Bonjour à tous,

Mon ordinateur est infecté depuis quelques temps par Win32:BHO-KD [trj], c'est le fichier c:\windows\system32\dmim.dll qui est infecté.
Avast le détecte mais ne réussit ni à le supprimer, ni à le mettre en quarantaine...
J'ai essayé de détruire l'infection avec spybot, ad aware, avast virus cleaner, combo fix... mais rien n'y fait !

Merci beaucoup pour votre aide

Ci joint rapport hijackthis et combofix

hijacks
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:55:39, on 11/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\802.11 Wireless LAN\WlanMonitor.exe
C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\Program Files\a-squared HiJackFree\a2hijackfree.exe
C:\DOCUME~1\nicolas\LOCALS~1\Temp\Répertoire temporaire 1 pour HiJackThis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webcam-internet.com/google.php
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://10.0.0.1/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Adssite Search Assistant - {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} - C:\WINDOWS\system32\adssite_sidebar.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ads_optimizer - {9C8A568E-4201-478a-8536-526CF371D2E2} - C:\WINDOWS\system32\nsx9.dll
O2 - BHO: (no name) - {D471FCFD-6594-4F7E-9210-762E80E5DC58} - C:\WINDOWS\system32\dmim.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Moniteur & Configuration.lnk = ?
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/fr/securityadvis [...] stscan.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - http://www.bobtv.fr/download/cfweb [...] module.exe
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

--
End of file - 6809 bytes


rapport combofix
ComboFix 08-01-09.2 - nicolas 2008-01-11 16:06:12.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.691 [GMT 1:00]
Running from: C:\Documents and Settings\nicolas\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Documents and Settings\nicolas\Local Settings\Application Data\vlthyt.dat
C:\Documents and Settings\nicolas\Local Settings\Application Data\vlthyt.exe
C:\Documents and Settings\nicolas\Local Settings\Application Data\vlthyt_nav.dat
C:\Documents and Settings\nicolas\Local Settings\Application Data\vlthyt_navps.dat
C:\WINDOWS\backinf.tab
C:\WINDOWS\system32\nsx9.dll
C:\WINDOWS\ufdata2000.log
D:\autorun.inf
E:\autorun.inf
F:\Autorun.inf
G:\autorun.inf

.
((((((((((((((((((((((((((((( Fichiers créés 2007-12-11 to 2008-01-11 ))))))))))))))))))))))))))))))))))))
.

