bonjour  
 
je viens vous demandez votre aide
je pense être infecté
divers scan en ligne m'indique comme infecté rlls.dll
 
rapport hijackthis :  
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:21 , on 21/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\{92EC085D-F442-4FD1-8DCF-E1D09139B511}\sign.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\program Files\Windows Sidebar\sidebar.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
c:\windows\system32\rlvknlg.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://windows-unattended.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://windows-unattended.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://windows-unattended.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://windows-unattended.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: rightonads optimizer - {7D9362F8-77D8-4b29-97B5-621D550890C0} - C:\WINDOWS\system32\gzmrt.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Signature] C:\Windows\Drive\sign.exe
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [postSetupCheck] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrt.dll" DllStart
O4 - HKCU\..\Run: [Sidebar] C:\program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Signature] C:\Windows\Drive\sign.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [3D] C:\program Files\Topdesk\topdesk.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Vistadrv] C:\Windows\Drive\vsdrv.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Signature] C:\Windows\Drive\sign.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Horlorge] C:\program Files\Clock\Clock.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] C:\program Files\Windows Sidebar\sidebar.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [3D] C:\program Files\Topdesk\topdesk.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [3D] C:\program Files\Topdesk\topdesk.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [3D] C:\program Files\Topdesk\topdesk.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/p [...] nicode.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/adva [...] module.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-F [...] E_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/re [...] oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activ [...] asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: AshampooDefragService -   - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
 
--
End of file - 11313 bytes

Et Alors Efface le en mode sans échec, tu veux que l'on te dise quoi?

Hello ,

Ben voyons ...
 
phil8340 ,
 
Désactive tes protections résidentes ( Antivirus , ... ) tu les réactivera après le scan
 
Télécharge ComboFix < ici
 
Enregistre le sur ton Bureau et pas ailleurs !
Double clique combofix.exe ( le .exe peut ne pas apparaitre )
Pour démarrer , tape [1] puis valide , attend la fin du scan
il peut y avoir un Redémarrage du PC !
 
Copie / Colle le rapport généré ( C:\Combofix.txt )

heu merci
la courtoisie oui, je viens souvent dans ce forum, est soit disant le maître mot
un grand merci à angeldark qui m'a toujours remarquablement aidé

ouf merci eric_71

Re , c'est clair y'en à qui méritent des sanctions ...

pas grave Eric_71, je te remercie, voilà la suite
 
rapport :  
 
omboFix 08-02-22 - Administrateur 2008-02-21 20:55:20.12 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.1.1036.18.400 [GMT 1:00]
Endroit: D:\télécharger\ComboFix.exe
 * Création d'un nouveau point de restauration
 
[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.
 
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
 
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Program Files\webhancer
C:\Program Files\webhancer\Programs\license.txt
C:\Program Files\webhancer\Programs\readme.txt
C:\Program Files\webhancer\Programs\whAgent.ini
C:\WINDOWS\system32\gzmrt.dll
C:\WINDOWS\system32\ldpackage.dll
C:\WINDOWS\system32\model.dat
C:\WINDOWS\system32\rlls.dll
C:\WINDOWS\system32\rlvknlg.exe
C:\WINDOWS\system32\rlxf.dll
C:\WINDOWS\system32\silc_dll.dll
 
----- BITS: Possible sites infect‚s -----
 
hxxp://au.download.windowsupdate.õj
hxxp://au.download.window
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
 
.
-------\poof
 
 
(((((((((((((((((((((((((((((   Fichiers cr‚‚s 2008-01-22 to 2008-02-22  ))))))))))))))))))))))))))))))))))))
.
 
