Salut tout le monde

j'ai un petit soucis de contamination et n'arrive pas à m'en débarrasser, si quelqu'un pouvait m'aider ce serait trop cool.
Je vous explique: j'étais sous Win XP et Avast m'a détecté une infection, j'ai donc voulu formater et j'ai installer Win Vista SP1, seulement il ne m'a pas formaté mon ancienne partition XP mais me l'a mise dans un dossier Old Windows ( ) que j'ai supprimé mais le virus est toujours là.
J'ai donc un grand besoin de votre aide.
Merci d'avance.

PS: j'ai vu sur le forum, une méthode pour supprimer ce virus mais ne sait pas si elle est adaptée pour tous les PC.

Je viens de scanner mon PC avec HIjackThis et voici le rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:45:56, on 04/04/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\SOUNDMAN.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\qommllk.dll,#1
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Johnny\AppData\Local\Temp\ddccc.dll,#1
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Johnny\AppData\Local\Temp\gebcb.dll,c
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\Johnny\AppData\Local\Temp\lgydntgo.dll",run
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activ [...] stubie.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll
O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DesktopControlPanel.dll
O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

--
End of file - 6931 bytes

Aider moi à comprendre

Désactive l'UAC ( Menu Démarrer \ Panneau de Configuration \ Comptes d'utilisateurs et protection des utilisateurs \ Comptes d'utilisateurs \ Activer ou désactiver le contrôle des comptes d'utilisateurs \ décoche la case Utiliser le contrôle ...
et valide par OK , il te sera demandé de redémarrer, fais le )

Tu es infecté(e) par "Vundo". Supprime tous les cracks de ton PC s'ils sont présents car sinon ils relanceront l'infection.

Télécharge Vundofix (par Atribune) sur ton Bureau.

• Double-clique VundoFix.exe afin de le lancer
• Clique sur le bouton Scan for Vundo
• Lorsque le scan est complété, clique sur le bouton Remove Vundo
• Une invite te demandera si tu veux supprimer les fichiers, clique YES
• Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
• Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
• Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-dessus, à partir de "clique sur le bouton Scan for Vundo".

N.B : Il se peut que vundofix ne détecte rien, dans ce cas-là pas de rapport nécessaire, dis-moi juste qu'il n'a rien trouvé.

Le problème c'est que je n'arrive pas à avoir accès au compte utilisateur du panneau de configuration. Je vais essayer de redémarrer pour voir si c'est mieux. Je re tout de suite.

SUITE je suis obligé d'utiliser un deuxième PC car le mieux refuse de télécharger le VundoFix (Mozilla s'arrête à chaque fois)

Je fais ce que tu m'as dit et envoie les rapports de suite. Merci de ton aide

Re,

Ah oui c'est possible que tu ne puisses pas accéder au panneau de configuration, c'est dû à ton infection. Ne lance pas vundofix si l'uac n'est pas désactivée.

Tiens-moi au courant, d'autant plus qu'il y a de nombreuses façons de procéder.

je viens juste de terminer l'analyse. Voici les rapports.

D'abord celui de Vundofix

VundoFix V7.0.3

Scan started at 20:46:31 04/04/2008

Listing files found while scanning....

C:\windows\System32\awvtq.dll
C:\windows\System32\jkhff.dll

Beginning removal...

Ensuite celui de HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:03:14, on 05/04/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\SOUNDMAN.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54C6DA23-73E7-419F-BB09-7C3C5C900A3C} - C:\Users\Johnny\AppData\Local\Temp\gebcb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: (no name) - {E81140A0-A25D-4F62-8CC6-0057824A05E8} - (no file)
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\pmkji.dll,#1
O4 - HKLM\..\Run: [8c8dce17] rundll32.exe "C:\Users\Johnny\AppData\Local\Temp\roqjovbc.dll",b
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Johnny\AppData\Local\Temp\ddccc.dll,#1
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Johnny\AppData\Local\Temp\gebcb.dll,c
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\Johnny\AppData\Local\Temp\lgydntgo.dll",run
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activ [...] stubie.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll
O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DesktopControlPanel.dll
O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

--
End of file - 7281 bytes

En espérant que ça t'aide à y voir clair sur ma contamination.