2008-01-11 16:05 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-08 21:17 . 2007-03-04 16:53 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-01-08 21:17 . 2007-03-04 16:53 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-01-08 21:17 . 2007-03-04 17:01 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-01-08 21:17 . 2007-03-04 16:53 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-01-08 21:17 . 2007-03-04 16:53 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-01-08 21:17 . 2007-03-04 16:53 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-01-08 21:17 . 2007-03-04 16:53 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-01-08 16:05 . 2008-01-08 16:05 <REP> d-------- C:\WINDOWS\report
2008-01-08 16:05 . 2008-01-08 16:05 <REP> d-------- C:\WINDOWS\AU_Backup
2008-01-08 16:05 . 2008-01-08 16:05 35,362,677 --a------ C:\WINDOWS\VPTNFILE.933
2008-01-08 16:05 . 2008-01-08 16:05 35,362,677 --a------ C:\WINDOWS\LPT$VPN.933
2008-01-08 16:05 . 2008-01-08 16:05 1,908,478 --a------ C:\WINDOWS\tsc.ptn
2008-01-08 16:05 . 2008-01-08 16:05 1,163,344 --a------ C:\WINDOWS\vsapi32.dll
2008-01-08 16:05 . 2008-01-08 16:05 267,845 --a------ C:\WINDOWS\tsc.exe
2008-01-08 16:05 . 2008-01-08 16:05 86,094 --a------ C:\WINDOWS\BPMNT.dll
2008-01-08 16:05 . 2008-01-08 16:05 71,749 --a------ C:\WINDOWS\hcextoutput.dll
2008-01-08 16:05 . 2008-01-08 20:45 823 --a------ C:\WINDOWS\tsc.ini
2008-01-08 16:01 . 2008-01-08 16:05 <REP> d-------- C:\WINDOWS\AU_Temp
2008-01-08 16:01 . 2008-01-08 16:01 <REP> d-------- C:\WINDOWS\AU_Log
2008-01-08 16:01 . 2008-01-08 16:01 170 --a------ C:\WINDOWS\GetServer.ini
2008-01-08 16:00 . 2008-01-08 16:00 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2008-01-08 16:00 . 2008-01-08 16:00 286,720 --a------ C:\WINDOWS\PATCH.EXE
2008-01-08 16:00 . 2008-01-08 16:00 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2008-01-06 22:43 . 2008-01-06 22:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2008-01-06 22:26 . 2008-01-06 22:26 <REP> d-------- C:\Program Files\Uniblue
2008-01-06 22:12 . 2008-01-06 22:32 <REP> d-------- C:\Documents and Settings\nicolas\Application Data\Uniblue
2008-01-06 22:04 . 2008-01-11 15:52 100 --a------ C:\index.ini
2008-01-06 21:59 . 2008-01-06 22:00 <REP> d-------- C:\Program Files\a-squared HiJackFree
2008-01-05 23:30 . 2008-01-05 23:30 <REP> d-------- C:\Program Files\QuickPar
2008-01-05 21:08 . 2001-10-26 23:16 16,384 --a------ C:\WINDOWS\system32\FileOps.exe
2008-01-05 20:57 . 2008-01-05 20:57 <REP> d-------- C:\eLearn
2008-01-05 20:51 . 2008-01-05 20:51 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2008-01-05 20:51 . 2008-01-05 20:51 <REP> d-------- C:\Documents and Settings\nicolas\Application Data\Ahead
2008-01-05 20:51 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2008-01-05 20:51 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2008-01-05 20:51 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2008-01-05 20:51 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-01-05 20:51 . 2003-03-29 16:45 89,184 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2008-01-05 20:51 . 2003-07-29 17:09 57,344 --a------ C:\WINDOWS\system32\ImageDrive.cpl
2008-01-05 20:51 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2008-01-05 13:30 . 2008-01-05 13:30 <REP> d-------- C:\Documents and Settings\nicolas\Application Data\Media Player Classic
2008-01-04 16:06 . 1996-02-08 09:54 284,160 --a------ C:\WINDOWS\unin040c.exe
2007-12-12 20:35 . 2004-08-19 16:09 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-12-12 20:35 . 2004-08-19 16:09 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2007-12-12 20:35 . 2001-08-23 17:04 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-12-12 20:35 . 2001-08-23 17:04 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2007-12-12 20:35 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-12-12 20:35 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2007-12-11 17:22 . 2007-12-11 17:22 <REP> d-------- C:\Program Files\Activision
2007-12-11 17:19 . 2007-12-11 17:19 <REP> d--hs---- C:\WINDOWS\ftpcache
2007-12-11 17:13 . 2007-12-11 17:13 <REP> d-------- C:\WINDOWS\system32\LogFiles
2007-12-11 12:07 . 2008-01-11 16:05 77,353 --a------ C:\WINDOWS\system32\adssite_sidebar_uninstall.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-08 13:53 --------- d-----w C:\Program Files\Wanadoo
2008-01-06 21:30 --------- d-----w C:\Program Files\a-squared Free
2008-01-06 00:53 --------- d-----w C:\Documents and Settings\nicolas\Application Data\GrabIt
2008-01-05 20:08 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-01-05 19:51 --------- d-----w C:\Program Files\Ahead
2007-12-28 21:58 --------- d-----w C:\Documents and Settings\nicolas\Application Data\CamfrogWEB
2007-12-19 21:21 --------- d-----w C:\Program Files\VideoLAN
2007-12-19 19:25 --------- d-----w C:\Program Files\eMule
2007-12-11 16:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-11 11:06 19,456 ----a-w C:\WINDOWS\system32\drivers\dgozwjnc.dat
2007-12-10 18:52 303,104 ----a-w C:\WINDOWS\system32\adssite_sidebar.dll
2007-12-06 11:13 --------- d-----w C:\Program Files\Home Plan Software
2007-12-06 09:25 --------- d-----w C:\Program Files\GrabIt
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-12-02 10:07 79,868 ----a-w C:\WINDOWS\system32\adssite-remove.exe
2007-11-22 14:44 --------- d-----w C:\Documents and Settings\nicolas\Application Data\Lavasoft
2007-11-22 14:43 --------- d-----w C:\Program Files\Lavasoft
2007-11-18 07:52 --------- d-----w C:\Program Files\EntreCam
2007-11-17 08:32 --------- d-----w C:\Program Files\LimeWire
2007-06-01 17:24 22,504 -c--a-w C:\Documents and Settings\nicolas\Application Data\GDIPFONTCACHEV1.DAT
2001-03-28 10:02 122,880 -c--a-w C:\WINDOWS\inf\Agfa\message.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1648E328-3E5A-4EA5-A9C6-E5F09EE272DA}]
2007-12-10 19:52 303104 --a------ C:\WINDOWS\system32\adssite_sidebar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D471FCFD-6594-4F7E-9210-762E80E5DC58}]
2004-08-19 16:09 93440 --a------ C:\WINDOWS\system32\dmim.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-02-24 00:32 5537792]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 18:19 15872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17 443968]