2008-02-21 18:24 . 2008-02-21 18:24 <REP> d-------- C:\Program Files\Softwin
2008-02-20 20:52 . 2008-02-20 20:52 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-20 20:52 . 2008-02-20 20:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-20 20:48 . 2008-02-21 18:23 <REP> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-20 20:48 . 2008-02-20 20:48 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-20 20:48 . 2008-02-20 20:48 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-20 19:02 . 2008-02-20 19:31 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-02-20 18:57 . 2008-02-20 18:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-02-20 18:40 . 2008-02-20 18:40 712,704 --a------ C:\WINDOWS\system32\rlph.dll
2008-02-20 18:25 . 2003-05-07 19:01 8,464 --a------ C:\WINDOWS\system32\sporder.dll
2008-02-20 18:23 . 2008-02-20 18:23 40,724 --a------ C:\WINDOWS\system32\rightonadz-uninst.exe
2008-02-19 19:01 . 2008-02-19 19:01 <REP> d-------- C:\Sierra
2008-02-19 19:00 . 1998-10-29 15:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-15 13:27 . 2008-02-15 13:27 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-02-12 21:07 . 2008-02-12 21:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Micro Application
2008-02-12 20:54 . 2008-02-12 20:54 <REP> d-------- C:\Program Files\Micro Application
2008-02-12 20:54 . 2008-02-12 20:54 <REP> d-------- C:\Program Files\Fichiers communs\Acronis
2008-02-12 20:54 . 2008-02-12 20:54 210,400 --a------ C:\WINDOWS\system32\drivers\timntr.sys
2008-02-12 20:54 . 2008-02-12 20:54 126,976 --a------ C:\WINDOWS\system32\snapapi.dll
2008-02-12 20:54 . 2008-02-12 20:54 81,280 --a------ C:\WINDOWS\system32\drivers\snapman.sys
2008-02-12 20:54 . 2008-02-12 20:54 37,888 --a------ C:\WINDOWS\system32\setupnt.dll
2008-02-12 20:54 . 2008-02-12 20:54 28,768 --a------ C:\WINDOWS\system32\drivers\tifsfilt.sys
2008-02-10 20:51 . 2008-02-10 20:51 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-10 19:41 . 2008-02-10 19:42 <REP> d-------- C:\Program Files\Any Video Converter Professional
2008-02-04 14:21 . 2008-02-04 14:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-02-04 14:21 . 2008-02-10 22:14 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Azureus
2008-02-04 14:20 . 2008-02-04 14:21 <REP> d-------- C:\Program Files\Azureus
2008-01-31 21:30 . 2008-01-31 21:30 <REP> d-------- C:\Documents and Settings\Administrateur\Temp
2008-01-29 20:38 . 2008-01-29 20:38 <REP> d-------- C:\Program Files\Ashampoo
2008-01-29 20:38 . 2008-01-29 20:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Ashampoo
2008-01-28 18:05 . 2008-02-13 12:27 <REP> d-------- C:\Program Files\SUPERAntiSpyware
2008-01-28 18:05 . 2008-01-28 18:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-28 18:05 . 2008-01-28 18:05 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com
2008-01-23 21:34 . 2008-01-23 21:34 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\TuneUp Software
2008-01-23 21:33 . 2008-01-23 21:34 <REP> d-------- C:\Program Files\TuneUp Utilities 2008
2008-01-23 21:33 . 2008-01-28 18:04 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-01-23 21:33 . 2008-01-23 21:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-01-23 21:33 . 2008-01-23 21:34 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-01-23 21:33 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
 
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-22 19:59 --------- d-----w C:\Program Files\Wanadoo
2008-02-21 19:12 --------- d-----w C:\Program Files\Trend Micro
2008-02-21 17:24 --------- d-----w C:\Program Files\Fichiers communs\Softwin
2008-02-12 11:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-23 20:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-18 14:14 --------- d-----w C:\Program Files\CFWebAdvancedU
2008-01-17 20:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-13 15:40 --------- d-----w C:\Program Files\DivX
2008-01-12 14:15 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\vlc
2008-01-03 21:31 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\CamfrogWEB
2008-01-02 15:04 --------- d-----w C:\Program Files\CFWebAdvancedU_BOBTV.FR
2007-12-27 17:25 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\LimeWire
2007-12-21 14:39 10,752 ----a-w C:\WINDOWS\system32\WhoisCL.exe
2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-28 16:48 19,960 ----a-w C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
2007-08-30 15:50 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
2006-07-29 17:18 112 --sha-w C:\WINDOWS\Drive\unistl.cmd
2007-08-28 16:15 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-08-28 16:15 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
2007-08-28 16:15 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
 
