . 2001-08-23 17:47 17,408 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll
2007-12-18 17:56 . 2001-08-23 17:47 99,865 --a--c--- C:\WINDOWS\system32\dllcache\xlog.exe
2007-12-18 17:56 . 2001-08-23 17:47 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe
2007-12-18 17:56 . 2004-08-03 22:29 19,455 --a--c--- C:\WINDOWS\system32\dllcache\wvchntxx.sys
2007-12-18 17:56 . 2001-08-17 20:11 16,970 --a--c--- C:\WINDOWS\system32\dllcache\xem336n5.sys
2007-12-18 17:56 . 2004-08-03 22:29 12,063 --a--c--- C:\WINDOWS\system32\dllcache\wsiintxx.sys
2007-12-18 17:56 . 2001-08-23 17:47 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe
2007-12-18 17:55 . 2001-08-17 21:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys
2007-12-18 17:55 . 2004-08-03 22:31 154,624 --a--c--- C:\WINDOWS\system32\dllcache\wlluc48.sys
2007-12-18 17:55 . 2001-08-23 17:05 35,402 --a--c--- C:\WINDOWS\system32\dllcache\wlandrv2.sys
2007-12-18 17:55 . 2004-08-03 23:07 8,832 --a--c--- C:\WINDOWS\system32\dllcache\wmiacpi.sys
2007-12-18 17:53 . 2001-08-17 21:28 604,253 --a--c--- C:\WINDOWS\system32\dllcache\vmodem.sys
2007-12-18 17:53 . 2001-08-17 21:28 397,502 --a--c--- C:\WINDOWS\system32\dllcache\vpctcom.sys
2007-12-18 17:53 . 2001-08-17 20:14 249,402 --a--c--- C:\WINDOWS\system32\dllcache\vinwm.sys
2007-12-18 17:53 . 2001-08-17 21:28 64,605 --a--c--- C:\WINDOWS\system32\dllcache\vvoice.sys
2007-12-18 17:53 . 2004-08-05 11:00 48,256 --a--c--- C:\WINDOWS\system32\dllcache\w32.dll
2007-12-18 17:53 . 2001-08-17 21:49 24,576 --a--c--- C:\WINDOWS\system32\dllcache\viairda.sys
2007-12-18 17:53 . 2001-08-17 20:13 19,528 --a--c--- C:\WINDOWS\system32\dllcache\w840nd.sys
2007-12-18 17:53 . 2001-08-17 20:13 19,016 --a--c--- C:\WINDOWS\system32\dllcache\w926nd.sys
2007-12-18 17:53 . 2001-08-17 20:13 16,925 --a--c--- C:\WINDOWS\system32\dllcache\w940nd.sys
2007-12-18 17:52 . 2001-08-17 21:28 765,884 --a--c--- C:\WINDOWS\system32\dllcache\usrti.sys
2007-12-18 17:52 . 2001-08-17 21:28 687,999 --a--c--- C:\WINDOWS\system32\dllcache\usrwdxjs.sys
2007-12-18 17:52 . 2001-08-17 21:28 224,802 --a--c--- C:\WINDOWS\system32\dllcache\usr1807a.sys
2007-12-18 17:52 . 2001-08-17 21:28 113,762 --a--c--- C:\WINDOWS\system32\dllcache\usrpda.sys
2007-12-18 17:52 . 2004-08-03 23:07 42,240 --a--c--- C:\WINDOWS\system32\dllcache\viaagp.sys
2007-12-18 17:52 . 2004-08-04 00:54 11,325 --a--c--- C:\WINDOWS\system32\dllcache\vchnt5.dll
2007-12-18 17:52 . 2001-08-17 21:28 7,556 --a--c--- C:\WINDOWS\system32\dllcache\usroslba.sys
2007-12-18 17:52 . 2004-08-03 22:59 5,376 --a--c--- C:\WINDOWS\system32\dllcache\viaide.sys
2007-12-18 17:51 . 2001-08-17 21:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2007-12-18 17:51 . 2001-08-17 21:28 794,399 --a--c--- C:\WINDOWS\system32\dllcache\usr1806v.sys
2007-12-18 17:51 . 2001-08-17 21:28 793,598 --a--c--- C:\WINDOWS\system32\dllcache\usr1806.sys
2007-12-18 17:51 . 2004-08-03 23:10 78,464 --a--c--- C:\WINDOWS\system32\dllcache\usbvideo.sys
2007-12-18 17:51 . 2004-08-04 00:43 32,384 --a--c--- C:\WINDOWS\system32\dllcache\usb101et.sys
2007-12-18 17:51 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-12-18 17:51 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2007-12-18 17:51 . 2004-08-03 23:08 20,480 --a--c--- C:\WINDOWS\system32\dllcache\usbuhci.sys