Par contre, j'ai 2 PC reliés en réseaux sur celui-là. Est-ce qu'ils ont pû être contaminés eux aussi?

Re,

Toujours avec l'uac désactivée !

Désactive toute protection résidente ( antivirus…) !
Déconnecte-toi d’internet, ferme tous les programmes en cours et laisse combofix travailler : ne fais donc pas autre chose en même temps !

Télécharge Combofix de sUBs
Sauvegarde le sur ton bureau et pas ailleurs !
Redémarre en mode sans échecs : aide ici >>>
http://forum.telecharger.01net.com [...] ges-1.html
/!\ Ne jamais redémarrer en mode sans échec via msconfig ! /!\

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport. Il se trouve ici : C:\Combofix.txt

Alors voici le rapport de ComboFix:

ComboFix 08-04-04.1 - Johnny 2008-04-05 13:08:33.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Édition Intégrale 6.0.6001.1.1252.1.1036.18.1231 [GMT 2:00]
Endroit: C:\Users\Johnny\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\pskt.ini
C:\Windows\system32\jkhff.dll
C:\Windows\system32\khcqwbam.dll
C:\Windows\system32\luovwxjl.dll
C:\Windows\System32\mabwqchk.ini
C:\Windows\system32\pmkji.dll
C:\Windows\system32\xqxewnqx.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-05 to 2008-04-05 ))))))))))))))))))))))))))))))))))))
.