(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\program Files\Windows Sidebar\sidebar.exe" [2006-11-12 11:00 1248768]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-28 20:33 68856]
"Signature"="C:\Windows\Drive\sign.exe" [2006-11-11 17:34 435200]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2004-10-27 10:05 823361]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 16:32 221184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Signature"="C:\Windows\Drive\sign.exe" [2006-11-11 17:34 435200]
"DefragTaskBar"="C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe" [2007-08-28 16:31 169312]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"Cloneur Expert Monitor"="C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2008-02-12 20:54 437675]
"Acronis Scheduler2 Service"="C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2008-02-12 20:54 61440]
 
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"3D"="C:\program Files\Topdesk\topdesk.exe" [2006-11-06 17:50 195584]
"Vistadrv"="C:\Windows\Drive\vsdrv.exe" [2006-07-30 02:37 121089]
"Signature"="C:\Windows\Drive\sign.exe" [2006-11-11 17:34 435200]
"UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2006-11-11 17:34 241664]
"Horlorge"="C:\program Files\Clock\Clock.exe" [2006-11-11 17:32 142848]
"Sidebar"="C:\program Files\Windows Sidebar\sidebar.exe" [2006-11-12 11:00 1248768]
 
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide3"="cmd.exe" [2006-10-24 22:28 403968 C:\WINDOWS\system32\cmd.exe]
 
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Vistadrv"=C:\Windows\Drive\vsdrv.exe
"Horlorge"=C:\program Files\Clock\Clock.exe
"UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe"
"3D"=C:\program Files\Topdesk\topdesk.exe
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Vistadrv"=C:\WINDOWS\Drive\vsdrv.exe
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"NeroFilterCheck"=C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe
"WOOWATCH"=C:\PROGRA~1\Wanadoo\Watch.exe
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe
 
R1 DCDisk;DCDisk;C:\WINDOWS\system32\drivers\DCDisk.sys [2005-09-14 10:25]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:55]
S0 gcxyvhse;gcxyvhse;C:\WINDOWS\system32\drivers\bdlsqzik.dat []
S3 exdisk;Express Disk Service;C:\WINDOWS\system32\DRIVERS\exdisk.sys []
S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187B.sys []
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys []
S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys []
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-01-23 21:34]
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
 
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-15 16:17:53 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************
 
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-22 20:59:55
Windows 5.1.2600 Service Pack 2 NTFS
 
Balayage processus cach‚s ...
 
Balayage cach‚ autostart entries ...
 
Balayage des fichiers cach‚s ...
 
Scan termin‚ avec succŠs  
Les fichiers cach‚s: 0  
 
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\{32EDBFE3-5EE4-4472-BA89-ACB6D3BF9EAF}\sign.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-22 21:02:47 - machine was rebooted
ComboFix-quarantined-files.txt  2008-02-22 20:02:42
.
2008-02-13 22:26:31 --- E O F ---  

pardon je ne l'avais pas mis sur le bureau
 
rectif peut être identique :
 
omboFix 08-02-22 - Administrateur 2008-02-22 21:18:39.13 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.1.1036.18.479 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
 
[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.
 
(((((((((((((((((((((((((((((   Fichiers créés 2008-01-22 to 2008-02-22  ))))))))))))))))))))))))))))))))))))
.
 
