Lenteur anormale Résolu

Bonjour et Bonne Année 2008,
J'ai un petit soucis de lenteur depuis qq jours avec mon PC ! L'internet et lent et même parfois les applications se bloquent.

Voilà mon rapport log.
MErci de l'aide par avance.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:44:14, on 03/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\vphc600.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\lclock.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\Microsoft ActiveSync\rapimgr.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\Philips\SPC 600NC PC Camera\TrayMin.exe
C:\Program Files\SpamPal\spampal.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Bernardo\Bureau\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {818EC18F-5774-4DF2-A384-E0AA650CEC05} - C:\WINDOWS\system32\cfgmgr3.dll
O2 - BHO: (no name) - {B9E85D85-F6EE-4655-A639-E33983612A6E} - C:\WINDOWS\system32\pmnnllk.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {F457A3ED-47D8-4162-BFBD-48C0F493B2F7} - C:\WINDOWS\system32\ssqpn.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX700 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE /P31 "EPSON Stylus Photo RX700 Series" /O6 "USB001" /M "Stylus Photo RX700"
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [phc600] C:\WINDOWS\vphc600.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office2000\Office\OSA9.EXE
O4 - Global Startup: TrayMin.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wi [...] 9045558125
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.fotocompil.com/panierph [...] oader4.cab
O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - E:\Player\__CDS2.dll (file missing)
O20 - Winlogon Notify: pmnnllk - C:\WINDOWS\SYSTEM32\pmnnllk.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32\netdde.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--
End of file - 9606 bytes

Voila les rapports


VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 17:19:17 03/01/2008

Listing files found while scanning....

No infected files were found.


VundoFix V6.7.7

Checking Java version...

Sun Java not detected
Scan started at 21:49:15 05/01/2008

Listing files found while scanning....

C:\windows\system32\nnnlklm.dll
C:\WINDOWS\system32\npqss.ini
C:\WINDOWS\system32\npqss.ini2
C:\windows\system32\pmnnllk.dll
C:\WINDOWS\system32\ssqpn.dll
C:\WINDOWS\system32\winjyg32.dll

Beginning removal...

Attempting to delete C:\windows\system32\nnnlklm.dll
C:\windows\system32\nnnlklm.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\npqss.ini
C:\WINDOWS\system32\npqss.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\npqss.ini2
C:\WINDOWS\system32\npqss.ini2 Has been deleted!

Attempting to delete C:\windows\system32\pmnnllk.dll
C:\windows\system32\pmnnllk.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\ssqpn.dll
C:\WINDOWS\system32\ssqpn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\winjyg32.dll
C:\WINDOWS\system32\winjyg32.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\windows\system32\pmnnllk.dll
C:\windows\system32\pmnnllk.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...


ComboFix 08-01-04.1 - Bernardo 2008-01-05 22:12:00.5 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.615 [GMT 1:00]
Running from: C:\Documents and Settings\Bernardo\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\cfgmgr3.1
C:\WINDOWS\system32\cfgmgr3.dll . . . . Echec de suppression

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-05 to 2008-01-05 ))))))))))))))))))))))))))))))))))))
.