C:\Documents and Settings\nicolas\Menu D‚marrer\Programmes\D‚marrage\
Moniteur & Configuration.lnk - C:\Program Files\802.11 Wireless LAN\WlanMonitor.exe [2003-10-01 14:27:44]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background

R0 iteraid;ITERAID_Service_Install;C:\WINDOWS\system32\DRIVERS\iteraid.sys [2004-06-01 09:19]
R0 pxfvcvna;pxfvcvna;C:\WINDOWS\system32\drivers\dgozwjnc.dat []
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe [2001-08-23 17:47]
R3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys [2001-08-17 21:28]
S3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys []
S3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys []
S3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgNW.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\Auto\command - tel.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\Auto\command - tel.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\Auto\command - tel.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\Auto\command - tel.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\Auto\command - tel.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-01-07 07:15:22 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-11 16:07:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-11 16:07:40
ComboFix-quarantined-files.txt 2008-01-11 15:07:38

Bonsoir

Séléctionne l'encadré ci dessous en entier , puis clique droit , choisis Copier

Colle le dans le Bloc-Notes
Enregistre le sur ton Bureau et nomme le CFScript ( type fichier texte )
Fait glisser le fichier CFScript sur le fichier ComboFix.exe comme ceci :



Un menu va apparaitre , tape 1 puis valide
Laisse faire le scan et poste le rapport généré ( C:\ComboFix.txt )

---------------------------------------------------

Fais analyser ce fichier ici : Virustotal
Clique sur , choisis Poste de travail

puis C:\WINDOWS\inf\Agfa\message.exe

Clique maintenant sur

il sera analysé par une plusieurs Antivirus

copie / colle le rapport

Bonjour,


Télécharge :
http://dcangeldark.googlepages.com/Kill_Adssite.zip
Dézippe-le sur ton bureau.

Redémarre en mode sans échec.

Lance Kill.cmd puis sauvegarde le rapport.
Poste-le dans ta prochaine réponse.

Angel , tu es grillé

18:18:57 < > 18:19:53

J'étais sur le sujet depuis longtemps, mais j'ai pas eu le temps de poster.
Le gouter, c'est sacré

Voici le resultat combofix, merci encore eric

ComboFix 08-01-09.2 - nicolas 2008-01-11 20:05:05.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.651 [GMT 1:00]
Running from: C:\Documents and Settings\nicolas\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\nicolas\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\adssite-remove.exe
C:\WINDOWS\system32\adssite_sidebar.dll
C:\WINDOWS\system32\dmim.dll
C:\WINDOWS\system32\drivers\dgozwjnc.dat
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\adssite-remove.exe
C:\WINDOWS\system32\adssite_sidebar.dll
C:\WINDOWS\system32\dmim.dll
C:\WINDOWS\system32\drivers\dgozwjnc.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_PXFVCVNA
-------\pxfvcvna


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-11 to 2008-01-11 ))))))))))))))))))))))))))))))))))))
.

