virus "qu'est ce que ta tof fait sur ce site"

Bonjour,

Merci d'éviter le sms.

Télécharge MSNFix.zip (!aur3n7) sur ton Bureau.
Décompresse-le sur ton bureau (Clique-Droit/Extraire tout).

Ouvre le dossier MSNFix puis double-clique sur MSNFix.bat.
- Exécute l'option R.
-- Si l'infection est détectée, presse une touche pour lancer le nettoyage.

Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations.
Dans ce cas il suffit de redémarrer l'ordinateur manuellement.

Poste le rapport situé dans le dossier MSNFix.
Le nom du rapport correspond au moment de sa création : date_heure.log

Re,

Désactive tes protections résidentes (antivirus, Spybot...) !

• Télécharge Combofix (sUBs) sur ton Bureau.
• Double clique sur combofix.exe afin de le lancer.
• Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

qu'est ce que je doit faire maintenant??

après avoir téléchargé malwarebyte's anti-malware j'ai éffectué la recherche. je poste donc mon rapport

ps: des infections été présente est ce grave si après avoir affiché les résultats je n'est pas "supprimer la sélection" si oui doi je recomancer la recherche?

le rapport:

Malwarebytes' Anti-Malware 1.09
Version de la base de données: 573

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|)
Eléments examinés: 80173
Temps écoulé: 1 hour(s), 17 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 26

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Typelib\{50ccd00a-66b6-4d95-aaef-8ee959498f92} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\BO1jiZmwnF2zhi (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stfngdvw.1 (Trojan.FakeAlert) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\QooBox\Quarantine\C\WINDOWS\mrofinu1423.exe.vir (Trojan.Downloader) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\mrofinu1423.MSNFix.vir (Trojan.Downloader) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\mrofinu881.exe.MSNFix.vir (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP161\A0018417.exe (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP162\A0018454.exe (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP162\A0018463.exe (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP166\A0018581.exe (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP170\A0018723.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP171\A0018754.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP171\A0018755.exe (Trojan.Insider) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP171\A0018767.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP174\A0019112.exe (Trojan.Insider) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP176\A0020197.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP177\A0020234.exe (Trojan.Insider) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP177\A0021186.exe (Trojan.Insider) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023359.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023373.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023379.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023382.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023400.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023564.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023577.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP183\A0023592.exe (Trojan.Downloader) -> No action taken.
C:\WINDOWS\b152.MSNFix (Trojan.Insider) -> No action taken.
C:\WINDOWS\system32\Services.cpi (Heuristics.Reserved.Word.Exploit) -> No action taken.
C:\WINDOWS\system32\Services.cpl (Heuristics.Reserved.Word.Exploit) -> No action taken.

oui je vien de le faire :s dsl!
j'ai donc tout recommancé en supprimant bien, cette foi, les selections!
voici le nouveau rapport:

Malwarebytes' Anti-Malware 1.09
Version de la base de données: 573

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|)
Eléments examinés: 80670
Temps écoulé: 23 minute(s), 19 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 26

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Typelib\{50ccd00a-66b6-4d95-aaef-8ee959498f92} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\BO1jiZmwnF2zhi (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stfngdvw.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\QooBox\Quarantine\C\WINDOWS\mrofinu1423.exe.vir (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\mrofinu1423.MSNFix.vir (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\mrofinu881.exe.MSNFix.vir (Trojan.DownLoader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP161\A0018417.exe (Trojan.DownLoader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP162\A0018454.exe (Trojan.DownLoader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP162\A0018463.exe (Trojan.DownLoader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP166\A0018581.exe (Trojan.DownLoader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP170\A0018723.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP171\A0018754.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP171\A0018755.exe (Trojan.Insider) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP171\A0018767.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP174\A0019112.exe (Trojan.Insider) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP176\A0020197.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP177\A0020234.exe (Trojan.Insider) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP177\A0021186.exe (Trojan.Insider) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023359.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023373.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023379.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023382.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023400.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023564.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP182\A0023577.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{152D6AE9-046E-40B4-89D7-90BC0B8A5A9C}\RP183\A0023592.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\b152.MSNFix (Trojan.Insider) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Services.cpi (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Services.cpl (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

voila:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:31:28, on 31/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.922\services.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Flash Media] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.922\services.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/mi [...] 8842505875
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mi [...] 8842494718
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 10665 bytes