2008-01-05 22:19 . 2008-01-05 22:19 <REP> d--hs---- C:\WINDOWS\system32\dllcache
2008-01-03 22:39 . 2008-01-03 22:39 <REP> d-------- C:\Documents and Settings\Bernardo\Application Data\Leadertech
2007-12-31 17:00 . 2008-01-02 19:29 225 --a------ C:\WINDOWS\wininit.ini
2007-12-30 21:21 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-12-30 21:14 . 2007-12-30 21:19 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-12-30 21:14 . 2007-12-30 21:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-30 21:13 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-12-30 21:13 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2007-12-30 21:13 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-30 21:13 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-12-30 21:13 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-26 20:54 . 2008-01-03 20:11 <REP> d-------- C:\Program Files\JeCreeMaCuisineAvecLeroyMerlin
2007-12-26 20:54 . 2000-07-14 23:00 311,296 --a------ C:\WINDOWS\system32\MSDBRPT.DLL
2007-12-26 20:54 . 1998-07-12 23:00 141,312 --a------ C:\WINDOWS\system32\MSCmCFR.dll
2007-12-19 08:50 . 2007-12-19 08:50 63 --a------ C:\WINDOWS\mdm.ini
2007-12-19 08:49 . 2007-12-19 08:49 0 --a------ C:\WINDOWS\NSREX.INI
2007-12-19 08:46 . 2007-12-19 08:46 <REP> d-------- C:\WINDOWS\Twain32
2007-12-19 08:46 . 2007-12-19 08:46 <REP> d-------- C:\Program Files\Microsoft Office2000
2007-12-19 08:46 . 2007-12-19 08:46 <REP> d-------- C:\Documents and Settings\Bernardo\Application Data\Microsoft Web Folders
2007-12-19 08:41 . 2007-12-19 08:41 39,936 --------- C:\WINDOWS\system32\pmnnllk.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 09:03 --------- d-----w C:\Program Files\eMule
2008-01-02 18:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-31 16:13 --------- d-----w C:\Documents and Settings\Bernardo\Application Data\AdobeUM
2007-12-20 17:41 --------- d-----w C:\Program Files\EPSON Print CD
2007-12-17 19:11 --------- d-----w C:\Program Files\MSN Messenger
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-25 14:43 --------- d-----w C:\Program Files\adslTV
2007-11-25 14:40 --------- d-----w C:\Documents and Settings\Bernardo\Application Data\vlc
2007-11-25 14:33 4,546,649 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-11-16 11:46 --------- d-----w C:\Documents and Settings\Bernardo\Application Data\CSTB_CDDTU
2007-11-16 11:36 2,227 ----a-w C:\Program Files\unins000.dat
2007-11-16 11:35 643,129 ----a-w C:\Program Files\unins000.exe
2007-11-16 08:00 66,576 ----a-w C:\Documents and Settings\Bernardo\Application Data\GDIPFONTCACHEV1.DAT
2007-11-15 18:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-11-15 18:03 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-11-15 18:03 --------- d-----w C:\Program Files\Bonjour
2007-11-15 17:54 --------- d-----w C:\Program Files\Fichiers communs\Macrovision Shared
2007-08-14 17:37 60,372 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_08_13_19_52_21_small.dmp.zip
2007-04-28 07:44 61,997 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_04_28_09_26_51_small.dmp.zip
2007-04-11 07:01 63,042 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_04_10_22_26_27_small.dmp.zip
2007-02-10 09:28 66,176 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_03_15_35_39_small.dmp.zip
2007-01-27 15:13 79,254 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_01_27_12_16_45_small.dmp.zip
2007-01-27 15:13 206,885 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_01_27_12_16_02_small.dmp.zip
2006-12-09 13:17 64,365 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2006_12_08_19_36_58_small.dmp.zip
2006-10-21 12:03 61,624 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2006_10_21_12_29_51_small.dmp.zip
2006-10-18 11:21 24,046 ----a-w C:\WINDOWS\Fonts\Arctic.zip
2006-03-10 11:35 6,684,672 ----a-w C:\Program Files\Em4.exe
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{028A6469-94F4-4A9C-84C8-6609476B5219}]
C:\WINDOWS\system32\ssqpn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{818EC18F-5774-4DF2-A384-E0AA650CEC05}]
2004-08-19 17:08 105685 --a------ C:\WINDOWS\system32\cfgmgr3.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 17:09 15360]
"LClock"="lclock.exe" [2004-12-08 17:06 65536 C:\WINDOWS\LClock.exe]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-21 00:20 1211176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo RX700 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.exe" [2004-11-10 04:00 98304]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-07-22 09:42 1519616]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-12-16 16:49 49152]
"phc600"="C:\WINDOWS\vphc600.exe" [2005-02-01 14:05 339968]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58 282624]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-23 22:38 968696]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 14:47 57344]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576]
"NeroCheck"="C:\WINDOWS\system32\\NeroCheck.exe" [2001-07-09 11:50 155648]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"SoundMan"="SOUNDMAN.EXE" [2003-02-27 13:29 47104 C:\WINDOWS\soundman.exe]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 15:52 3770024]
"avast!"="C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 17:09 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="C:\WINDOWS\LSD\end.cmd" [2005-07-14 16:39 2310]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 16:52 44544]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)

R0 frwuacoj;frwuacoj;C:\WINDOWS\system32\drivers\cpucseit.sys []
R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys [2005-02-11 19:11]
R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-10-18 16:06]
R3 phc600;USB PC Camera (phc600);C:\WINDOWS\system32\DRIVERS\phc600.sys [2005-02-22 18:48]
S3 95f619c0-0af3-42f4-bbec-e6aa03903b20;95f619c0-0af3-42f4-bbec-e6aa03903b20;E:\Player\cds300.dll []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e18cdc5-5320-11db-9a09-806d6172696f}]
\Shell\AutoRun\command - E:\autorun.exe readme.hta

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-01-19 11:29:20 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-05 22:20:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2527]
-> C:\WINDOWS\LC.dll
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-05 22:24:24 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-05 21:24:20