2008-01-11 16:05 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-08 21:17 . 2007-03-04 16:53 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-01-08 21:17 . 2007-03-04 16:53 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-01-08 21:17 . 2007-03-04 17:01 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-01-08 21:17 . 2007-03-04 16:53 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-01-08 21:17 . 2007-03-04 16:53 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-01-08 21:17 . 2007-03-04 16:53 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-01-08 21:17 . 2007-03-04 16:53 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-01-08 16:05 . 2008-01-08 16:05 <REP> d-------- C:\WINDOWS\report
2008-01-08 16:05 . 2008-01-08 16:05 <REP> d-------- C:\WINDOWS\AU_Backup
2008-01-08 16:05 . 2008-01-08 16:05 35,362,677 --a------ C:\WINDOWS\VPTNFILE.933
2008-01-08 16:05 . 2008-01-08 16:05 35,362,677 --a------ C:\WINDOWS\LPT$VPN.933
2008-01-08 16:05 . 2008-01-08 16:05 1,908,478 --a------ C:\WINDOWS\tsc.ptn
2008-01-08 16:05 . 2008-01-08 16:05 1,163,344 --a------ C:\WINDOWS\vsapi32.dll
2008-01-08 16:05 . 2008-01-08 16:05 267,845 --a------ C:\WINDOWS\tsc.exe
2008-01-08 16:05 . 2008-01-08 16:05 86,094 --a------ C:\WINDOWS\BPMNT.dll
2008-01-08 16:05 . 2008-01-08 16:05 71,749 --a------ C:\WINDOWS\hcextoutput.dll
2008-01-08 16:05 . 2008-01-08 20:45 823 --a------ C:\WINDOWS\tsc.ini
2008-01-08 16:01 . 2008-01-08 16:05 <REP> d-------- C:\WINDOWS\AU_Temp
2008-01-08 16:01 . 2008-01-08 16:01 <REP> d-------- C:\WINDOWS\AU_Log
2008-01-08 16:01 . 2008-01-08 16:01 170 --a------ C:\WINDOWS\GetServer.ini
2008-01-08 16:00 . 2008-01-08 16:00 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2008-01-08 16:00 . 2008-01-08 16:00 286,720 --a------ C:\WINDOWS\PATCH.EXE
2008-01-08 16:00 . 2008-01-08 16:00 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2008-01-06 22:43 . 2008-01-06 22:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2008-01-06 22:26 . 2008-01-06 22:26 <REP> d-------- C:\Program Files\Uniblue
2008-01-06 22:12 . 2008-01-06 22:32 <REP> d-------- C:\Documents and Settings\nicolas\Application Data\Uniblue
2008-01-06 22:04 . 2008-01-11 15:52 100 --a------ C:\index.ini
2008-01-06 21:59 . 2008-01-06 22:00 <REP> d-------- C:\Program Files\a-squared HiJackFree
2008-01-05 23:30 . 2008-01-05 23:30 <REP> d-------- C:\Program Files\QuickPar
2008-01-05 21:08 . 2001-10-26 23:16 16,384 --a------ C:\WINDOWS\system32\FileOps.exe
2008-01-05 20:57 . 2008-01-05 20:57 <REP> d-------- C:\eLearn
2008-01-05 20:51 . 2008-01-05 20:51 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2008-01-05 20:51 . 2008-01-05 20:51 <REP> d-------- C:\Documents and Settings\nicolas\Application Data\Ahead
2008-01-05 20:51 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2008-01-05 20:51 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2008-01-05 20:51 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2008-01-05 20:51 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-01-05 20:51 . 2003-03-29 16:45 89,184 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2008-01-05 20:51 . 2003-07-29 17:09 57,344 --a------ C:\WINDOWS\system32\ImageDrive.cpl
2008-01-05 20:51 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2008-01-05 13:30 . 2008-01-05 13:30 <REP> d-------- C:\Documents and Settings\nicolas\Application Data\Media Player Classic
2008-01-04 16:06 . 1996-02-08 09:54 284,160 --a------ C:\WINDOWS\unin040c.exe
2007-12-12 20:35 . 2004-08-19 16:09 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-12-12 20:35 . 2004-08-19 16:09 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2007-12-12 20:35 . 2001-08-23 17:04 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-12-12 20:35 . 2001-08-23 17:04 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2007-12-12 20:35 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-12-12 20:35 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2007-12-11 17:22 . 2007-12-11 17:22 <REP> d-------- C:\Program Files\Activision
2007-12-11 17:19 . 2007-12-11 17:19 <REP> d--hs---- C:\WINDOWS\ftpcache
2007-12-11 17:13 . 2007-12-11 17:13 <REP> d-------- C:\WINDOWS\system32\LogFiles
2007-12-11 12:07 . 2008-01-11 16:05 77,353 --a------ C:\WINDOWS\system32\adssite_sidebar_uninstall.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-11 15:12 --------- d-----w C:\Program Files\Wanadoo
2008-01-06 21:30 --------- d-----w C:\Program Files\a-squared Free
2008-01-06 00:53 --------- d-----w C:\Documents and Settings\nicolas\Application Data\GrabIt
2008-01-05 20:08 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-01-05 19:51 --------- d-----w C:\Program Files\Ahead
2007-12-28 21:58 --------- d-----w C:\Documents and Settings\nicolas\Application Data\CamfrogWEB
2007-12-19 21:21 --------- d-----w C:\Program Files\VideoLAN
2007-12-19 19:25 --------- d-----w C:\Program Files\eMule
2007-12-11 16:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-06 11:13 --------- d-----w C:\Program Files\Home Plan Software
2007-12-06 09:25 --------- d-----w C:\Program Files\GrabIt
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-22 14:44 --------- d-----w C:\Documents and Settings\nicolas\Application Data\Lavasoft
2007-11-22 14:43 --------- d-----w C:\Program Files\Lavasoft
2007-11-18 07:52 --------- d-----w C:\Program Files\EntreCam
2007-11-17 08:32 --------- d-----w C:\Program Files\LimeWire
2007-06-01 17:24 22,504 -c--a-w C:\Documents and Settings\nicolas\Application Data\GDIPFONTCACHEV1.DAT
2001-03-28 10:02 122,880 -c--a-w C:\WINDOWS\inf\Agfa\message.exe
.

((((((((((((((((((((((((((((( snapshot@2008-01-11_16.07.26,46 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-11 15:06:02 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-11 19:05:00 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-11 15:06:02 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-11 19:05:00 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-11 15:06:02 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-11 19:05:00 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-11 15:06:02 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-11 19:05:00 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-11 15:06:02 4,763,648 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-11 19:05:00 4,763,648 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-11 15:06:02 147,456 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-11 19:05:00 147,456 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-01-11 19:07:34 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_57c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-02-24 00:32 5537792]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 18:19 15872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17 443968]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background

R0 iteraid;ITERAID_Service_Install;C:\WINDOWS\system32\DRIVERS\iteraid.sys [2004-06-01 09:19]
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe [2001-08-23 17:47]
R3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys [2001-08-17 21:28]
S3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys []
S3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys []
S3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgNW.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\Auto\command - tel.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\Auto\command - tel.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\Auto\command - tel.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\Auto\command - tel.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\Auto\command - tel.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-01-07 07:15:22 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-11 20:10:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]
-> C:\Program Files\Unlocker\UnlockerHook.dll
.
Completion time: 2008-01-11 20:11:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-11 19:11:43
ComboFix2.txt 2008-01-11 15:07:41

Re ,

Reposte un HiJackThis

Et l'analyse de Virus Total

l'analyse de virus total de mon fichier dmime.dll?