Ouaip. Refais un scan Combofix.

voila:

ComboFix 08-04-01.2 - Administrateur 2008-04-01 21:47:17.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.441 [GMT 2:00]
Endroit: C:\Documents and Settings\Administrateur\Mes documents\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-03-01 to 2008-04-01 ))))))))))))))))))))))))))))))))))))
.

2008-03-31 19:04 . 2008-03-31 19:04 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-03-31 19:04 . 2008-03-31 19:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-31 19:04 . 2008-03-31 19:04 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-03-30 23:02 . 2008-03-30 23:02 244 --ah----- C:\sqmnoopt06.sqm
2008-03-30 23:02 . 2008-03-30 23:02 232 --ah----- C:\sqmdata06.sqm
2008-03-30 13:51 . 2008-03-30 13:51 <REP> d-------- C:\Program Files\Trend Micro
2008-03-30 01:54 . 2008-03-30 01:54 244 --ah----- C:\sqmnoopt05.sqm
2008-03-30 01:54 . 2008-03-30 01:54 232 --ah----- C:\sqmdata05.sqm
2008-03-27 23:53 . 2008-03-27 23:53 244 --ah----- C:\sqmnoopt04.sqm
2008-03-27 23:53 . 2008-03-27 23:53 232 --ah----- C:\sqmdata04.sqm
2008-03-24 15:47 . 2008-03-24 15:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-03-24 15:39 . 2008-03-24 17:04 <REP> d-------- C:\Documents and Settings\Administrateur\Contacts
2008-03-24 15:37 . 2008-03-31 18:26 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-03-24 15:14 . 2008-03-25 23:40 <REP> d-------- C:\Program Files\Windows Live
2008-03-16 15:43 . 2008-03-16 15:43 <REP> d-------- C:\Program Files\iTunes
2008-03-16 15:43 . 2008-03-16 15:43 <REP> d-------- C:\Program Files\iPod
2008-03-16 15:43 . 2008-03-23 20:55 <REP> d-------- C:\Program Files\Bonjour
2008-03-16 15:43 . 2008-03-24 16:33 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2008-03-16 15:43 . 2008-04-01 19:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-16 15:43 . 2008-03-16 15:44 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-16 15:42 . 2008-03-16 15:43 <REP> d-------- C:\Program Files\QuickTime
2008-03-16 15:42 . 2008-03-16 15:42 <REP> d-------- C:\Program Files\Fichiers communs\Apple
2008-03-16 15:42 . 2008-03-16 15:42 <REP> d-------- C:\Program Files\Apple Software Update
2008-03-16 15:42 . 2008-03-16 15:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-16 15:42 . 2008-03-16 15:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-03-08 00:45 . 2008-03-08 00:45 244 --ah----- C:\sqmnoopt03.sqm
2008-03-08 00:45 . 2008-03-08 00:45 232 --ah----- C:\sqmdata03.sqm
2008-03-06 14:57 . 2008-03-06 14:57 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-03-06 14:12 . 2008-03-06 14:12 244 --ah----- C:\sqmnoopt02.sqm
2008-03-06 14:12 . 2008-03-06 14:12 232 --ah----- C:\sqmdata02.sqm
2008-03-05 14:55 . 2008-03-05 14:55 244 --ah----- C:\sqmnoopt01.sqm
2008-03-05 14:55 . 2008-03-05 14:55 232 --ah----- C:\sqmdata01.sqm
2008-03-05 13:35 . 2008-03-05 13:39 <REP> d-------- C:\WINDOWS\system32\NtmsData
2008-03-04 20:27 . 2008-03-04 20:29 <REP> d-------- C:\Program Files\Microsoft Windows OneCare Live
2008-03-04 12:56 . 2008-03-04 12:56 244 --ah----- C:\sqmnoopt00.sqm
2008-03-04 12:56 . 2008-03-04 12:56 232 --ah----- C:\sqmdata00.sqm
2008-03-04 12:33 . 2008-03-04 12:33 0 --a------ C:\WINDOWS\system32\real.MSNFix
2008-03-03 22:10 . 2008-03-03 22:10 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
2008-03-03 16:43 . 2008-03-03 16:43 6,144 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-03-03 13:25 . 2008-03-03 13:25 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-03 13:15 . 2008-03-03 13:22 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-03-03 13:15 . 2008-03-24 15:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 17:27 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-03-30 11:10 --------- d-----w C:\Program Files\eMule
2008-03-24 13:05 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2008-03-09 15:19 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\dvdcss
2008-03-04 21:43 --------- d-----w C:\Program Files\Winamp
2008-03-04 21:43 --------- d-----w C:\Program Files\Motorola Phone Tools
2008-02-11 18:22 --------- d-----w C:\Program Files\Avanquest update
2008-02-06 18:24 --------- d-----w C:\Program Files\Lexmark X1100 Series
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-28 12:26 92,064 ----a-w C:\Documents and Settings\Administrateur\mqdmmdm.sys
2007-10-28 12:26 9,232 ----a-w C:\Documents and Settings\Administrateur\mqdmmdfl.sys
2007-10-28 12:26 79,328 ----a-w C:\Documents and Settings\Administrateur\mqdmserd.sys
2007-10-28 12:26 66,656 ----a-w C:\Documents and Settings\Administrateur\mqdmbus.sys
2007-10-28 12:26 6,208 ----a-w C:\Documents and Settings\Administrateur\mqdmcmnt.sys
2007-10-28 12:26 5,936 ----a-w C:\Documents and Settings\Administrateur\mqdmwhnt.sys
2007-10-28 12:26 4,048 ----a-w C:\Documents and Settings\Administrateur\mqdmcr.sys
2007-10-28 12:26 25,600 ----a-w C:\Documents and Settings\Administrateur\usbsermptxp.sys
2007-10-28 12:26 22,768 ----a-w C:\Documents and Settings\Administrateur\usbsermpt.sys
.