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:25:20, on 05/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\vphc600.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\lclock.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\Microsoft ActiveSync\rapimgr.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Philips\SPC 600NC PC Camera\TrayMin.exe
C:\Program Files\SpamPal\spampal.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Bernardo\Bureau\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {028A6469-94F4-4A9C-84C8-6609476B5219} - C:\WINDOWS\system32\ssqpn.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {818EC18F-5774-4DF2-A384-E0AA650CEC05} - C:\WINDOWS\system32\cfgmgr3.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX700 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE /P31 "EPSON Stylus Photo RX700 Series" /O6 "USB001" /M "Stylus Photo RX700"
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [phc600] C:\WINDOWS\vphc600.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office2000\Office\OSA9.EXE
O4 - Global Startup: TrayMin.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wi [...] 9045558125
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.fotocompil.com/panierph [...] oader4.cab
O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - E:\Player\__CDS2.dll (file missing)
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32\netdde.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--
End of file - 9069 bytes

Voilà la suite

ComboFix 08-01-04.1 - Bernardo 2008-01-05 23:01:23.6 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.641 [GMT 1:00]
Running from: C:\Documents and Settings\Bernardo\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Bernardo\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\cfgmgr3.dll
C:\WINDOWS\system32\drivers\cpucseit.sys
C:\windows\system32\pmnnllk.dll
C:\WINDOWS\system32\ssqpn.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\cfgmgr3.dll
C:\WINDOWS\system32\drivers\cpucseit.sys
C:\windows\system32\pmnnllk.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FRWUACOJ
-------\frwuacoj


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-05 to 2008-01-05 ))))))))))))))))))))))))))))))))))))
.

2008-01-05 22:58 . 2008-01-05 22:58 <REP> d-------- C:\Program Files\XviD
2008-01-05 22:53 . 2008-01-05 22:53 <REP> d-------- C:\Program Files\Anuman Interactive
2008-01-05 22:19 . 2008-01-05 22:19 <REP> d--hs---- C:\WINDOWS\system32\dllcache
2008-01-03 22:39 . 2008-01-03 22:39 <REP> d-------- C:\Documents and Settings\Bernardo\Application Data\Leadertech
2007-12-31 17:00 . 2008-01-02 19:29 225 --a------ C:\WINDOWS\wininit.ini
2007-12-30 21:21 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-12-30 21:14 . 2007-12-30 21:19 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-12-30 21:14 . 2007-12-30 21:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-30 21:13 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-12-30 21:13 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2007-12-30 21:13 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-30 21:13 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-12-30 21:13 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-26 20:54 . 2008-01-03 20:11 <REP> d-------- C:\Program Files\JeCreeMaCuisineAvecLeroyMerlin
2007-12-26 20:54 . 2000-07-14 23:00 311,296 --a------ C:\WINDOWS\system32\MSDBRPT.DLL
2007-12-26 20:54 . 1998-07-12 23:00 141,312 --a------ C:\WINDOWS\system32\MSCmCFR.dll
2007-12-19 08:50 . 2007-12-19 08:50 63 --a------ C:\WINDOWS\mdm.ini
2007-12-19 08:49 . 2007-12-19 08:49 0 --a------ C:\WINDOWS\NSREX.INI
2007-12-19 08:46 . 2007-12-19 08:46 <REP> d-------- C:\WINDOWS\Twain32
2007-12-19 08:46 . 2007-12-19 08:46 <REP> d-------- C:\Program Files\Microsoft Office2000
2007-12-19 08:46 . 2007-12-19 08:46 <REP> d-------- C:\Documents and Settings\Bernardo\Application Data\Microsoft Web Folders