2008-04-05 00:29 . 2008-04-05 00:29 38 --a------ C:\Windows\avisplitter.INI
2008-04-04 23:53 . 2008-04-04 23:53 24,576 --a------ C:\Windows\System32\VundoFixSVC.exe
2008-04-04 23:42 . 2008-04-04 23:42 <REP> dr------- C:\Users\Mcx1\Searches
2008-04-04 20:46 . 2008-04-05 04:00 <REP> d-------- C:\VundoFix Backups
2008-04-04 18:43 . 2008-04-04 18:43 <REP> d-------- C:\Program Files\Trend Micro
2008-04-04 03:15 . 2008-04-04 03:17 <REP> d-------- C:\Program Files\Panda Security
2008-04-04 03:00 . 2008-04-04 03:02 <REP> d-------- C:\Users\Johnny\.housecall6.6
2008-04-04 02:59 . 2008-04-04 02:59 507,904 --a------ C:\Windows\TMUPDATE.DLL
2008-04-04 02:59 . 2008-04-04 02:59 286,720 --a------ C:\Windows\PATCH.EXE
2008-04-04 02:59 . 2008-04-04 02:59 69,689 --a------ C:\Windows\UNZIP.DLL
2008-04-03 21:58 . 2008-04-03 21:58 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-04-03 21:42 . 2008-04-03 21:42 <REP> d-------- C:\Program Files\WinISO
2008-04-03 21:09 . 2008-04-03 21:41 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-04-03 21:09 . 2008-04-03 21:41 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-04-03 21:09 . 2008-04-03 21:09 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-03 03:53 . 2008-04-03 03:53 <REP> d-------- C:\Users\All Users\Elaborate Bytes
2008-04-03 03:53 . 2008-04-03 03:53 <REP> d-------- C:\ProgramData\Elaborate Bytes
2008-04-03 02:48 . 2008-04-03 02:48 <REP> d-------- C:\Program Files\Elaborate Bytes
2008-04-03 00:39 . 2008-04-03 00:39 <REP> d-------- C:\Users\All Users\SlySoft
2008-04-03 00:39 . 2008-04-03 00:39 <REP> d-------- C:\ProgramData\SlySoft
2008-04-03 00:33 . 2008-04-03 04:06 <REP> d-------- C:\Program Files\SlySoft
2008-04-03 00:33 . 2008-04-03 03:53 48 ---hs---- C:\Windows\S067C957E.tmp
2008-04-03 00:24 . 2008-04-03 00:24 <REP> d-------- C:\Users\Johnny\AppData\Roaming\DVDFab
2008-04-02 22:06 . 2008-04-02 22:06 <REP> d-------- C:\Program Files\Learning Essentials
2008-04-02 18:56 . 2008-04-02 18:56 <REP> d-------- C:\Program Files\Lavalys
2008-04-02 18:37 . 2006-11-02 12:23 <REP> dr------- C:\Users\Mcx1\Videos
2008-04-02 18:37 . 2006-11-02 12:23 <REP> d-------- C:\Users\Mcx1\Saved Games
2008-04-02 18:37 . 2006-11-02 12:23 <REP> dr------- C:\Users\Mcx1\Pictures
2008-04-02 18:37 . 2006-11-02 12:23 <REP> dr------- C:\Users\Mcx1\Music
2008-04-02 18:37 . 2006-11-02 12:23 <REP> dr------- C:\Users\Mcx1\Links
2008-04-02 18:37 . 2006-11-02 12:23 <REP> dr------- C:\Users\Mcx1\Downloads
2008-04-02 18:37 . 2008-04-02 18:37 <REP> dr------- C:\Users\Mcx1\Documents
2008-04-02 18:37 . 2008-04-02 18:38 <REP> d--h----- C:\Users\Mcx1\AppData
2008-04-02 16:05 . 2008-04-02 16:05 <REP> d-------- C:\Users\All Users\Stardock
2008-04-02 16:05 . 2008-04-02 16:05 <REP> d-------- C:\ProgramData\Stardock
2008-04-02 16:05 . 2008-04-02 16:05 <REP> d-------- C:\Program Files\Stardock
2008-04-02 13:06 . 2008-04-02 22:31 <REP> d-------- C:\Program Files\Microsoft Etudes
2008-04-02 13:05 . 2005-05-26 15:34 2,297,552 --a------ C:\Windows\System32\d3dx9_26.dll
2008-04-02 12:16 . 2008-04-02 16:19 <REP> d-------- C:\Users\All Users\NVIDIA
2008-04-02 12:16 . 2008-04-02 16:19 <REP> d-------- C:\ProgramData\NVIDIA
2008-04-02 12:13 . 2008-04-02 15:35 145,968,559 --a------ C:\Windows\MEMORY.DMP
2008-04-02 03:35 . 2007-07-20 01:55 233,888 --a------ C:\Windows\System32\DreamScene.dll
2008-04-02 03:33 . 2008-04-02 03:33 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-04-02 03:32 . 2007-12-11 17:06 1,073,152 --a------ C:\Windows\System32\nvcpluir.dll
2008-04-02 03:32 . 2007-12-11 17:06 753,664 --a------ C:\Windows\System32\nvcplui.exe
2008-04-02 03:32 . 2007-12-11 17:06 413,696 --a------ C:\Windows\System32\nvcpl.cpl
2008-04-02 03:32 . 2007-12-11 17:06 307,200 --a------ C:\Windows\System32\nvexpbar.dll
2008-04-02 03:30 . 2008-04-02 03:30 <REP> d-------- C:\Program Files\BitLocker
2008-04-02 03:29 . 2007-02-22 04:26 1,171,848 --a------ C:\Windows\System32\SecureKeyBackupCPL.dll
2008-04-02 03:29 . 2008-03-12 22:21 678,408 --a------ C:\Windows\System32\gpprefcl.dll
2008-04-02 03:29 . 2006-12-21 02:58 711 --a------ C:\Windows\System32\CPSOKBTasks.xml
2008-04-02 03:20 . 2008-04-02 03:20 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2008-04-02 02:25 . 2008-04-02 02:27 <REP> d-------- C:\Users\All Users\Adobe
2008-04-02 02:24 . 2008-04-02 02:24 <REP> d-------- C:\Program Files\Common Files\Adobe
2008-04-01 22:50 . 2008-04-01 22:50 <REP> d-------- C:\Program Files\Microsoft Works
2008-04-01 22:47 . 2008-04-01 22:47 <REP> d-------- C:\Program Files\Microsoft.NET
2008-04-01 22:39 . 2008-04-01 22:39 <REP> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-04-01 22:34 . 2008-04-02 03:37 <REP> d-------- C:\Users\All Users\Microsoft Help
2008-04-01 22:34 . 2008-04-02 03:37 <REP> d-------- C:\ProgramData\Microsoft Help
2008-04-01 22:30 . 2008-04-01 22:30 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-04-01 22:25 . 2008-04-01 22:25 717,296 --a------ C:\Windows\System32\drivers\sptd.sys
2008-04-01 22:24 . 2008-04-01 22:24 <REP> d-------- C:\Users\Johnny\AppData\Roaming\DAEMON Tools
2008-04-01 22:18 . 2008-04-01 22:18 <REP> d-------- C:\Users\Johnny\AppData\Roaming\PeerNetworking
2008-04-01 21:51 . 2008-04-01 21:51 <REP> d-------- C:\Users\All Users\CyberLink
2008-04-01 21:51 . 2008-04-01 21:51 <REP> d-------- C:\ProgramData\CyberLink
2008-04-01 21:49 . 2008-04-01 21:49 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2008-04-01 21:49 . 2008-04-01 21:49 <REP> d-------- C:\Program Files\CyberLink
2008-04-01 21:48 . 2008-04-02 15:54 <REP> d-------- C:\Program Files\Common Files\InstallShield
2008-04-01 21:31 . 2008-04-01 21:31 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-04-01 21:23 . 2008-04-01 21:23 <REP> d-------- C:\Users\All Users\IncrediMail
2008-04-01 21:23 . 2008-04-01 21:35 <REP> d-------- C:\Users\All Users\IM
2008-04-01 21:23 . 2008-04-01 21:23 <REP> d-------- C:\ProgramData\IncrediMail
2008-04-01 21:23 . 2008-04-01 21:35 <REP> d-------- C:\ProgramData\IM
2008-04-01 21:20 . 2006-10-12 03:10 49,265 --a------ C:\Windows\System32\jpicpl32.cpl
2008-04-01 21:19 . 2008-04-01 21:20 <REP> d-------- C:\Program Files\Java
2008-04-01 21:19 . 2008-04-01 21:19 <REP> d-------- C:\Program Files\Common Files\Java
2008-04-01 21:18 . 2008-04-01 21:18 <REP> d-------- C:\Windows\System32\Macromed
2008-04-01 21:15 . 2008-04-01 21:15 <REP> d-------- C:\Windows\PCHEALTH
2008-04-01 21:12 . 2008-04-05 00:21 <REP> d-------- C:\Users\Johnny\AppData\Roaming\uTorrent
2008-04-01 21:12 . 2008-04-01 21:50 <REP> d-------- C:\Program Files\uTorrent
2008-04-01 21:06 . 2008-04-01 21:13 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-01 21:05 . 2008-04-04 03:17 <REP> d--hs---- C:\Windows\Installer
2008-04-01 21:05 . 2008-04-01 21:05 <REP> d-------- C:\Users\All Users\WLInstaller
2008-04-01 21:05 . 2008-04-01 21:05 <REP> d-------- C:\ProgramData\WLInstaller
2008-04-01 20:57 . 2008-04-01 20:57 <REP> d-------- C:\Users\Johnny\AppData\Roaming\InstallShield
2008-04-01 20:56 . 2006-10-13 00:00 61,952 --a------ C:\Windows\System32\escwiad.dll
2008-04-01 20:53 . 2008-04-01 20:56 <REP> d-------- C:\Program Files\EPSON
2008-04-01 20:53 . 2004-11-25 05:07 79,679 --a------ C:\Windows\System32\E_FLMACE.DLL
2008-04-01 20:53 . 2003-05-21 02:27 64,000 --a------ C:\Windows\System32\E_FBCBACE.DLL
2008-04-01 20:53 . 2004-09-10 20:12 49,152 --a------ C:\Windows\System32\E_DCINST.DLL
2008-04-01 20:53 . 2000-06-07 01:01 34,304 --a------ C:\Windows\System32\E_FBCHACE.DLL
2008-04-01 20:42 . 2008-04-01 20:42 71 --a------ C:\Windows\SBWIN.INI
2008-04-01 20:41 . 1998-10-29 16:45 306,688 --a------ C:\Windows\IsUninst.exe
2008-04-01 20:40 . 1999-01-21 11:35 8,292,462 --------- C:\Windows\System32\drivers\Eapci8m.Ecw
2008-04-01 20:40 . 1999-01-21 11:33 4,987,002 --------- C:\Windows\System32\drivers\Eapci4m.Ecw
2008-04-01 20:39 . 2008-04-01 20:41 <REP> d-------- C:\Program Files\Creative
2008-04-01 20:39 . 1999-01-21 11:31 2,259,070 --a------ C:\Windows\System32\drivers\eapci2m.ecw
2008-04-01 20:39 . 2002-01-03 03:00 523,392 --a------ C:\Windows\System32\drivers\sbpci.sys
2008-04-01 20:39 . 1998-11-13 13:16 308,224 --a------ C:\Windows\IsUn040c.exe
2008-04-01 20:39 . 2000-07-31 03:00 130,048 --a------ C:\Windows\System32\ctpcir32.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-02 01:28 --------- d-----w C:\Program Files\Microsoft Games
2008-04-01 20:50 --------- d-----w C:\Program Files\MSBuild
2008-04-01 14:15 --------- d-sh--w C:\ProgramData\Modèles
2008-04-01 14:15 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-04-01 14:15 --------- d-sh--w C:\ProgramData\Favoris
2008-04-01 14:15 --------- d-sh--w C:\ProgramData\Documents
2008-04-01 14:15 --------- d-sh--w C:\ProgramData\Bureau
2008-04-01 14:15 --------- d-sh--w C:\ProgramData\Application Data
2008-04-01 14:15 --------- d-sh--w C:\Program Files\Fichiers communs
2008-03-29 17:35 20,560 ----a-w C:\Windows\system32\drivers\aswFsBlk.sys
2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-03-29 17:31 75,856 ----a-w C:\Windows\system32\drivers\aswSP.sys
2008-03-29 17:29 23,152 ----a-w C:\Windows\system32\drivers\aswRdr.sys
2008-03-29 17:27 42,912 ----a-w C:\Windows\system32\drivers\aswTdi.sys
2008-02-26 17:37 174 --sha-w C:\Program Files\desktop.ini
2008-02-26 17:31 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-26 17:31 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-02-26 17:31 --------- d-----w C:\Program Files\Windows Mail
2008-02-26 17:31 --------- d-----w C:\Program Files\Windows Journal
2008-02-26 17:31 --------- d-----w C:\Program Files\Windows Defender
2008-02-26 17:31 --------- d-----w C:\Program Files\Windows Collaboration
2008-02-26 17:31 --------- d-----w C:\Program Files\Windows Calendar
2008-02-26 16:50 --------- d--h--w C:\ProgramData\CanonBJ
2008-01-18 22:34 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-01-18 22:33 58,880 ----a-w C:\Windows\bfsvc.exe
2008-01-18 22:33 540,672 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-01-18 22:33 498,176 ----a-w C:\Windows\HelpPane.exe
2008-01-18 22:33 459,264 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-01-18 22:33 40,960 ----a-w C:\Windows\AppPatch\apihex86.dll
2008-01-18 22:33 237,568 ----a-w C:\Windows\AppPatch\AcRedir.dll
2008-01-18 22:33 2,927,104 ----a-w C:\Windows\explorer.exe
2008-01-18 22:33 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-01-18 22:33 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-01-18 22:33 151,040 ----a-w C:\Windows\notepad.exe
2008-01-18 22:33 134,656 ----a-w C:\Windows\regedit.exe
2008-01-18 22:33 13,312 ----a-w C:\Windows\fveupdate.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54C6DA23-73E7-419F-BB09-7C3C5C900A3C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9145FE93-4D85-4572-B8EA-03E32771BA10}]
2008-04-04 18:16 269312 --------- C:\Users\Johnny\AppData\Local\Temp\gebcb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E81140A0-A25D-4F62-8CC6-0057824A05E8}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 00:33 1233920]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [ ]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 00:33 125952]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 00:33 202240]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-03-07 05:26 1694656]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"MSServer"="C:\Users\Johnny\AppData\Local\Temp\ddccc.dll" [ ]
"cmds"="C:\Users\Johnny\AppData\Local\Temp\gebcb.dll" [2008-04-04 18:16 269312]
"MS Juan"="C:\Users\Johnny\AppData\Local\Temp\lgydntgo.dll" [2008-04-04 18:17 90176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 00:38 1008184]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"SoundMan"="SOUNDMAN.EXE" [2007-03-09 16:28 598016 C:\Windows\SOUNDMAN.EXE]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"msacm.ac3acm"= ac3acm.acm
"msacm.lameacm"= lameACM.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CreativeMixer]
C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-03-14 13:55 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Disc Detector]
C:\Program Files\Creative\ShareDLL\CtNotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX3800 Series]
--a------ 2005-02-08 04:00 98304 C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIACE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
C:\Program Files\IncrediMail\bin\IncMail.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 20:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{B24CA305-303F-43F2-8817-5D97D25EB139}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{79D89589-ED4F-41F7-BEDD-91CBA0091C48}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{FAC8D99A-0C80-4CB5-95A0-BC924E9DD0DA}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{23E647EB-052F-440D-ABAC-4EE2A1B5DDA2}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{EBBC6294-CDF1-47BD-8CA7-0202EB9EA52F}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{95CDA3DA-4773-4759-A131-7EDD09342839}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{3D116700-E403-49B2-8712-EF8009519B15}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{8D7B7354-6DA3-4915-9F5B-32152E4BABEF}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{8DDBC1E4-FECC-4986-B839-C6ED8006AFC9}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{470AC7BD-F2E2-4C79-851D-43730C09AAE8}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{E87C0E70-F858-4FBD-912B-4BC99A73B817}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{65943869-71CB-494A-A157-504314198487}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 11:43]
S3 UMPass;Pilote Microsoft UMPass;C:\Windows\system32\DRIVERS\umpass.sys [2008-01-18 22:53]
S3 yukonwlh;Pilote miniport NDIS6.0 pour contrôleur Ethernet Marvell Yukon;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 09:30]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
GPSvcGroup REG_MULTI_SZ GPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff95e7b4-0029-11dd-ab2b-000c6ef29557}]
\shell\AutoRun\command - L:\SETUP.EXE
\shell\configure\command - L:\SETUP.EXE
\shell\install\command - L:\SETUP.EXE

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-04-04 19:06:08 C:\Windows\Tasks\User_Feed_Synchronization-{F03C8A5F-541E-4B79-96C9-668E58818E3A}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-05 13:16:42
Windows 6.0.6001 Service Pack 1 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\system32\conime.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\DllHost.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-05 13:19:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-05 11:19:03
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Post-Run: 33,901,178,880 octets libres
.
2008-04-02 14:48:36 --- E O F ---


Par contre, je pense qu'il y a eu un problème lors de l'éxecution de celui-ci. Il ne m'a pas demandé de répondre par 1 et entrée avant l'analyse et lors de la suppression, Vista m'a fermé le programme et redémarrer.

Et un HiJackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:31:37, on 05/04/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\SOUNDMAN.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\Explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54C6DA23-73E7-419F-BB09-7C3C5C900A3C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9145FE93-4D85-4572-B8EA-03E32771BA10} - C:\Users\Johnny\AppData\Local\Temp\gebcb.dll (file missing)
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activ [...] stubie.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll
O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DesktopControlPanel.dll
O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

--
End of file - 6390 bytes

Re,

Désinstalle avast, redémarre et supprime ~~>C:\Program Files\Alwil Software

Télécharge ccleaner (>>tuto à lire !<<), tu download «the latest version » puis installe le en décochant - Ajouter la Barre d'Outils Yahoo! CCleaner
Puis lance le nettoyage, puis fais chercher des erreurs et sa