2007-12-18 17:51 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2007-12-18 17:51 . 2004-08-03 23:04 12,672 --a--c--- C:\WINDOWS\system32\dllcache\usb8023x.sys
2007-12-18 17:50 . 2001-08-23 17:47 94,720 --a--c--- C:\WINDOWS\system32\dllcache\umaxud32.dll
2007-12-18 17:50 . 2001-08-23 17:47 70,144 --a--c--- C:\WINDOWS\system32\dllcache\umaxu12.dll
2007-12-18 17:50 . 2001-08-23 17:47 50,688 --a--c--- C:\WINDOWS\system32\dllcache\umaxscan.dll
2007-12-18 17:50 . 2001-08-23 17:47 28,672 --a--c--- C:\WINDOWS\system32\dllcache\umaxu40.dll
2007-12-18 17:50 . 2001-08-23 17:47 27,136 --a--c--- C:\WINDOWS\system32\dllcache\umaxu22.dll
2007-12-18 17:49 . 2001-08-23 17:47 216,576 --a--c--- C:\WINDOWS\system32\dllcache\um34scan.dll
2007-12-18 17:49 . 2001-08-23 17:47 212,480 --a--c--- C:\WINDOWS\system32\dllcache\um54scan.dll
2007-12-18 17:49 . 2001-08-23 17:47 50,688 --a--c--- C:\WINDOWS\system32\dllcache\umaxp60.dll
2007-12-18 17:49 . 2001-08-23 17:47 47,616 --a--c--- C:\WINDOWS\system32\dllcache\umaxcam.dll
2007-12-18 17:49 . 2001-08-17 21:52 36,736 --a--c--- C:\WINDOWS\system32\dllcache\ultra.sys
2007-12-18 17:49 . 2001-08-17 21:58 22,912 --a--c--- C:\WINDOWS\system32\dllcache\umaxpcls.sys
2007-12-18 17:48 . 2001-08-23 17:47 525,568 --a--c--- C:\WINDOWS\system32\dllcache\tridxp.dll
2007-12-18 17:48 . 2001-08-17 20:51 166,784 --a--c--- C:\WINDOWS\system32\dllcache\tridxpm.sys
2007-12-18 17:48 . 2001-08-17 20:51 159,232 --a--c--- C:\WINDOWS\system32\dllcache\tridkbm.sys
2007-12-18 17:48 . 2004-08-03 23:07 44,672 --a--c--- C:\WINDOWS\system32\dllcache\uagp35.sys
2007-12-18 17:48 . 2004-08-05 11:00 14,336 --a--c--- C:\WINDOWS\system32\dllcache\tsprof.exe
2007-12-18 17:48 . 2001-08-17 21:48 11,520 --a--c--- C:\WINDOWS\system32\dllcache\twotrack.sys
2007-12-18 17:47 . 2001-08-23 17:46 440,576 --a--c--- C:\WINDOWS\system32\dllcache\tridkb.dll
2007-12-18 17:47 . 2001-08-23 17:46 315,520 --a--c--- C:\WINDOWS\system32\dllcache\trid3d.dll
2007-12-18 17:47 . 2001-08-17 20:51 222,336 --a--c--- C:\WINDOWS\system32\dllcache\trid3dm.sys
2007-12-18 17:47 . 2004-08-04 00:55 82,432 --a--c--- C:\WINDOWS\system32\dllcache\tp4mon.exe
2007-12-18 17:47 . 2001-08-23 17:46 43,520 --a--c--- C:\WINDOWS\system32\dllcache\tp4res.dll
2007-12-18 17:47 . 2001-08-17 20:12 34,375 --a--c--- C:\WINDOWS\system32\dllcache\tpro4.sys
2007-12-18 17:47 . 2001-08-23 17:47 31,744 --a--c--- C:\WINDOWS\system32\dllcache\tp4.dll
2007-12-18 17:46 . 2001-08-17 22:01 241,664 --a--c--- C:\WINDOWS\system32\dllcache\tosdvd02.sys
2007-12-18 17:46 . 2001-08-17 22:02 230,912 --a--c--- C:\WINDOWS\system32\dllcache\tosdvd03.sys
2007-12-18 17:46 . 2001-08-17 20:14 123,995 --a--c--- C:\WINDOWS\system32\dllcache\tjisdn.sys
2007-12-18 17:46 . 2001-08-17 20:10 28,232 --a--c--- C:\WINDOWS\system32\dllcache\tos4mo.sys
2007-12-18 17:46 . 2001-08-23 17:00 4,992 --a--c--- C:\WINDOWS\system32\dllcache\toside.sys
2007-12-18 17:45 . 2004-08-05 11:00 185,344 --a--c--- C:\WINDOWS\system32\dllcache\thawbrkr.dll
2007-12-18 17:45 . 2004-08-03 23:00 149,376 --a--c--- C:\WINDOWS\system32\dllcache\tffsport.sys
2007-12-18 17:45 . 2001-08-17 20:51 138,528 --a--c--- C:\WINDOWS\system32\dllcache\tgiulnt5.sys
2007-12-18 17:45 . 2001-08-23 17:46 81,408 --a--c--- C:\WINDOWS\system32\dllcache\tgiul50.dll
2007-12-18 17:45 . 2001-08-17 20:13 37,961 --a--c--- C:\WINDOWS\system32\dllcache\tdk100b.sys
2007-12-18 17:45 . 2004-08-05 11:00 21,896 --a--c--- C:\WINDOWS\system32\dllcache\tdipx.sys
2007-12-18 17:45 . 2004-08-05 11:00 19,464 --a--c--- C:\WINDOWS\system32\dllcache\tdspx.sys
2007-12-18 17:45 . 2001-08-17 20:13 17,129 --a--c--- C:\WINDOWS\system32\dllcache\tdkcd31.sys
2007-12-18 17:45 . 2004-08-05 11:00 13,192 --a--c--- C:\WINDOWS\system32\dllcache\tdasync.sys
2007-12-18 17:44 . 2001-08-23 17:46 172,768 --a--c--- C:\WINDOWS\system32\dllcache\t2r4disp.dll
2007-12-18 17:44 . 2001-08-17 20:50 36,640 --a--c--- C:\WINDOWS\system32\dllcache\t2r4mini.sys
2007-12-18 17:44 . 2001-08-17 22:07 32,640 --a--c--- C:\WINDOWS\system32\dllcache\symc8xx.sys
2007-12-18 17:44 . 2001-08-17 21:49 30,464 --a--c--- C:\WINDOWS\system32\dllcache\tbatm155.sys
2007-12-18 17:44 . 2001-08-17 21:52 7,040 --a--c--- C:\WINDOWS\system32\dllcache\tandqic.sys
2007-12-18 17:42 . 2001-08-23 16:57 286,848 --a--c--- C:\WINDOWS\system32\dllcache\stlnata.sys
2007-12-18 17:42 . 2004-08-05 11:00 101,888 --a--c--- C:\WINDOWS\system32\dllcache\srusbusd.dll
2007-12-18 17:42 . 2001-08-23 17:47 99,840 --a--c--- C:\WINDOWS\system32\dllcache\srusd.dll
2007-12-18 17:42 . 2001-08-23 17:47 53,248 --a--c--- C:\WINDOWS\system32\dllcache\stlncoin.dll
2007-12-18 17:42 . 2001-08-17 20:11 48,736 --a--c--- C:\WINDOWS\system32\dllcache\srwlnd5.sys
2007-12-18 17:42 . 2001-08-23 16:57 17,024 --a--c--- C:\WINDOWS\system32\dllcache\stcusb.sys
2007-12-18 17:41 . 2001-08-23 17:47 106,584 --a--c--- C:\WINDOWS\system32\dllcache\spdports.dll
2007-12-18 17:41 . 2001-08-17 21:51 61,824 --a--c--- C:\WINDOWS\system32\dllcache\speed.sys
2007-12-18 17:41 . 2001-08-23 17:47 24,660 --a--c--- C:\WINDOWS\system32\dllcache\spxupchk.dll
2007-12-18 17:41 . 2001-08-17 22:07 19,072 --a--c--- C:\WINDOWS\system32\dllcache\sparrow.sys
2007-12-18 17:41 . 2001-08-17 21:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys
2007-12-18 17:39 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys
2007-12-18 17:38 . 2001-08-23 17:47 238,592 --a--c--- C:\WINDOWS\system32\dllcache\sisgrv.dll
2007-12-18 17:38 . 2001-08-23 17:46 157,696 --a--c--- C:\WINDOWS\system32\dllcache\sisv256.dll
2007-12-18 17:38 . 2001-08-17 20:50 104,064 --a--c--- C:\WINDOWS\system32\dllcache\sisgrp.sys
2007-12-18 17:38 . 2001-08-23 17:21 95,114 --a--c--- C:\WINDOWS\system32\dllcache\sk98xwin.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 13:55 692,000 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2007-12-22 13:54 20,602,656 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-22 13:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-22 13:08 65,804 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-12-22 13:08 276,668 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-20 18:15 91,492 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2007-12-12 21:38 85,860 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2007-12-01 16:50 --------- d-----w C:\Program Files\MSN Messenger
2007-11-15 23:09 --------- d-----w C:\Program Files\Dream Aquarium
2007-11-14 15:31 --------- d-----w C:\Program Files\Active WebCam
2007-11-14 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\PY_Software
2007-10-23 23:01 --------- d-----w C:\Program Files\eMule
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 335,872 2004-03-09 19:10:00 C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe

----a-w 256,576 2006-10-30 08:36:36 C:\Program Files\iTunes\bak\iTunesHelper.exe
----a-w 270,648 2007-06-28 07:14:42 C:\Program Files\iTunes\iTunesHelper.exe

----a-w 458,752 2005-06-08 14:24:32 C:\Program Files\Logitech\Video\bak\ISStart.exe

----a-w 217,088 2005-06-08 14:14:44 C:\Program Files\Logitech\Video\bak\LogiTray.exe

----a-w 196,608 2005-06-08 13:44:14 C:\Program Files\Logitech\Video\bak\ManifestEngine.exe

----a-w 282,624 2006-10-25 17:58:18 C:\Program Files\QuickTime\bak\qttask.exe
----a-w 282,624 2007-04-27 07:41:54 C:\Program Files\QuickTime\qttask.exe

----a-w 507,904 2004-04-22 14:23:18 C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe

----a-w 98,304 2004-04-22 14:23:44 C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe

----a-w 1,019,904 2004-02-12 09:43:56 C:\Program Files\Toshiba\PadTouch\bak\PadExe.exe

----a-w 430,080 2004-08-16 14:08:56 C:\Program Files\Toshiba\TOSHIBA Applet\bak\thotkey.exe

----a-w 118,784 2004-04-30 09:14:50 C:\Program Files\Toshiba\Utilitaire de zoom TOSHIBA\bak\SmoothView.exe

----a-w 15,360 2004-08-05 10:00:00 C:\WINDOWS\system32\bak\ctfmon.exe
----a-w 15,360 2004-08-05 10:00:00 C:\WINDOWS\system32\ctfmon.exe

----a-w 221,184 2005-07-19 16:32:18 C:\WINDOWS\system32\bak\LVCOMSX.EXE

----a-w 122,939 2004-07-20 00:04:00 C:\WINDOWS\system32\dla\bak\tfswctrl.exe

.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 11:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 13:24 C:\WINDOWS\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-02-20 14:00 C:\WINDOWS\agrsmmsg.exe]
"TPSMain"="TPSMain.exe" [2004-08-12 11:13 C:\WINDOWS\system32\TPSMain.exe]
"NDSTray.exe"="NDSTray.exe" []
"TFncKy"="TFncKy.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-01-29 23:02]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 11:00]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2007-01-27 16:23:07]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoRun"= 0 (0x0)
"NoDesktop"= 0 (0x0)
"NoClose"= 0 (0x0)
"StartMenuLogOff"= 0 (0x0)
"HideClock"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-06-28 08:14 270648 --a------ C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN Webcam Recorder]
C:\Program Files\MSN Webcam Recorder\ml20gui.exe -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

R0 atiide;atiide;C:\WINDOWS\system32\DRIVERS\atiide.sys [2004-04-14 13:52]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 22:10]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-12-05 20:20:40 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 14:56:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-22 15:00:24
C:\ComboFix2.txt ... 2007-12-22 14:23

Rapport Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 15:05:59, on 22/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Moi\Bureau\Film\Programmes Divers\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
R3 - URLSearchHook: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
O3 - Toolbar: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
O3 - Toolbar: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawfl [...] awflow.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/adva [...] module.exe
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - http://www.bobtv.fr/download/cfweb [...] module.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Re,

Je trouve pas SweetIM.J'avais l'impression de l'avoir supprimer mais là je le trouve pas.

J'ai chercher dans le panneau de configuration,j'ai fait une recherche mais je le trouve pas.

J'espere que tu voulais parler de la Multi Media toolbar.

Logfile of HijackThis v1.99.1
Scan saved at 21:51:00, on 22/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Moi\Bureau\Film\Programmes Divers\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawfl [...] awflow.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/adva [...] module.exe
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - http://www.bobtv.fr/download/cfweb [...] module.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Voila,c'est fait.

C'est fini?Mon PC est comme neuf?

Re,

Logfile of HijackThis v1.99.1
Scan saved at 12:47:08, on 23/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Moi\Bureau\Film\Programmes Divers\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawfl [...] awflow.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/adva [...] module.exe
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - http://www.bobtv.fr/download/cfweb [...] module.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

D'abord,merci pour ton aide rapide

Et puis,j'ai un petit problème avec mon lecteur DVD.Il arrive à lire les DVD mais pour ce qui est des DIVX ou des CD c'est autre chose!
Quand je lance un DVD rempli de DIVX,la petite led clignote mais l'icone passe de "lecteur DVD" à "lecteur CD".Quand je double clique dessus,il me marque:"erreur de périphériques entrée/sortie".
J'ai essayé avec un CD Boot et ca fonctionne aussi.
Penses tu que c'est un problème de lentille ou que ca peut venir d'un problème software ou même d'un virus?

Je sais pas si c'est le bon endroit pour poster ce genre de question,dsl.

Pour ton autre problème, voir dans la section Hardware.
Bonnes fêtes !

• Télécharge ToolsCleaner sur ton Bureau.
• Clique sur Recherche et laisse le scan se terminer.
• Clique sur Suppression pour finaliser.
• Clique sur Quitter, pour que le rapport puisse se créer.
• Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\)

Désactive puis réactive la restauration du système : Voir aide

Ajoute maintenant [Résolu] au titre. Pour cela :
* Clique, dans ton premier message, sur le bouton "Editer"
* Rajoute la mention [Résolu] au titre
* Clique ensuite sur "Valider votre message"

Lis le dossier dossier sur la prévention et la protection pour ne plus avoir ce genre de problème en cliquant sur l'image ci-dessous :

Oui, cela ne coûte rien

C'est terminé, passe un bon noël