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 09:03 --------- d-----w C:\Program Files\eMule
2008-01-02 18:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-31 16:13 --------- d-----w C:\Documents and Settings\Bernardo\Application Data\AdobeUM
2007-12-20 17:41 --------- d-----w C:\Program Files\EPSON Print CD
2007-12-17 19:11 --------- d-----w C:\Program Files\MSN Messenger
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-25 14:43 --------- d-----w C:\Program Files\adslTV
2007-11-25 14:40 --------- d-----w C:\Documents and Settings\Bernardo\Application Data\vlc
2007-11-25 14:33 4,546,649 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-11-16 11:46 --------- d-----w C:\Documents and Settings\Bernardo\Application Data\CSTB_CDDTU
2007-11-16 11:36 2,227 ----a-w C:\Program Files\unins000.dat
2007-11-16 11:35 643,129 ----a-w C:\Program Files\unins000.exe
2007-11-16 08:00 66,576 ----a-w C:\Documents and Settings\Bernardo\Application Data\GDIPFONTCACHEV1.DAT
2007-11-15 18:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-11-15 18:03 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-11-15 18:03 --------- d-----w C:\Program Files\Bonjour
2007-11-15 17:54 --------- d-----w C:\Program Files\Fichiers communs\Macrovision Shared
2007-08-14 17:37 60,372 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_08_13_19_52_21_small.dmp.zip
2007-04-28 07:44 61,997 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_04_28_09_26_51_small.dmp.zip
2007-04-11 07:01 63,042 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_04_10_22_26_27_small.dmp.zip
2007-02-10 09:28 66,176 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_03_15_35_39_small.dmp.zip
2007-01-27 15:13 79,254 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_01_27_12_16_45_small.dmp.zip
2007-01-27 15:13 206,885 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_01_27_12_16_02_small.dmp.zip
2006-12-09 13:17 64,365 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2006_12_08_19_36_58_small.dmp.zip
2006-10-21 12:03 61,624 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2006_10_21_12_29_51_small.dmp.zip
2006-10-18 11:21 24,046 ----a-w C:\WINDOWS\Fonts\Arctic.zip
2006-03-10 11:35 6,684,672 ----a-w C:\Program Files\Em4.exe
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((( snapshot@2008-01-05_22.23.59.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-12-20 10:03:26 679,936 ----a-w C:\WINDOWS\system32\xvidcore.dll
+ 2004-12-20 10:08:28 155,648 ----a-w C:\WINDOWS\system32\xvidvfw.dll
- 2008-01-05 21:08:51 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat
+ 2008-01-05 22:08:54 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat
+ 2008-01-05 22:06:16 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_50c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 17:09 15360]
"LClock"="lclock.exe" [2004-12-08 17:06 65536 C:\WINDOWS\LClock.exe]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-21 00:20 1211176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo RX700 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.exe" [2004-11-10 04:00 98304]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-07-22 09:42 1519616]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-12-16 16:49 49152]
"phc600"="C:\WINDOWS\vphc600.exe" [2005-02-01 14:05 339968]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58 282624]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-23 22:38 968696]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 14:47 57344]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576]
"NeroCheck"="C:\WINDOWS\system32\\NeroCheck.exe" [2001-07-09 11:50 155648]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"SoundMan"="SOUNDMAN.EXE" [2003-02-27 13:29 47104 C:\WINDOWS\soundman.exe]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 15:52 3770024]
"avast!"="C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 17:09 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="C:\WINDOWS\LSD\end.cmd" [2005-07-14 16:39 2310]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 16:52 44544]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys [2005-02-11 19:11]
R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-10-18 16:06]
R3 phc600;USB PC Camera (phc600);C:\WINDOWS\system32\DRIVERS\phc600.sys [2005-02-22 18:48]
S3 95f619c0-0af3-42f4-bbec-e6aa03903b20;95f619c0-0af3-42f4-bbec-e6aa03903b20;E:\Player\cds300.dll []

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-01-19 11:29:20 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-05 23:10:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2527]
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-05 23:14:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-05 22:14:26
ComboFix2.txt 2008-01-05 21:24:24

Avec un peu de retard désolé :

Thursday, January 10, 2008 8:10:14 AM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 9/01/2008
Enregistrements dans la base antivirus Kaspersky : 471635


Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Poste de travail
A:\
C:\
D:\
E:\
F:\

Statistiques de l'analyse
Total d'objets analysés 153448
Nombre de virus trouvés 4
Nombre d'objets infectés 7 / 0
Nombre d'objets suspects 0
Durée de l'analyse 03:54:37

Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\Bernardo\Application Data\$_hpcst$.hpc L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\Application Data\Identities\{9CFC3277-B3BD-4CD9-B7A1-DEEEA2C9FE18}\Microsoft\Outlook Express\Folders.dbx L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\Application Data\Identities\{9CFC3277-B3BD-4CD9-B7A1-DEEEA2C9FE18}\Microsoft\Outlook Express\Offline.dbx L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\Application Data\Identities\{9CFC3277-B3BD-4CD9-B7A1-DEEEA2C9FE18}\Microsoft\Outlook Express\Pop3uidl.dbx L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\Application Data\Identities\{9CFC3277-B3BD-4CD9-B7A1-DEEEA2C9FE18}\Microsoft\Outlook Express\Éléments supprimés.dbx L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\temp\Perflib_Perfdata_434.dat L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\temp\Perflib_Perfdata_7cc.dat L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\temp\Perflib_Perfdata_80c.dat L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\temp\WCESLog.log L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\temp\~DFC399.tmp L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\Bernardo\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log L'objet est verrouillé ignoré

C:\Program Files\Alwil Software\Avast4\DATA\report\Protection résidente.txt L'objet est verrouillé ignoré

C:\qoobox\Quarantine\C\WINDOWS\system32\cfgmgr3.1.vir Infecté : Trojan-Spy.Win32.BZub.btd ignoré

C:\qoobox\Quarantine\catchme2008-01-05_231020.03.zip/cpucseit.sys Infecté : Trojan.Win32.BHO.gy ignoré

C:\qoobox\Quarantine\catchme2008-01-05_231020.03.zip ZIP: infecté - 1 ignoré

C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

C:\System Volume Information\_restore{8C8F4419-6B85-4D6B-9DC0-675C6E9F9814}\RP7\change.log L'objet est verrouillé ignoré

C:\VundoFix Backups\winjyg32.dll.bad Infecté : Trojan.Win32.Dialer.yz ignoré

C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\ACEEvent.evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\drivers\atapi.sys L'objet est verrouillé ignoré

C:\WINDOWS\system32\drivers\xkvletbe.sys Infecté : Trojan.Win32.BHO.gy ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

C:\WINDOWS\TEMP\Perflib_Perfdata_508.dat L'objet est verrouillé ignoré

C:\WINDOWS\TEMP\_avast4_\Webshlock.txt L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

D:\System Volume Information\_restore{8C8F4419-6B85-4D6B-9DC0-675C6E9F9814}\RP7\change.log L'objet est verrouillé ignoré

D:\My Downloads\Font - 13000 Fonts The Definitive Collection\007 Spy Software(Keylogger) Plus Serial By Deeohgee\007 Spy SoftWare(KeyLogger+) Plus Serial By DeeOhGee\007 Spy SoftWare SetUp.exe/data0007 Infecté : Trojan-Spy.Win32.SpyAnyTime.a ignoré

D:\My Downloads\Font - 13000 Fonts The Definitive Collection\007 Spy Software(Keylogger) Plus Serial By Deeohgee\007 Spy SoftWare(KeyLogger+) Plus Serial By DeeOhGee\007 Spy SoftWare SetUp.exe Inno: infecté - 1 ignoré

Analyse terminée.

Voilà :
C:\qoobox\Quarantine\Registry_backups moved successfully.
C:\qoobox\Quarantine\C\WINDOWS\system32\drivers moved successfully.
C:\qoobox\Quarantine\C\WINDOWS\system32 moved successfully.
C:\qoobox\Quarantine\C\WINDOWS moved successfully.
C:\qoobox\Quarantine\C\ComboFix moved successfully.
C:\qoobox\Quarantine\C moved successfully.
C:\qoobox\Quarantine moved successfully.
C:\qoobox\Hiv-backup\Users\00000006 moved successfully.
C:\qoobox\Hiv-backup\Users\00000005 moved successfully.
C:\qoobox\Hiv-backup\Users\00000004 moved successfully.
C:\qoobox\Hiv-backup\Users\00000003 moved successfully.
C:\qoobox\Hiv-backup\Users\00000002 moved successfully.
C:\qoobox\Hiv-backup\Users\00000001 moved successfully.
C:\qoobox\Hiv-backup\Users moved successfully.
Folder move failed. C:\qoobox\Hiv-backup\system scheduled to be moved on reboot.
Folder move failed. C:\qoobox\Hiv-backup\software scheduled to be moved on reboot.
Folder move failed. C:\qoobox\Hiv-backup\SECURITY scheduled to be moved on reboot.
Folder move failed. C:\qoobox\Hiv-backup\SAM scheduled to be moved on reboot.
Folder move failed. C:\qoobox\Hiv-backup\default scheduled to be moved on reboot.
C:\qoobox\Hiv-backup moved successfully.
C:\qoobox\BackEnv moved successfully.
C:\qoobox moved successfully.
C:\VundoFix Backups moved successfully.
C:\WINDOWS\system32\drivers\xkvletbe.sys moved successfully.
D:\My Downloads\Font - 13000 Fonts The Definitive Collection\007 Spy Software(Keylogger) Plus Serial By Deeohgee\007 Spy SoftWare(KeyLogger+) Plus Serial By DeeOhGee\007 Spy SoftWare SetUp.exe moved successfully.

Created on 01/11/2008 17:48:45

Cela à l'air de fonctionner correctement, je crois bien que c'est tout bon.
Merci Beaucoup pour ton aide et meilleurs voeux pour cette nouvelle année