2008-02-21 18:24 . 2008-02-21 18:24 <REP> d-------- C:\Program Files\Softwin
2008-02-20 20:52 . 2008-02-20 20:52 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-20 20:52 . 2008-02-20 20:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-20 20:48 . 2008-02-21 18:23 <REP> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-20 20:48 . 2008-02-20 20:48 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-20 20:48 . 2008-02-20 20:48 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-20 19:02 . 2008-02-20 19:31 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-02-20 18:57 . 2008-02-20 18:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-02-20 18:40 . 2008-02-20 18:40 712,704 --a------ C:\WINDOWS\system32\rlph.dll
2008-02-20 18:25 . 2003-05-07 19:01 8,464 --a------ C:\WINDOWS\system32\sporder.dll
2008-02-20 18:23 . 2008-02-20 18:23 40,724 --a------ C:\WINDOWS\system32\rightonadz-uninst.exe
2008-02-19 19:01 . 2008-02-19 19:01 <REP> d-------- C:\Sierra
2008-02-19 19:00 . 1998-10-29 15:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-15 13:27 . 2008-02-15 13:27 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-02-12 21:07 . 2008-02-12 21:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Micro Application
2008-02-12 20:54 . 2008-02-12 20:54 <REP> d-------- C:\Program Files\Micro Application
2008-02-12 20:54 . 2008-02-12 20:54 <REP> d-------- C:\Program Files\Fichiers communs\Acronis
2008-02-12 20:54 . 2008-02-12 20:54 210,400 --a------ C:\WINDOWS\system32\drivers\timntr.sys
2008-02-12 20:54 . 2008-02-12 20:54 126,976 --a------ C:\WINDOWS\system32\snapapi.dll
2008-02-12 20:54 . 2008-02-12 20:54 81,280 --a------ C:\WINDOWS\system32\drivers\snapman.sys
2008-02-12 20:54 . 2008-02-12 20:54 37,888 --a------ C:\WINDOWS\system32\setupnt.dll
2008-02-12 20:54 . 2008-02-12 20:54 28,768 --a------ C:\WINDOWS\system32\drivers\tifsfilt.sys
2008-02-10 20:51 . 2008-02-10 20:51 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-10 19:41 . 2008-02-10 19:42 <REP> d-------- C:\Program Files\Any Video Converter Professional
2008-02-04 14:21 . 2008-02-04 14:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-02-04 14:21 . 2008-02-10 22:14 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Azureus
2008-02-04 14:20 . 2008-02-04 14:21 <REP> d-------- C:\Program Files\Azureus
2008-01-31 21:30 . 2008-01-31 21:30 <REP> d-------- C:\Documents and Settings\Administrateur\Temp
2008-01-29 20:38 . 2008-01-29 20:38 <REP> d-------- C:\Program Files\Ashampoo
2008-01-29 20:38 . 2008-01-29 20:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Ashampoo
2008-01-28 18:05 . 2008-02-13 12:27 <REP> d-------- C:\Program Files\SUPERAntiSpyware
2008-01-28 18:05 . 2008-01-28 18:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-28 18:05 . 2008-01-28 18:05 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com
2008-01-23 21:34 . 2008-01-23 21:34 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\TuneUp Software
2008-01-23 21:33 . 2008-01-23 21:34 <REP> d-------- C:\Program Files\TuneUp Utilities 2008
2008-01-23 21:33 . 2008-01-28 18:04 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-01-23 21:33 . 2008-01-23 21:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-01-23 21:33 . 2008-01-23 21:34 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-01-23 21:33 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
 
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-22 20:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-22 19:59 --------- d-----w C:\Program Files\Wanadoo
2008-02-21 19:12 --------- d-----w C:\Program Files\Trend Micro
2008-02-21 17:24 --------- d-----w C:\Program Files\Fichiers communs\Softwin
2008-01-23 20:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-18 14:14 --------- d-----w C:\Program Files\CFWebAdvancedU
2008-01-17 20:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-13 15:40 --------- d-----w C:\Program Files\DivX
2008-01-12 14:15 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\vlc
2008-01-03 21:31 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\CamfrogWEB
2008-01-02 15:04 --------- d-----w C:\Program Files\CFWebAdvancedU_BOBTV.FR
2007-12-27 17:25 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\LimeWire
2007-12-21 14:39 10,752 ----a-w C:\WINDOWS\system32\WhoisCL.exe
2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-28 16:48 19,960 ----a-w C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
2007-08-30 15:50 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
2006-07-29 17:18 112 --sha-w C:\WINDOWS\Drive\unistl.cmd
2007-08-28 16:15 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-08-28 16:15 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
2007-08-28 16:15 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
 