((((((((((((((((((((((((((((( snapshot@2008-03-30_17.13.31,37 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-29 23:53:59 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-03-30 21:02:27 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-03-29 23:53:59 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2008-03-30 21:02:27 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2008-03-29 23:53:59 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-03-30 21:02:27 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-30 22:48 68856]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-10-30 06:42 67128]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2005-12-15 14:00 30208]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2006-07-19 19:26 52896]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-11-14 15:51 125536]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53 153136]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 14:12 135168]
"YeppStudioAgent"="C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe" [2005-06-29 17:54 36864]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
"mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 14:12 53248]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 15:46 28160 C:\WINDOWS\KHALMNPR.Exe]
"Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 11:48 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2005-12-15 14:00 30208]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="cmd.exe" [2005-12-15 14:00 515072 C:\WINDOWS\system32\cmd.exe]
"nlhr"="C:\WINDOWS\System32\AdvPack.Dll" [2007-12-07 04:08 124928]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2005-12-15 14:00 44544]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-10-30 06:42:19 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-10-28 12:16:20 450560]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TClock.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\TClock.lnk
backup=C:\WINDOWS\pss\TClock.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-03-12 13:49 153136 C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2005-12-15 14:00 30208 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TaskSwitchXP]
--a------ 2005-08-24 23:11 61952 C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2003-12-13 02:50 33792 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\Rar$EX03.922\\services.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2005-12-15 14:00]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2008-01-15 22:47]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-03-27 17:33:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-14 16:15:00 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-01 21:48:40
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

? [1328]

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-01 21:49:11
ComboFix-quarantined-files.txt 2008-04-01 19:49:08
ComboFix2.txt 2008-03-30 15:13:48
Pre-Run: 27,274,047,488 octets libres
Post-Run: 27,265,138,688 octets libres
.
2008-03-25 21:40:25 --- E O F ---

rapport combofix:

ComboFix 08-04-01.2 - Administrateur 2008-04-01 22:40:38.5 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.499 [GMT 2:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrateur\Bureau\CFScript.txt..txt
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.922\services.exe

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-01 to 2008-04-01 ))))))))))))))))))))))))))))))))))))
.

2008-03-31 19:04 . 2008-03-31 19:04 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-03-31 19:04 . 2008-03-31 19:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-31 19:04 . 2008-03-31 19:04 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-03-30 23:02 . 2008-03-30 23:02 244 --ah----- C:\sqmnoopt06.sqm
2008-03-30 23:02 . 2008-03-30 23:02 232 --ah----- C:\sqmdata06.sqm
2008-03-30 13:51 . 2008-03-30 13:51 <REP> d-------- C:\Program Files\Trend Micro
2008-03-30 01:54 . 2008-03-30 01:54 244 --ah----- C:\sqmnoopt05.sqm
2008-03-30 01:54 . 2008-03-30 01:54 232 --ah----- C:\sqmdata05.sqm
2008-03-27 23:53 . 2008-03-27 23:53 244 --ah----- C:\sqmnoopt04.sqm
2008-03-27 23:53 . 2008-03-27 23:53 232 --ah----- C:\sqmdata04.sqm
2008-03-24 15:47 . 2008-03-24 15:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-03-24 15:39 . 2008-03-24 17:04 <REP> d-------- C:\Documents and Settings\Administrateur\Contacts
2008-03-24 15:37 . 2008-03-31 18:26 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-03-24 15:14 . 2008-03-25 23:40 <REP> d-------- C:\Program Files\Windows Live
2008-03-16 15:43 . 2008-03-16 15:43 <REP> d-------- C:\Program Files\iTunes
2008-03-16 15:43 . 2008-03-16 15:43 <REP> d-------- C:\Program Files\iPod
2008-03-16 15:43 . 2008-03-23 20:55 <REP> d-------- C:\Program Files\Bonjour
2008-03-16 15:43 . 2008-03-24 16:33 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2008-03-16 15:43 . 2008-04-01 22:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-16 15:43 . 2008-03-16 15:44 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-16 15:42 . 2008-03-16 15:43 <REP> d-------- C:\Program Files\QuickTime
2008-03-16 15:42 . 2008-03-16 15:42 <REP> d-------- C:\Program Files\Fichiers communs\Apple
2008-03-16 15:42 . 2008-03-16 15:42 <REP> d-------- C:\Program Files\Apple Software Update
2008-03-16 15:42 . 2008-03-16 15:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-16 15:42 . 2008-03-16 15:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-03-08 00:45 . 2008-03-08 00:45 244 --ah----- C:\sqmnoopt03.sqm
2008-03-08 00:45 . 2008-03-08 00:45 232 --ah----- C:\sqmdata03.sqm
2008-03-06 14:57 . 2008-03-06 14:57 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-03-06 14:12 . 2008-03-06 14:12 244 --ah----- C:\sqmnoopt02.sqm
2008-03-06 14:12 . 2008-03-06 14:12 232 --ah----- C:\sqmdata02.sqm
2008-03-05 14:55 . 2008-03-05 14:55 244 --ah----- C:\sqmnoopt01.sqm
2008-03-05 14:55 . 2008-03-05 14:55 232 --ah----- C:\sqmdata01.sqm
2008-03-05 13:35 . 2008-03-05 13:39 <REP> d-------- C:\WINDOWS\system32\NtmsData
2008-03-04 20:27 . 2008-03-04 20:29 <REP> d-------- C:\Program Files\Microsoft Windows OneCare Live
2008-03-04 12:56 . 2008-03-04 12:56 244 --ah----- C:\sqmnoopt00.sqm
2008-03-04 12:56 . 2008-03-04 12:56 232 --ah----- C:\sqmdata00.sqm
2008-03-04 12:33 . 2008-03-04 12:33 0 --a------ C:\WINDOWS\system32\real.MSNFix
2008-03-03 22:10 . 2008-03-03 22:10 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
2008-03-03 16:43 . 2008-03-03 16:43 6,144 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-03-03 13:25 . 2008-03-03 13:25 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-03 13:15 . 2008-03-03 13:22 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-03-03 13:15 . 2008-03-24 15:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 20:30 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-03-30 11:10 --------- d-----w C:\Program Files\eMule
2008-03-24 13:05 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2008-03-09 15:19 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\dvdcss
2008-03-04 21:43 --------- d-----w C:\Program Files\Winamp
2008-03-04 21:43 --------- d-----w C:\Program Files\Motorola Phone Tools
2008-02-11 18:22 --------- d-----w C:\Program Files\Avanquest update
2008-02-06 18:24 --------- d-----w C:\Program Files\Lexmark X1100 Series
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-28 12:26 92,064 ----a-w C:\Documents and Settings\Administrateur\mqdmmdm.sys
2007-10-28 12:26 9,232 ----a-w C:\Documents and Settings\Administrateur\mqdmmdfl.sys
2007-10-28 12:26 79,328 ----a-w C:\Documents and Settings\Administrateur\mqdmserd.sys
2007-10-28 12:26 66,656 ----a-w C:\Documents and Settings\Administrateur\mqdmbus.sys
2007-10-28 12:26 6,208 ----a-w C:\Documents and Settings\Administrateur\mqdmcmnt.sys
2007-10-28 12:26 5,936 ----a-w C:\Documents and Settings\Administrateur\mqdmwhnt.sys
2007-10-28 12:26 4,048 ----a-w C:\Documents and Settings\Administrateur\mqdmcr.sys
2007-10-28 12:26 25,600 ----a-w C:\Documents and Settings\Administrateur\usbsermptxp.sys
2007-10-28 12:26 22,768 ----a-w C:\Documents and Settings\Administrateur\usbsermpt.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-01_22.35.39,03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-01 20:43:07 40,960 ----a-w C:\WINDOWS\TEMP\rtdrvmon.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-30 22:48 68856]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-10-30 06:42 67128]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2005-12-15 14:00 30208]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2006-07-19 19:26 52896]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-11-14 15:51 125536]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53 153136]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 14:12 135168]
"YeppStudioAgent"="C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe" [2005-06-29 17:54 36864]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
"mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 14:12 53248]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 15:46 28160 C:\WINDOWS\KHALMNPR.Exe]
"Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 11:48 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2005-12-15 14:00 30208]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="cmd.exe" [2005-12-15 14:00 515072 C:\WINDOWS\system32\cmd.exe]
"nlhr"="C:\WINDOWS\System32\AdvPack.Dll" [2007-12-07 04:08 124928]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2005-12-15 14:00 44544]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TClock.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\TClock.lnk
backup=C:\WINDOWS\pss\TClock.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-03-12 13:49 153136 C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2005-12-15 14:00 30208 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TaskSwitchXP]
--a------ 2005-08-24 23:11 61952 C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2003-12-13 02:50 33792 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2005-12-15 14:00]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2008-01-15 22:47]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-27 17:33:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-14 16:15:00 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-01 22:43:10
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-01 22:45:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-01 20:45:00
ComboFix2.txt 2008-04-01 20:35:58
ComboFix3.txt 2008-04-01 20:28:29
Pre-Run: 27,283,660,800 octets libres
Post-Run: 27,287,179,264 octets libres
.
2008-03-25 21:40:25 --- E O F ---


et rapport hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:46:20, on 01/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/mi [...] 8842505875
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mi [...] 8842494718
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 10289 bytes

heu pour l'instent sa a l'air d'allé!! j'ai pas eu trop le temps d'allé sur msn mais je croise les doigts :s !!
je reposteré un mess si pas de changement!

merci bcp de m'avoir aidé et pour ta patience