(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\program Files\Windows Sidebar\sidebar.exe" [2006-11-12 11:00 1248768]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-28 20:33 68856]
"Signature"="C:\Windows\Drive\sign.exe" [2006-11-11 17:34 435200]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2004-10-27 10:05 823361]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 16:32 221184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Signature"="C:\Windows\Drive\sign.exe" [2006-11-11 17:34 435200]
"DefragTaskBar"="C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe" [2007-08-28 16:31 169312]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"Cloneur Expert Monitor"="C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [2008-02-12 20:54 437675]
"Acronis Scheduler2 Service"="C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [2008-02-12 20:54 61440]
 
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"3D"="C:\program Files\Topdesk\topdesk.exe" [2006-11-06 17:50 195584]
"Vistadrv"="C:\Windows\Drive\vsdrv.exe" [2006-07-30 02:37 121089]
"Signature"="C:\Windows\Drive\sign.exe" [2006-11-11 17:34 435200]
"UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2006-11-11 17:34 241664]
"Horlorge"="C:\program Files\Clock\Clock.exe" [2006-11-11 17:32 142848]
"Sidebar"="C:\program Files\Windows Sidebar\sidebar.exe" [2006-11-12 11:00 1248768]
 
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide3"="cmd.exe" [2006-10-24 22:28 403968 C:\WINDOWS\system32\cmd.exe]
 
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Vistadrv"=C:\Windows\Drive\vsdrv.exe
"Horlorge"=C:\program Files\Clock\Clock.exe
"UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe"
"3D"=C:\program Files\Topdesk\topdesk.exe
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Vistadrv"=C:\WINDOWS\Drive\vsdrv.exe
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"NeroFilterCheck"=C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe
"WOOWATCH"=C:\PROGRA~1\Wanadoo\Watch.exe
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe
 
R1 DCDisk;DCDisk;C:\WINDOWS\system32\drivers\DCDisk.sys [2005-09-14 10:25]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:55]
S0 gcxyvhse;gcxyvhse;C:\WINDOWS\system32\drivers\bdlsqzik.dat []
S3 exdisk;Express Disk Service;C:\WINDOWS\system32\DRIVERS\exdisk.sys []
S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187B.sys []
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys []
S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys []
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-01-23 21:34]
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
 
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-15 16:17:53 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************
 
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-22 21:20:02
Windows 5.1.2600 Service Pack 2 NTFS
 
Balayage processus cachés ...
 
Balayage caché autostart entries ...
 
Balayage des fichiers cachés ...
 
Scan terminé avec succès  
Les fichiers cachés: 0  
 
**************************************************************************
.
Temps d'accomplissement: 2008-02-22 21:20:46
ComboFix-quarantined-files.txt  2008-02-22 20:20:31
ComboFix2.txt  2008-02-22 20:02:48
.
2008-02-13 22:26:31 --- E O F ---  

Re ,
 
Séléctionne l'encadré ci dessous en entier , puis clique droit , choisis Copier

Colle le dans le Bloc-Notes
Enregistre le sur ton Bureau et nomme le CFScript ( type fichier texte )
Fait glisser le fichier CFScript sur le fichier ComboFix.exe comme ceci :
 

 
Un menu va apparaitre , tape 1 puis valide
Laisse faire le scan et poste le rapport généré ( C:\ComboFix.txt )
 

re,
 
ComboFix 08-02-22 - Administrateur 2008-02-22 22:35:57.14 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.1.1036.18.602 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrateur\Bureau\CFScript.txt
 * Création d'un nouveau point de restauration
 
[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
 
FILE ::
C:\WINDOWS\system32\drivers\bdlsqzik.dat
C:\WINDOWS\system32\rightonadz-uninst.exe
C:\WINDOWS\system32\rlph.dll
.
 
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
 
C:\WINDOWS\system32\rightonadz-uninst.exe
C:\WINDOWS\system32\rlph.dll
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
 
.
-------\LEGACY_GCXYVHSE
-------\gcxyvhse
 
 
(((((((((((((((((((((((((((((   Fichiers cr‚‚s 2008-01-22 to 2008-02-22  ))))))))))))))))))))))))))))))))))))
.
 
2008-02-21 18:24 . 2008-02-21 18:24 <REP> d-------- C:\Program Files\Softwin
2008-02-20 20:52 . 2008-02-20 20:52 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-20 20:52 . 2008-02-20 20:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-20 20:48 . 2008-02-21 18:23 <REP> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-20 20:48 . 2008-02-20 20:48 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-20 20:48 . 2008-02-20 20:48 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-20 19:02 . 2008-02-20 19:31 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-02-20 18:57 . 2008-02-20 18:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-02-20 18:25 . 2003-05-07 19:01 8,464 --a------ C:\WINDOWS\system32\sporder.dll
2008-02-19 19:01 . 2008-02-19 19:01 <REP> d-------- C:\Sierra
2008-02-19 19:00 . 1998-10-29 15:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-15 13:27 . 2008-02-15 13:27 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-02-12 21:07 . 2008-02-12 21:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Micro Application
2008-02-12 20:54 . 2008-02-12 20:54 <REP> d-------- C:\Program Files\Micro Application
2008-02-12 20:54 . 2008-02-12 20:54 <REP> d-------- C:\Program Files\Fichiers communs\Acronis
2008-02-12 20:54 . 2008-02-12 20:54 210,400 --a------ C:\WINDOWS\system32\drivers\timntr.sys
2008-02-12 20:54 . 2008-02-12 20:54 126,976 --a------ C:\WINDOWS\system32\snapapi.dll
2008-02-12 20:54 . 2008-02-12 20:54 81,280 --a------ C:\WINDOWS\system32\drivers\snapman.sys
2008-02-12 20:54 . 2008-02-12 20:54 37,888 --a------ C:\WINDOWS\system32\setupnt.dll
2008-02-12 20:54 . 2008-02-12 20:54 28,768 --a------ C:\WINDOWS\system32\drivers\tifsfilt.sys
2008-02-10 20:51 . 2008-02-10 20:51 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-10 19:41 . 2008-02-10 19:42 <REP> d-------- C:\Program Files\Any Video Converter Professional
2008-02-04 14:21 . 2008-02-04 14:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-02-04 14:21 . 2008-02-10 22:14 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Azureus
2008-02-04 14:20 . 2008-02-04 14:21 <REP> d-------- C:\Program Files\Azureus
2008-01-31 21:30 . 2008-01-31 21:30 <REP> d-------- C:\Documents and Settings\Administrateur\Temp
2008-01-29 20:38 . 2008-01-29 20:38 <REP> d-------- C:\Program Files\Ashampoo
2008-01-29 20:38 . 2008-01-29 20:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Ashampoo
2008-01-28 18:05 . 2008-02-13 12:27 <REP> d-------- C:\Program Files\SUPERAntiSpyware
2008-01-28 18:05 . 2008-01-28 18:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-28 18:05 . 2008-01-28 18:05 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SUPERAntiSpyware.com
2008-01-23 21:34 . 2008-01-23 21:34 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\TuneUp Software
2008-01-23 21:33 . 2008-01-23 21:34 <REP> d-------- C:\Program Files\TuneUp Utilities 2008
2008-01-23 21:33 . 2008-01-28 18:04 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-01-23 21:33 . 2008-01-23 21:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-01-23 21:33 . 2008-01-23 21:34 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-01-23 21:33 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
 
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-22 21:41 --------- d-----w C:\Program Files\Wanadoo
2008-02-22 20:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-21 19:12 --------- d-----w C:\Program Files\Trend Micro
2008-02-21 17:24 --------- d-----w C:\Program Files\Fichiers communs\Softwin
2008-01-23 20:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-18 14:14 --------- d-----w C:\Program Files\CFWebAdvancedU
2008-01-17 20:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-13 15:40 --------- d-----w C:\Program Files\DivX
2008-01-12 14:15 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\vlc
2008-01-03 21:31 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\CamfrogWEB
2008-01-02 15:04 --------- d-----w C:\Program Files\CFWebAdvancedU_BOBTV.FR
2007-12-27 17:25 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\LimeWire
2007-12-21 14:39 10,752 ----a-w C:\WINDOWS\system32\WhoisCL.exe
2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-28 16:48 19,960 ----a-w C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
2007-08-30 15:50 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
2006-07-29 17:18 112 --sha-w C:\WINDOWS\Drive\unistl.cmd
2007-08-28 16: