Bonjour à tous,

Voila j'ai fais une c...rie et j'ai eu droit a virtumonde et Malwarecore qui ont bien été detecté par Spybot.

J'ai fait un nettoyage, mais au boot du PC spybot s'affole.

J'ai donc lancé HijackThis dont voici le rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:03:19, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\windows\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Eset\nod32krn.exe
C:\windows\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\windows\system32\PnkBstrA.exe
C:\windows\System32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\windows\system32\wscntfy.exe
C:\windows\system32\rundll32.exe
C:\Program Files\ULI5289\ULi5289.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\windows\CTHELPER.EXE
C:\windows\system32\CTXFIHLP.EXE
C:\Program Files\Eset\nod32kui.exe
C:\windows\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\windows\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\windows\system32\rundll32.exe
C:\windows\explorer.exe
C:\Documents and Settings\Fred\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.diskeeper.com/updates/u [...] atform=x86
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {3CCA2B40-4543-4038-BF9A-C8A8ED19789E} - C:\windows\system32\hgGvursQ.dll (file missing)
O2 - BHO: (no name) - {4EA844E3-F761-4B05-9FD2-ED8CCFB25C83} - C:\windows\system32\geBrrQih.dll (file missing)
O2 - BHO: (no name) - {522E0112-EDD9-413D-A99E-C311A54B6676} - C:\windows\system32\hgGaXOGa.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [ULiRaid5289] C:\Program Files\ULI5289\ULi5289.exe
O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [3cb391f8] rundll32.exe "C:\windows\system32\sqrktonf.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA1079] command /c del "C:\WINDOWS\system32\geBrrQih.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4097] cmd /c del "C:\WINDOWS\system32\geBrrQih.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6660] command /c del "C:\WINDOWS\system32\hgGvursQ.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7367] cmd /c del "C:\WINDOWS\system32\hgGvursQ.dll_old"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O18 - Protocol: bw+0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: awvvs - C:\WINDOWS\system32\awvvs.dll (file missing)
O20 - Winlogon Notify: hgGaXOGa - C:\windows\SYSTEM32\hgGaXOGa.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)

--
End of file - 24196 bytes


Merci de m'aider d'avance à finir de nettoyer mon PC

Merci de m'aider

Voici le rapport de combo fix

ComboFix 08-05-15.3 - Fred 2008-05-17 13:09:11.2 - NTFSx86 MINIMAL
Endroit: C:\Documents and Settings\Fred\Bureau\ComboFix.exe

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\windows\pskt.ini
C:\windows\system32\cvshvven.ini
C:\WINDOWS\system32\IhggOXyb.ini
C:\WINDOWS\system32\IhggOXyb.ini2
C:\windows\system32\nopVCcdd.ini
C:\WINDOWS\system32\nopVCcdd.ini2
C:\windows\system32\slmuseke.ini

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-17 to 2008-05-17 ))))))))))))))))))))))))))))))))))))
.

2008-05-17 13:03 . 2008-05-17 13:03 134,144 --a------ C:\WINDOWS\system32\iwlwmrns.dll
2008-05-17 13:00 . 2008-05-17 13:00 116,224 --a------ C:\WINDOWS\system32\ekesumls.dll
2008-05-17 12:55 . 2008-05-17 12:55 125,952 --a------ C:\WINDOWS\system32\ipejfejr.dll
2008-05-17 11:19 . 2008-05-17 11:19 134,144 --a------ C:\WINDOWS\system32\feubjauh.dll
2008-05-17 11:07 . 2008-05-17 11:07 125,952 --a------ C:\WINDOWS\system32\nicaikoc.dll
2008-05-17 10:12 . 2008-05-17 10:12 <REP> d-------- C:\VundoFix Backups
2008-05-17 10:02 . 2008-05-17 10:02 116,736 --a------ C:\WINDOWS\system32\tttwadlm.dll
2008-05-17 09:59 . 2008-05-17 09:59 135,680 --a------ C:\WINDOWS\system32\ehmclstl.dll
2008-05-17 09:57 . 2008-05-17 09:57 125,952 --a------ C:\WINDOWS\system32\uksaprdn.dll
2008-05-17 09:24 . 2008-05-17 11:30 <REP> d-------- C:\Program Files\Enigma Software Group
2008-05-17 08:48 . 2008-05-17 08:48 135,680 --a------ C:\WINDOWS\system32\qlebnpgw.dll
2008-05-17 08:45 . 2008-05-17 08:45 125,952 --a------ C:\WINDOWS\system32\pupheghq.dll
2008-05-17 08:12 . 2008-05-17 08:12 115,712 --a------ C:\WINDOWS\system32\gfedkauk.dll
2008-05-17 08:03 . 2008-05-17 08:03 133,632 --a------ C:\WINDOWS\system32\fupmbnxf.dll
2008-05-17 08:00 . 2008-05-17 08:00 125,440 --a------ C:\WINDOWS\system32\edbkpmij.dll
2008-05-17 08:00 . 2008-05-17 13:16 109,807 --a------ C:\WINDOWS\BM3f80a264.xml
2008-05-16 19:58 . 2008-05-16 19:58 115,712 --a------ C:\WINDOWS\system32\kncqgdlf.dll
2008-05-16 19:46 . 2008-05-16 19:46 93,696 --------- C:\WINDOWS\version.exe
2008-05-16 19:46 . 2008-05-16 19:46 58,880 --a------ C:\WINDOWS\system32\hgGaXOGa.dll
2008-05-11 13:51 . 2008-05-12 13:50 <REP> d-------- C:\Temp\Driving speed 2
2008-05-08 18:00 . 2008-05-08 18:00 <REP> d-------- C:\WINDOWS\Club PoM
2008-05-08 18:00 . 2008-05-08 18:00 290,816 --------- C:\WINDOWS\Setup1.exe
2008-05-08 17:59 . 2008-05-08 17:59 74,752 --a------ C:\WINDOWS\ST6UNST.EXE
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\templates
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Setup
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\rpplugins
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\producer
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\plugins
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Netscape6
2008-05-05 19:09 . 2008-05-05 19:31 <REP> d-------- C:\Program Files\library
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Fichiers communs\Real
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Devices
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\DataCache
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\CDBurning
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\browserrecord
2008-05-05 19:09 . 2008-05-05 19:09 719,360 --a------ C:\Program Files\dbghelp.dll
2008-05-05 19:09 . 2008-05-05 19:09 692,224 --a------ C:\Program Files\dtdr3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 659,456 --a------ C:\Program Files\rjbres.dll
2008-05-05 19:09 . 2008-05-05 19:09 339,968 --a------ C:\Program Files\rjdlg.dll
2008-05-05 19:09 . 2008-05-05 19:09 308,856 --a------ C:\Program Files\rpbrowserrecordplugin.dll
2008-05-05 19:09 . 2008-05-05 19:09 214,560 --a------ C:\Program Files\realplay.exe
2008-05-05 19:09 . 2008-05-05 19:09 153,176 --a------ C:\Program Files\RecordingManager.exe
2008-05-05 19:09 . 2008-05-05 19:09 139,264 --a------ C:\Program Files\DUNZIP32.dll
2008-05-05 19:09 . 2008-05-05 19:09 102,400 --a------ C:\Program Files\HXAudioDeviceHook.dll
2008-05-05 19:09 . 2008-05-05 19:09 98,304 --a------ C:\Program Files\rpshellextension.dll
2008-05-05 19:09 . 2008-05-05 19:09 95,816 --a------ C:\Program Files\rdsf3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 86,016 --a------ C:\Program Files\rpplugprot.dll
2008-05-05 19:09 . 2008-05-05 19:09 81,920 --a------ C:\Program Files\tsasdk.dll
2008-05-05 19:09 . 2008-05-05 19:09 65,536 --a------ C:\Program Files\rjwmapln.dll
2008-05-05 19:09 . 2008-05-05 19:09 63,040 --a------ C:\Program Files\rpshell.dll
2008-05-05 19:09 . 2008-05-05 19:09 57,344 --a------ C:\Program Files\tpasdk.dll
2008-05-05 19:09 . 2008-05-05 19:09 53,248 --a------ C:\Program Files\rpau3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 43,088 --a------ C:\Program Files\rpshellsearch.dll
2008-05-05 19:09 . 2008-05-05 19:09 41,472 --a------ C:\Program Files\mmcdda32.dll
2008-05-05 19:09 . 2008-05-05 19:09 36,352 --a------ C:\Program Files\ierjplug.dll
2008-05-05 19:09 . 2008-05-05 19:09 32,768 --a------ C:\Program Files\rpwa3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 19,456 --a------ C:\Program Files\tnetdtct.dll
2008-05-05 19:09 . 2008-05-05 19:09 19,456 --a------ C:\Program Files\rjprog.dll
2008-05-05 19:09 . 2008-05-05 19:09 14,336 --a------ C:\Program Files\wmdmhelper.dll
2008-05-05 19:09 . 2008-05-05 19:09 9,216 --a------ C:\Program Files\rphelperapp.exe
2008-05-05 19:09 . 2008-05-05 19:09 7,168 --a------ C:\Program Files\realjbox.exe
2008-05-05 19:09 . 2008-05-05 19:09 6,656 --a------ C:\Program Files\fixrjb.exe
2008-05-05 19:09 . 2008-05-05 19:09 1,001 --a------ C:\Program Files\autoplaylist.dat
2008-05-05 19:09 . 2008-05-05 19:09 685 --a------ C:\Program Files\RecordingManager.exe.manifest
2008-05-05 19:09 . 2008-05-05 19:09 682 --a------ C:\Program Files\realplay.exe.manifest
2008-05-05 19:09 . 2008-05-05 19:09 480 --a------ C:\Program Files\keys.dat
2008-05-05 19:09 . 2008-05-05 19:09 221 --a------ C:\Program Files\subscription.rnx
2008-05-05 19:09 . 2008-05-05 19:09 71 --a------ C:\Program Files\strs23.dat
2008-05-05 19:09 . 2008-05-05 19:09 15 --a------ C:\Program Files\strs26.dat
2008-05-05 19:07 . 2008-05-05 19:07 333,360 --a------ C:\Temp\RealPlayer11GOLD_fr.exe
2008-04-30 20:23 . 2008-04-30 21:07 <REP> d-------- C:\Temp\Windows XP Corporate SP3
2008-04-26 21:33 . 2008-04-26 21:33 305,664 --a------ C:\Temp\Xtremsplit.exe
2008-04-26 13:35 . 2008-04-26 14:39 <REP> d-------- C:\Temp\F1 challenge
2008-04-26 09:32 . 2008-04-26 10:14 <REP> d-------- C:\Temp\Carte FRANCE v6.75.1409 pour TOMTOM + keygen
2008-04-21 20:34 . 2008-04-21 20:49 <REP> d-------- C:\Temp\Lexus Race
2008-04-20 13:44 . 2008-04-20 13:44 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Unigraphics Solutions
2008-04-20 13:30 . 2008-04-20 13:35 <REP> d-------- C:\Program Files\Solid Edge V12
2008-04-19 14:40 . 2008-05-01 15:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TrackMania
2008-04-19 13:13 . 2008-04-19 14:24 <REP> d-------- C:\Temp\Trackmania Forever Addon

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-16 17:32 --------- d-----w C:\Documents and Settings\Fred\Application Data\XnView
2008-05-15 20:17 --------- d-----w C:\Program Files\FlashFXP
2008-05-14 19:31 --------- d-----w C:\Program Files\FlashGet
2008-05-04 18:17 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-01 13:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-28 17:33 --------- d-----w C:\Documents and Settings\Fred\Application Data\Vso
2008-04-20 10:20 --------- d-----w C:\Program Files\Google SketchUp 6
2008-03-29 19:27 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-03-25 04:51 621,344 ----a-w C:\windows\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\windows\system32\msjint40.dll
2008-03-24 12:46 --------- d-----w C:\Program Files\MP3toringtone
2008-03-20 08:09 1,845,376 ----a-w C:\windows\system32\win32k.sys
2008-03-01 12:58 826,368 ----a-w C:\windows\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\windows\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\windows\system32\dnsrslvr.dll
2007-09-09 09:03 87,608 ----a-w C:\Documents and Settings\Fred\Application Data\inst.exe
2007-09-09 09:03 47,360 ----a-w C:\Documents and Settings\Fred\Application Data\pcouffin.sys
2007-04-16 15:53 192 --sh--r C:\windows\inf\sdatabl.sav.bin
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_11.07.39.93 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 09:00:58 2,048 --s-a-w C:\windows\bootstat.dat
+ 2008-05-17 11:13:55 2,048 --s-a-w C:\windows\bootstat.dat
- 2008-05-17 07:55:55 78,228 ----a-w C:\windows\system32\perfc009.dat
+ 2008-05-17 09:53:55 78,228 ----a-w C:\windows\system32\perfc009.dat
- 2008-05-17 07:55:55 95,800 ----a-w C:\windows\system32\perfc00C.dat
+ 2008-05-17 09:53:55 95,800 ----a-w C:\windows\system32\perfc00C.dat
- 2008-05-17 07:55:55 439,224 ----a-w C:\windows\system32\perfh009.dat
+ 2008-05-17 09:53:55 439,224 ----a-w C:\windows\system32\perfh009.dat
- 2008-05-17 07:55:55 511,964 ----a-w C:\windows\system32\perfh00C.dat
+ 2008-05-17 09:53:55 511,964 ----a-w C:\windows\system32\perfh00C.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{522E0112-EDD9-413D-A99E-C311A54B6676}]
2008-05-16 19:46 58880 --a------ C:\windows\system32\hgGaXOGa.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{984F2F13-D8B7-4A73-99AA-DA5BB0B443D7}]
C:\windows\system32\ddcCVpon.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 15:07 1289000]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingB7671"="command /c del C:\WINDOWS\system32\ddcCVpon.dll_old" [ ]
"SpybotDeletingD1450"="cmd /c del C:\WINDOWS\system32\ddcCVpon.dll_old" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ULiRaid5289"="C:\Program Files\ULI5289\ULi5289.exe" [2005-06-07 15:16 409600]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-07-11 11:34 122880]
"CTHelper"="CTHELPER.EXE" [2006-08-17 11:32 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 11:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2006-09-12 17:35 921600]
"SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [2008-01-28 12:43 5146448]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2004-03-18 10:33 892928]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53 153136]
"NvCplDaemon"="C:\windows\system32\NvCpl.dll" [2007-06-29 00:43 8466432]
"nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\windows\system32\NvMcTray.dll" [2007-06-29 00:43 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 17:16 37376]
"ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-08-11 15:30 249856]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-05-05 19:09 185896]
"3cb391f8"="C:\windows\system32\ekesumls.dll" [2008-05-17 13:00 116224]
"BM3f80a264"="C:\windows\system32\ipejfejr.dll" [2008-05-17 12:55 125952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{522E0112-EDD9-413D-A99E-C311A54B6676}"= C:\windows\system32\hgGaXOGa.dll [2008-05-16 19:46 58880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgGaXOGa]
hgGaXOGa.dll 2008-05-16 19:46 58880 C:\WINDOWS\system32\hgGaXOGa.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\AlienGUIse\fastload.dll 2001-12-20 22:34 24576 C:\Program Files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage d'Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage d'Office.lnk
backup=C:\windows\pss\Démarrage d'Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Recherche accélérée.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Recherche accélérée.lnk
backup=C:\windows\pss\Microsoft Recherche accélérée.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"EVEREST AutoStart"=C:\Program Files\Everest Ultimate Edition v.3.0\everest.exe
"ctfmon.exe"=C:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Device Detector"=DevDetect.exe -autorun
"CTDVDDET"="C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
"ISUSPM Startup"=C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\FlashGet\\FlashGet.exe"=
"C:\\Program Files\\FileZilla\\FileZilla.exe"=
"C:\\Jeux\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Jeux\\Hellgate London\\Launcher.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Jeux\\Battlefield 2142\\BF2142.exe"=
"C:\\ijji\\ENGLISH\\u_skid.exe"=
"C:\\Jeux\\DriftCity\\DriftCity.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
"C:\\Jeux\\TmUnitedForever\\TmForever.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8352:TCP"= 8352:TCP:BitComet 8352 TCP
"8352:UDP"= 8352:UDP:BitComet 8352 UDP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 m5289;m5289;C:\windows\system32\drivers\m5289.sys [2005-07-04 14:21]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\windows\system32\drivers\sfsync03.sys [2005-12-06 17:11]
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\windows\system32\DRIVERS\agpkx.sys [2005-05-03 17:31]
R1 oreans32;oreans32;C:\windows\system32\drivers\oreans32.sys [2007-07-21 08:50]
R2 UxTuneUp;Extension de conception TuneUp;C:\windows\System32\svchost.exe [2004-08-19 16:10]
R3 ha20x2k;Creative 20X HAL Driver;C:\windows\system32\drivers\ha20x2k.sys [2006-08-17 11:16]
R3 LCcfltr;Logitech USB Filter Driver;C:\windows\system32\drivers\lccfltr.sys [2004-03-03 10:50]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;C:\windows\system32\DRIVERS\ULILAN51.SYS [2005-03-22 20:36]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-09-22 11:49]
S3 hamachi_oem;PlayLinc Adapter;C:\windows\system32\DRIVERS\gan_adapter.sys [2006-10-19 13:11]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-04-11 15:16:03 C:\windows\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-17 13:15:49
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\windows\system32\winlogon.exe
-> C:\windows\system32\hgGaXOGa.dll

PROCESS: C:\windows\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll

PROCESS: C:\windows\explorer.exe
-> C:\windows\system32\ekesumls.dll
-> C:\windows\system32\ipejfejr.dll
-> C:\Program Files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RAXCO\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\RAXCO\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\CTXFISPI.EXE
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.exe
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-05-17 13:22:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-17 11:22:10
ComboFix2.txt 2008-05-17 09:09:52

Pre-Run: 16,353,153,024 octets libres
Post-Run: 16,338,010,112 octets libres

302 --- E O F --- 2008-05-14 19:32:26

avant de le faire, j'ai laisser spybot travailler.

Il scanne bien detecte bien Virtumonde et virtumonde.dll, les detruit, mais cet enfoiré revient a chaque fois

Merci de m'aider à l'eradiquer definitivement.

Re,

C'est toi qui a créé C:\Temp ?

*******

Sélectionne l'intégralité du cadre ci-dessous :

Cela va relancer Combofix. Après redémarrage, poste le contenu du rapport ComboFix.txt.
S'il n'y a pas de rédémarrage, poste quand même le rapport.

• Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
• Enregistre le sous sur ton bureau sous le nom de CFScript.txt
• Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :

• Cela va relancer Combofix. Poste le contenu du rapport ComboFix.txt après redémarrage s'il y en a un.

Voici le rapport de Combofix

ComboFix 08-05-15.3 - Fred 2008-05-17 14:21:30.4 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.589 [GMT 2:00]
Endroit: C:\Documents and Settings\Fred\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Fred\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
* Resident AV is active


[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]

FILE ::
C:\WINDOWS\BM3f80a264.xml
C:\windows\system32\ddcCVpon.dll
C:\WINDOWS\system32\edbkpmij.dll
C:\WINDOWS\system32\ehmclstl.dll
C:\windows\system32\ekesumls.dll
C:\WINDOWS\system32\ekesumls.dll
C:\WINDOWS\system32\feubjauh.dll
C:\WINDOWS\system32\fupmbnxf.dll
C:\WINDOWS\system32\gfedkauk.dll
C:\windows\system32\hgGaXOGa.dll
C:\windows\system32\ipejfejr.dll
C:\WINDOWS\system32\iwlwmrns.dll
C:\WINDOWS\system32\kncqgdlf.dll
C:\WINDOWS\system32\nicaikoc.dll
C:\WINDOWS\system32\pupheghq.dll
C:\WINDOWS\system32\qlebnpgw.dll
C:\WINDOWS\system32\slmuseke.ini
C:\WINDOWS\system32\tttwadlm.dll
C:\WINDOWS\system32\uksaprdn.dll
C:\WINDOWS\version.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Fred\Application Data\inst.exe
C:\Documents and Settings\Fred\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Program Files\BOONTYGames
C:\Program Files\BOONTYGames\Components\bureau.url
C:\Program Files\BOONTYGames\Components\Joystick.ico
C:\Program Files\BOONTYGames\Components\start.url
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\VundoFix Backups
C:\WINDOWS\BM3f80a264.xml
C:\windows\pskt.ini
C:\WINDOWS\system32\edbkpmij.dll
C:\WINDOWS\system32\ehmclstl.dll
C:\WINDOWS\system32\ekesumls.dll
C:\windows\system32\ekudxkmk.ini
C:\WINDOWS\system32\feubjauh.dll
C:\WINDOWS\system32\fupmbnxf.dll
C:\WINDOWS\system32\gfedkauk.dll
C:\windows\system32\hgGaXOGa.dll
C:\windows\system32\ipejfejr.dll
C:\WINDOWS\system32\iwlwmrns.dll
C:\WINDOWS\system32\kncqgdlf.dll
C:\WINDOWS\system32\nicaikoc.dll
C:\WINDOWS\system32\pupheghq.dll
C:\WINDOWS\system32\qlebnpgw.dll
C:\WINDOWS\system32\slmuseke.ini
C:\windows\system32\t.txt
C:\WINDOWS\system32\tttwadlm.dll
C:\WINDOWS\system32\uksaprdn.dll
C:\windows\system32\uvCKRXbc.ini
C:\WINDOWS\system32\uvCKRXbc.ini2
C:\WINDOWS\version.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-17 to 2008-05-17 ))))))))))))))))))))))))))))))))))))
.

2008-05-17 14:00 . 2008-05-17 14:00 134,144 --a------ C:\WINDOWS\system32\olxnshug.dll
2008-05-17 13:57 . 2008-05-17 13:57 116,224 --a------ C:\WINDOWS\system32\kmkxduke.dll
2008-05-17 13:52 . 2008-05-17 13:52 125,952 --a------ C:\WINDOWS\system32\hggqymhj.dll
2008-05-17 13:51 . 2008-05-17 13:51 371,712 --a------ C:\WINDOWS\system32\cbXRKCvu.dll
2008-05-17 09:24 . 2008-05-17 11:30 <REP> d-------- C:\Program Files\Enigma Software Group
2008-05-11 13:51 . 2008-05-12 13:50 <REP> d-------- C:\Temp\Driving speed 2
2008-05-08 18:00 . 2008-05-08 18:00 <REP> d-------- C:\WINDOWS\Club PoM
2008-05-08 18:00 . 2008-05-08 18:00 290,816 --------- C:\WINDOWS\Setup1.exe
2008-05-08 17:59 . 2008-05-08 17:59 74,752 --a------ C:\WINDOWS\ST6UNST.EXE
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\templates
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Setup
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\rpplugins
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\producer
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\plugins
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Netscape6
2008-05-05 19:09 . 2008-05-05 19:31 <REP> d-------- C:\Program Files\library
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Fichiers communs\Real
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Devices
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\DataCache
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\CDBurning
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\browserrecord
2008-05-05 19:09 . 2008-05-05 19:09 719,360 --a------ C:\Program Files\dbghelp.dll
2008-05-05 19:09 . 2008-05-05 19:09 692,224 --a------ C:\Program Files\dtdr3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 659,456 --a------ C:\Program Files\rjbres.dll
2008-05-05 19:09 . 2008-05-05 19:09 339,968 --a------ C:\Program Files\rjdlg.dll
2008-05-05 19:09 . 2008-05-05 19:09 308,856 --a------ C:\Program Files\rpbrowserrecordplugin.dll
2008-05-05 19:09 . 2008-05-05 19:09 214,560 --a------ C:\Program Files\realplay.exe
2008-05-05 19:09 . 2008-05-05 19:09 153,176 --a------ C:\Program Files\RecordingManager.exe
2008-05-05 19:09 . 2008-05-05 19:09 139,264 --a------ C:\Program Files\DUNZIP32.dll
2008-05-05 19:09 . 2008-05-05 19:09 102,400 --a------ C:\Program Files\HXAudioDeviceHook.dll
2008-05-05 19:09 . 2008-05-05 19:09 98,304 --a------ C:\Program Files\rpshellextension.dll
2008-05-05 19:09 . 2008-05-05 19:09 95,816 --a------ C:\Program Files\rdsf3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 86,016 --a------ C:\Program Files\rpplugprot.dll
2008-05-05 19:09 . 2008-05-05 19:09 81,920 --a------ C:\Program Files\tsasdk.dll
2008-05-05 19:09 . 2008-05-05 19:09 65,536 --a------ C:\Program Files\rjwmapln.dll
2008-05-05 19:09 . 2008-05-05 19:09 63,040 --a------ C:\Program Files\rpshell.dll
2008-05-05 19:09 . 2008-05-05 19:09 57,344 --a------ C:\Program Files\tpasdk.dll
2008-05-05 19:09 . 2008-05-05 19:09 53,248 --a------ C:\Program Files\rpau3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 43,088 --a------ C:\Program Files\rpshellsearch.dll
2008-05-05 19:09 . 2008-05-05 19:09 41,472 --a------ C:\Program Files\mmcdda32.dll
2008-05-05 19:09 . 2008-05-05 19:09 36,352 --a------ C:\Program Files\ierjplug.dll
2008-05-05 19:09 . 2008-05-05 19:09 32,768 --a------ C:\Program Files\rpwa3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 19,456 --a------ C:\Program Files\tnetdtct.dll
2008-05-05 19:09 . 2008-05-05 19:09 19,456 --a------ C:\Program Files\rjprog.dll
2008-05-05 19:09 . 2008-05-05 19:09 14,336 --a------ C:\Program Files\wmdmhelper.dll
2008-05-05 19:09 . 2008-05-05 19:09 9,216 --a------ C:\Program Files\rphelperapp.exe
2008-05-05 19:09 . 2008-05-05 19:09 7,168 --a------ C:\Program Files\realjbox.exe
2008-05-05 19:09 . 2008-05-05 19:09 6,656 --a------ C:\Program Files\fixrjb.exe
2008-05-05 19:09 . 2008-05-05 19:09 1,001 --a------ C:\Program Files\autoplaylist.dat
2008-05-05 19:09 . 2008-05-05 19:09 685 --a------ C:\Program Files\RecordingManager.exe.manifest
2008-05-05 19:09 . 2008-05-05 19:09 682 --a------ C:\Program Files\realplay.exe.manifest
2008-05-05 19:09 . 2008-05-05 19:09 480 --a------ C:\Program Files\keys.dat
2008-05-05 19:09 . 2008-05-05 19:09 221 --a------ C:\Program Files\subscription.rnx
2008-05-05 19:09 . 2008-05-05 19:09 71 --a------ C:\Program Files\strs23.dat
2008-05-05 19:09 . 2008-05-05 19:09 15 --a------ C:\Program Files\strs26.dat
2008-05-05 19:07 . 2008-05-05 19:07 333,360 --a------ C:\Temp\RealPlayer11GOLD_fr.exe
2008-04-30 20:23 . 2008-04-30 21:07 <REP> d-------- C:\Temp\Windows XP Corporate SP3
2008-04-26 21:33 . 2008-04-26 21:33 305,664 --a------ C:\Temp\Xtremsplit.exe
2008-04-26 13:35 . 2008-04-26 14:39 <REP> d-------- C:\Temp\F1 challenge
2008-04-26 09:32 . 2008-04-26 10:14 <REP> d-------- C:\Temp\Carte FRANCE v6.75.1409 pour TOMTOM + keygen
2008-04-21 20:34 . 2008-04-21 20:49 <REP> d-------- C:\Temp\Lexus Race
2008-04-20 13:44 . 2008-04-20 13:44 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Unigraphics Solutions
2008-04-20 13:30 . 2008-04-20 13:35 <REP> d-------- C:\Program Files\Solid Edge V12
2008-04-19 14:40 . 2008-05-01 15:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TrackMania
2008-04-19 13:13 . 2008-04-19 14:24 <REP> d-------- C:\Temp\Trackmania Forever Addon

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-16 17:32 --------- d-----w C:\Documents and Settings\Fred\Application Data\XnView
2008-05-15 20:17 --------- d-----w C:\Program Files\FlashFXP
2008-05-14 19:31 --------- d-----w C:\Program Files\FlashGet
2008-05-04 18:17 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-01 13:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-28 17:33 --------- d-----w C:\Documents and Settings\Fred\Application Data\Vso
2008-04-20 10:20 --------- d-----w C:\Program Files\Google SketchUp 6
2008-03-29 19:27 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-03-25 04:51 621,344 ----a-w C:\windows\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\windows\system32\msjint40.dll
2008-03-24 12:46 --------- d-----w C:\Program Files\MP3toringtone
2008-03-20 08:09 1,845,376 ----a-w C:\windows\system32\win32k.sys
2008-03-01 12:58 826,368 ----a-w C:\windows\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\windows\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\windows\system32\dnsrslvr.dll
2007-09-09 09:03 47,360 ----a-w C:\Documents and Settings\Fred\Application Data\pcouffin.sys
2007-04-16 15:53 192 --sh--r C:\windows\inf\sdatabl.sav.bin
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_11.07.39.93 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 09:00:58 2,048 --s-a-w C:\windows\bootstat.dat
+ 2008-05-17 12:27:00 2,048 --s-a-w C:\windows\bootstat.dat
- 2008-05-17 07:55:55 78,228 ----a-w C:\windows\system32\perfc009.dat
+ 2008-05-17 09:53:55 78,228 ----a-w C:\windows\system32\perfc009.dat
- 2008-05-17 07:55:55 95,800 ----a-w C:\windows\system32\perfc00C.dat
+ 2008-05-17 09:53:55 95,800 ----a-w C:\windows\system32\perfc00C.dat
- 2008-05-17 07:55:55 439,224 ----a-w C:\windows\system32\perfh009.dat
+ 2008-05-17 09:53:55 439,224 ----a-w C:\windows\system32\perfh009.dat
- 2008-05-17 07:55:55 511,964 ----a-w C:\windows\system32\perfh00C.dat
+ 2008-05-17 09:53:55 511,964 ----a-w C:\windows\system32\perfh00C.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1A4CFBF2-89B6-4579-8C21-096C9902E8A4}]
2008-05-17 13:51 371712 --a------ C:\windows\system32\cbXRKCvu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fecd6c14-d53f-4973-8dc5-77984c35d055}]
2008-05-17 14:00 134144 --a------ C:\windows\system32\olxnshug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 15:07 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ULiRaid5289"="C:\Program Files\ULI5289\ULi5289.exe" [2005-06-07 15:16 409600]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-07-11 11:34 122880]
"CTHelper"="CTHELPER.EXE" [2006-08-17 11:32 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 11:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2004-03-18 10:33 892928]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe]
"NvCplDaemon"="C:\windows\system32\NvCpl.dll" [2007-06-29 00:43 8466432]
"nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\windows\system32\NvMcTray.dll" [2007-06-29 00:43 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\AlienGUIse\fastload.dll 2001-12-20 22:34 24576 C:\Program Files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage d'Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage d'Office.lnk
backup=C:\windows\pss\Démarrage d'Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Recherche accélérée.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Recherche accélérée.lnk
backup=C:\windows\pss\Microsoft Recherche accélérée.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"EVEREST AutoStart"=C:\Program Files\Everest Ultimate Edition v.3.0\everest.exe
"ctfmon.exe"=C:\windows\system32\ctfmon.exe
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Device Detector"=DevDetect.exe -autorun
"CTDVDDET"="C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
"ISUSPM Startup"=C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
"SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\FlashGet\\FlashGet.exe"=
"C:\\Program Files\\FileZilla\\FileZilla.exe"=
"C:\\Jeux\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Jeux\\Hellgate London\\Launcher.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Jeux\\Battlefield 2142\\BF2142.exe"=
"C:\\ijji\\ENGLISH\\u_skid.exe"=
"C:\\Jeux\\DriftCity\\DriftCity.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
"C:\\Jeux\\TmUnitedForever\\TmForever.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8352:TCP"= 8352:TCP:BitComet 8352 TCP
"8352:UDP"= 8352:UDP:BitComet 8352 UDP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 m5289;m5289;C:\windows\system32\drivers\m5289.sys [2005-07-04 14:21]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\windows\system32\drivers\sfsync03.sys [2005-12-06 17:11]
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\windows\system32\DRIVERS\agpkx.sys [2005-05-03 17:31]
R1 oreans32;oreans32;C:\windows\system32\drivers\oreans32.sys [2007-07-21 08:50]
R2 UxTuneUp;Extension de conception TuneUp;C:\windows\System32\svchost.exe [2004-08-19 16:10]
R3 ha20x2k;Creative 20X HAL Driver;C:\windows\system32\drivers\ha20x2k.sys [2006-08-17 11:16]
R3 LCcfltr;Logitech USB Filter Driver;C:\windows\system32\drivers\lccfltr.sys [2004-03-03 10:50]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;C:\windows\system32\DRIVERS\ULILAN51.SYS [2005-03-22 20:36]
S3 hamachi_oem;PlayLinc Adapter;C:\windows\system32\DRIVERS\gan_adapter.sys [2006-10-19 13:11]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-04-11 15:16:03 C:\windows\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-17 14:27:32
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\windows\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RAXCO\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\CTXFISPI.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.exe
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-05-17 14:32:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-17 12:32:28
ComboFix2.txt 2008-05-17 11:44:28
ComboFix3.txt 2008-05-17 11:22:25
ComboFix4.txt 2008-05-17 09:09:52

Pre-Run: 17,556,213,760 octets libres
Post-Run: 17,540,603,904 octets libres

322 --- E O F --- 2008-05-14 19:32:26

J'ai supprimé le fichier Temp (il n'y avait pas grand chose d'important dedans)

Voici le nouveau rapport:

ComboFix 08-05-15.3 - Fred 2008-05-17 15:17:02.5 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.585 [GMT 2:00]
Endroit: C:\Documents and Settings\Fred\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Fred\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
* Resident AV is active


[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]

FILE ::
C:\windows\system32\cbXRKCvu.dll
C:\WINDOWS\system32\hggqymhj.dll
C:\WINDOWS\system32\kmkxduke.dll
C:\windows\system32\olxnshug.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\windows\pskt.ini
C:\windows\system32\cbXRKCvu.dll
C:\WINDOWS\system32\hggqymhj.dll
C:\WINDOWS\system32\kmkxduke.dll
C:\windows\system32\olxnshug.dll
C:\windows\system32\uvCKRXbc.ini
C:\WINDOWS\system32\uvCKRXbc.ini2
C:\windows\system32\xiiloqcr.ini

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-17 to 2008-05-17 ))))))))))))))))))))))))))))))))))))
.

2008-05-17 15:02 . 2008-05-17 15:02 134,144 --a------ C:\WINDOWS\system32\uutpbtba.dll
2008-05-17 15:02 . 2008-05-17 15:02 116,224 --a------ C:\WINDOWS\system32\rcqoliix.dll
2008-05-17 14:57 . 2008-05-17 14:57 125,952 --a------ C:\WINDOWS\system32\bqwhffgn.dll
2008-05-17 14:57 . 2008-05-17 15:25 109,807 --a------ C:\WINDOWS\BM3f80a264.xml
2008-05-17 09:24 . 2008-05-17 11:30 <REP> d-------- C:\Program Files\Enigma Software Group
2008-05-08 18:00 . 2008-05-08 18:00 <REP> d-------- C:\WINDOWS\Club PoM
2008-05-08 18:00 . 2008-05-08 18:00 290,816 --------- C:\WINDOWS\Setup1.exe
2008-05-08 17:59 . 2008-05-08 17:59 74,752 --a------ C:\WINDOWS\ST6UNST.EXE
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\templates
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Setup
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\rpplugins
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\producer
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\plugins
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Netscape6
2008-05-05 19:09 . 2008-05-05 19:31 <REP> d-------- C:\Program Files\library
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Fichiers communs\Real
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Devices
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\DataCache
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\CDBurning
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\browserrecord
2008-05-05 19:09 . 2008-05-05 19:09 719,360 --a------ C:\Program Files\dbghelp.dll
2008-05-05 19:09 . 2008-05-05 19:09 692,224 --a------ C:\Program Files\dtdr3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 659,456 --a------ C:\Program Files\rjbres.dll
2008-05-05 19:09 . 2008-05-05 19:09 339,968 --a------ C:\Program Files\rjdlg.dll
2008-05-05 19:09 . 2008-05-05 19:09 308,856 --a------ C:\Program Files\rpbrowserrecordplugin.dll
2008-05-05 19:09 . 2008-05-05 19:09 214,560 --a------ C:\Program Files\realplay.exe
2008-05-05 19:09 . 2008-05-05 19:09 153,176 --a------ C:\Program Files\RecordingManager.exe
2008-05-05 19:09 . 2008-05-05 19:09 139,264 --a------ C:\Program Files\DUNZIP32.dll
2008-05-05 19:09 . 2008-05-05 19:09 102,400 --a------ C:\Program Files\HXAudioDeviceHook.dll
2008-05-05 19:09 . 2008-05-05 19:09 98,304 --a------ C:\Program Files\rpshellextension.dll
2008-05-05 19:09 . 2008-05-05 19:09 95,816 --a------ C:\Program Files\rdsf3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 86,016 --a------ C:\Program Files\rpplugprot.dll
2008-05-05 19:09 . 2008-05-05 19:09 81,920 --a------ C:\Program Files\tsasdk.dll
2008-05-05 19:09 . 2008-05-05 19:09 65,536 --a------ C:\Program Files\rjwmapln.dll
2008-05-05 19:09 . 2008-05-05 19:09 63,040 --a------ C:\Program Files\rpshell.dll
2008-05-05 19:09 . 2008-05-05 19:09 57,344 --a------ C:\Program Files\tpasdk.dll
2008-05-05 19:09 . 2008-05-05 19:09 53,248 --a------ C:\Program Files\rpau3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 43,088 --a------ C:\Program Files\rpshellsearch.dll
2008-05-05 19:09 . 2008-05-05 19:09 41,472 --a------ C:\Program Files\mmcdda32.dll
2008-05-05 19:09 . 2008-05-05 19:09 36,352 --a------ C:\Program Files\ierjplug.dll
2008-05-05 19:09 . 2008-05-05 19:09 32,768 --a------ C:\Program Files\rpwa3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 19,456 --a------ C:\Program Files\tnetdtct.dll
2008-05-05 19:09 . 2008-05-05 19:09 19,456 --a------ C:\Program Files\rjprog.dll
2008-05-05 19:09 . 2008-05-05 19:09 14,336 --a------ C:\Program Files\wmdmhelper.dll
2008-05-05 19:09 . 2008-05-05 19:09 9,216 --a------ C:\Program Files\rphelperapp.exe
2008-05-05 19:09 . 2008-05-05 19:09 7,168 --a------ C:\Program Files\realjbox.exe
2008-05-05 19:09 . 2008-05-05 19:09 6,656 --a------ C:\Program Files\fixrjb.exe
2008-05-05 19:09 . 2008-05-05 19:09 1,001 --a------ C:\Program Files\autoplaylist.dat
2008-05-05 19:09 . 2008-05-05 19:09 685 --a------ C:\Program Files\RecordingManager.exe.manifest
2008-05-05 19:09 . 2008-05-05 19:09 682 --a------ C:\Program Files\realplay.exe.manifest
2008-05-05 19:09 . 2008-05-05 19:09 480 --a------ C:\Program Files\keys.dat
2008-05-05 19:09 . 2008-05-05 19:09 221 --a------ C:\Program Files\subscription.rnx
2008-05-05 19:09 . 2008-05-05 19:09 71 --a------ C:\Program Files\strs23.dat
2008-05-05 19:09 . 2008-05-05 19:09 15 --a------ C:\Program Files\strs26.dat
2008-04-20 13:44 . 2008-04-20 13:44 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Unigraphics Solutions
2008-04-20 13:30 . 2008-04-20 13:35 <REP> d-------- C:\Program Files\Solid Edge V12
2008-04-19 14:40 . 2008-05-01 15:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TrackMania

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-16 17:32 --------- d-----w C:\Documents and Settings\Fred\Application Data\XnView
2008-05-15 20:17 --------- d-----w C:\Program Files\FlashFXP
2008-05-14 19:31 --------- d-----w C:\Program Files\FlashGet
2008-05-04 18:17 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-01 13:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-28 17:33 --------- d-----w C:\Documents and Settings\Fred\Application Data\Vso
2008-04-20 10:20 --------- d-----w C:\Program Files\Google SketchUp 6
2008-03-29 19:27 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-03-25 04:51 621,344 ----a-w C:\windows\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\windows\system32\msjint40.dll
2008-03-24 12:46 --------- d-----w C:\Program Files\MP3toringtone
2008-03-20 08:09 1,845,376 ----a-w C:\windows\system32\win32k.sys
2008-03-01 12:58 826,368 ----a-w C:\windows\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\windows\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\windows\system32\dnsrslvr.dll
2007-09-09 09:03 47,360 ----a-w C:\Documents and Settings\Fred\Application Data\pcouffin.sys
2007-04-16 15:53 192 --sh--r C:\windows\inf\sdatabl.sav.bin
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_11.07.39.93 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 09:00:58 2,048 --s-a-w C:\windows\bootstat.dat
+ 2008-05-17 13:22:23 2,048 --s-a-w C:\windows\bootstat.dat
- 2008-05-17 07:55:55 78,228 ----a-w C:\windows\system32\perfc009.dat
+ 2008-05-17 09:53:55 78,228 ----a-w C:\windows\system32\perfc009.dat
- 2008-05-17 07:55:55 95,800 ----a-w C:\windows\system32\perfc00C.dat
+ 2008-05-17 09:53:55 95,800 ----a-w C:\windows\system32\perfc00C.dat
- 2008-05-17 07:55:55 439,224 ----a-w C:\windows\system32\perfh009.dat
+ 2008-05-17 09:53:55 439,224 ----a-w C:\windows\system32\perfh009.dat
- 2008-05-17 07:55:55 511,964 ----a-w C:\windows\system32\perfh00C.dat
+ 2008-05-17 09:53:55 511,964 ----a-w C:\windows\system32\perfh00C.dat
+ 2008-05-17 13:23:46 16,384 --sha-w C:\windows\TEMP\Cookies\index.dat
+ 2008-05-17 13:23:46 32,768 --sha-w C:\windows\TEMP\Fichiers Internet temporaires\Content.IE5\index.dat
+ 2008-05-17 13:23:46 16,384 --sha-w C:\windows\TEMP\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d2e57eff-1336-40b0-97c9-38b4371ca742}]
2008-05-17 15:02 134144 --a------ C:\windows\system32\uutpbtba.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 15:07 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ULiRaid5289"="C:\Program Files\ULI5289\ULi5289.exe" [2005-06-07 15:16 409600]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-07-11 11:34 122880]
"CTHelper"="CTHELPER.EXE" [2006-08-17 11:32 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 11:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2004-03-18 10:33 892928]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe]
"NvCplDaemon"="C:\windows\system32\NvCpl.dll" [2007-06-29 00:43 8466432]
"nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\windows\system32\NvMcTray.dll" [2007-06-29 00:43 81920]
"3cb391f8"="C:\windows\system32\rcqoliix.dll" [2008-05-17 15:02 116224]
"BM3f80a264"="C:\windows\system32\bqwhffgn.dll" [2008-05-17 14:57 125952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\AlienGUIse\fastload.dll 2001-12-20 22:34 24576 C:\Program Files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage d'Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage d'Office.lnk
backup=C:\windows\pss\Démarrage d'Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Recherche accélérée.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Recherche accélérée.lnk
backup=C:\windows\pss\Microsoft Recherche accélérée.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"EVEREST AutoStart"=C:\Program Files\Everest Ultimate Edition v.3.0\everest.exe
"ctfmon.exe"=C:\windows\system32\ctfmon.exe
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Device Detector"=DevDetect.exe -autorun
"CTDVDDET"="C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
"ISUSPM Startup"=C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
"SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\FlashGet\\FlashGet.exe"=
"C:\\Program Files\\FileZilla\\FileZilla.exe"=
"C:\\Jeux\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Jeux\\Hellgate London\\Launcher.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Jeux\\Battlefield 2142\\BF2142.exe"=
"C:\\ijji\\ENGLISH\\u_skid.exe"=
"C:\\Jeux\\DriftCity\\DriftCity.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
"C:\\Jeux\\TmUnitedForever\\TmForever.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8352:TCP"= 8352:TCP:BitComet 8352 TCP
"8352:UDP"= 8352:UDP:BitComet 8352 UDP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 m5289;m5289;C:\windows\system32\drivers\m5289.sys [2005-07-04 14:21]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\windows\system32\drivers\sfsync03.sys [2005-12-06 17:11]
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\windows\system32\DRIVERS\agpkx.sys [2005-05-03 17:31]
R1 oreans32;oreans32;C:\windows\system32\drivers\oreans32.sys [2007-07-21 08:50]
R2 UxTuneUp;Extension de conception TuneUp;C:\windows\System32\svchost.exe [2004-08-19 16:10]
R3 ha20x2k;Creative 20X HAL Driver;C:\windows\system32\drivers\ha20x2k.sys [2006-08-17 11:16]
R3 LCcfltr;Logitech USB Filter Driver;C:\windows\system32\drivers\lccfltr.sys [2004-03-03 10:50]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;C:\windows\system32\DRIVERS\ULILAN51.SYS [2005-03-22 20:36]
S3 hamachi_oem;PlayLinc Adapter;C:\windows\system32\DRIVERS\gan_adapter.sys [2006-10-19 13:11]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-04-11 15:16:03 C:\windows\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-17 15:23:57
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\windows\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RAXCO\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\CTXFISPI.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-05-17 15:28:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-17 13:28:53
ComboFix2.txt 2008-05-17 12:32:33
ComboFix3.txt 2008-05-17 11:44:28
ComboFix4.txt 2008-05-17 11:22:25
ComboFix5.txt 2008-05-17 09:09:52

Pre-Run: 29,043,687,424 octets libres
Post-Run: 29,033,414,656 octets libres

275 --- E O F --- 2008-05-14 19:32:26

J'ai refait un combofix en mode sans echec et un passage de hijachthis en mode normal voila les resultats:

Combofix:

ComboFix 08-05-15.3 - Fred 2008-05-17 18:41:29.6 - NTFSx86 MINIMAL
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.796 [GMT 2:00]
Endroit: C:\Documents and Settings\Fred\Bureau\ComboFix.exe

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\windows\pskt.ini

.
((((((((((((((((((((((((((((( Fichiers créés 2008-04-17 to 2008-05-17 ))))))))))))))))))))))))))))))))))))
.

2008-05-17 15:29 . 2008-05-17 18:21 414 ---hs---- C:\WINDOWS\system32\xiiloqcr.ini
2008-05-17 15:02 . 2008-05-17 15:02 134,144 --a------ C:\WINDOWS\system32\uutpbtba.dll
2008-05-17 15:02 . 2008-05-17 15:02 116,224 --a------ C:\WINDOWS\system32\rcqoliix.dll
2008-05-17 14:57 . 2008-05-17 14:57 125,952 --a------ C:\WINDOWS\system32\bqwhffgn.dll
2008-05-17 14:57 . 2008-05-17 17:20 109,836 --a------ C:\WINDOWS\BM3f80a264.xml
2008-05-17 09:24 . 2008-05-17 11:30 <REP> d-------- C:\Program Files\Enigma Software Group
2008-05-08 18:00 . 2008-05-08 18:00 <REP> d-------- C:\WINDOWS\Club PoM
2008-05-08 18:00 . 2008-05-08 18:00 290,816 --------- C:\WINDOWS\Setup1.exe
2008-05-08 17:59 . 2008-05-08 17:59 74,752 --a------ C:\WINDOWS\ST6UNST.EXE
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\templates
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Setup
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\rpplugins
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\producer
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\plugins
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Netscape6
2008-05-05 19:09 . 2008-05-05 19:31 <REP> d-------- C:\Program Files\library
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Fichiers communs\Real
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\Devices
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\DataCache
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\CDBurning
2008-05-05 19:09 . 2008-05-05 19:09 <REP> d-------- C:\Program Files\browserrecord
2008-05-05 19:09 . 2008-05-05 19:09 719,360 --a------ C:\Program Files\dbghelp.dll
2008-05-05 19:09 . 2008-05-05 19:09 692,224 --a------ C:\Program Files\dtdr3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 659,456 --a------ C:\Program Files\rjbres.dll
2008-05-05 19:09 . 2008-05-05 19:09 339,968 --a------ C:\Program Files\rjdlg.dll
2008-05-05 19:09 . 2008-05-05 19:09 308,856 --a------ C:\Program Files\rpbrowserrecordplugin.dll
2008-05-05 19:09 . 2008-05-05 19:09 214,560 --a------ C:\Program Files\realplay.exe
2008-05-05 19:09 . 2008-05-05 19:09 153,176 --a------ C:\Program Files\RecordingManager.exe
2008-05-05 19:09 . 2008-05-05 19:09 139,264 --a------ C:\Program Files\DUNZIP32.dll
2008-05-05 19:09 . 2008-05-05 19:09 102,400 --a------ C:\Program Files\HXAudioDeviceHook.dll
2008-05-05 19:09 . 2008-05-05 19:09 98,304 --a------ C:\Program Files\rpshellextension.dll
2008-05-05 19:09 . 2008-05-05 19:09 95,816 --a------ C:\Program Files\rdsf3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 86,016 --a------ C:\Program Files\rpplugprot.dll
2008-05-05 19:09 . 2008-05-05 19:09 81,920 --a------ C:\Program Files\tsasdk.dll
2008-05-05 19:09 . 2008-05-05 19:09 65,536 --a------ C:\Program Files\rjwmapln.dll
2008-05-05 19:09 . 2008-05-05 19:09 63,040 --a------ C:\Program Files\rpshell.dll
2008-05-05 19:09 . 2008-05-05 19:09 57,344 --a------ C:\Program Files\tpasdk.dll
2008-05-05 19:09 . 2008-05-05 19:09 53,248 --a------ C:\Program Files\rpau3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 43,088 --a------ C:\Program Files\rpshellsearch.dll
2008-05-05 19:09 . 2008-05-05 19:09 41,472 --a------ C:\Program Files\mmcdda32.dll
2008-05-05 19:09 . 2008-05-05 19:09 36,352 --a------ C:\Program Files\ierjplug.dll
2008-05-05 19:09 . 2008-05-05 19:09 32,768 --a------ C:\Program Files\rpwa3260.dll
2008-05-05 19:09 . 2008-05-05 19:09 19,456 --a------ C:\Program Files\tnetdtct.dll
2008-05-05 19:09 . 2008-05-05 19:09 19,456 --a------ C:\Program Files\rjprog.dll
2008-05-05 19:09 . 2008-05-05 19:09 14,336 --a------ C:\Program Files\wmdmhelper.dll
2008-05-05 19:09 . 2008-05-05 19:09 9,216 --a------ C:\Program Files\rphelperapp.exe
2008-05-05 19:09 . 2008-05-05 19:09 7,168 --a------ C:\Program Files\realjbox.exe
2008-05-05 19:09 . 2008-05-05 19:09 6,656 --a------ C:\Program Files\fixrjb.exe
2008-05-05 19:09 . 2008-05-05 19:09 1,001 --a------ C:\Program Files\autoplaylist.dat
2008-05-05 19:09 . 2008-05-05 19:09 685 --a------ C:\Program Files\RecordingManager.exe.manifest
2008-05-05 19:09 . 2008-05-05 19:09 682 --a------ C:\Program Files\realplay.exe.manifest
2008-05-05 19:09 . 2008-05-05 19:09 480 --a------ C:\Program Files\keys.dat
2008-05-05 19:09 . 2008-05-05 19:09 221 --a------ C:\Program Files\subscription.rnx
2008-05-05 19:09 . 2008-05-05 19:09 71 --a------ C:\Program Files\strs23.dat
2008-05-05 19:09 . 2008-05-05 19:09 15 --a------ C:\Program Files\strs26.dat
2008-04-20 13:44 . 2008-04-20 13:44 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Unigraphics Solutions
2008-04-20 13:30 . 2008-04-20 13:35 <REP> d-------- C:\Program Files\Solid Edge V12
2008-04-19 14:40 . 2008-05-01 15:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TrackMania

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-17 16:00 --------- d-----w C:\Documents and Settings\Fred\Application Data\XnView
2008-05-15 20:17 --------- d-----w C:\Program Files\FlashFXP
2008-05-14 19:31 --------- d-----w C:\Program Files\FlashGet
2008-05-04 18:17 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-01 13:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-28 17:33 --------- d-----w C:\Documents and Settings\Fred\Application Data\Vso
2008-04-20 10:20 --------- d-----w C:\Program Files\Google SketchUp 6
2008-03-29 19:27 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-03-25 04:51 621,344 ----a-w C:\windows\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\windows\system32\msjint40.dll
2008-03-24 12:46 --------- d-----w C:\Program Files\MP3toringtone
2008-03-20 08:09 1,845,376 ----a-w C:\windows\system32\win32k.sys
2008-03-01 12:58 826,368 ----a-w C:\windows\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\windows\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\windows\system32\dnsrslvr.dll
2007-09-09 09:03 47,360 ----a-w C:\Documents and Settings\Fred\Application Data\pcouffin.sys
2007-04-16 15:53 192 --sh--r C:\windows\inf\sdatabl.sav.bin
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_11.07.39.93 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 09:00:58 2,048 --s-a-w C:\windows\bootstat.dat
+ 2008-05-17 16:40:31 2,048 --s-a-w C:\windows\bootstat.dat
- 2008-04-06 05:56:20 19,836,024 ----a-w C:\windows\system32\MRT.exe
+ 2008-05-09 21:35:04 16,863,864 ----a-w C:\windows\system32\MRT.exe
- 2008-05-17 07:55:55 78,228 ----a-w C:\windows\system32\perfc009.dat
+ 2008-05-17 09:53:55 78,228 ----a-w C:\windows\system32\perfc009.dat
- 2008-05-17 07:55:55 95,800 ----a-w C:\windows\system32\perfc00C.dat
+ 2008-05-17 09:53:55 95,800 ----a-w C:\windows\system32\perfc00C.dat
- 2008-05-17 07:55:55 439,224 ----a-w C:\windows\system32\perfh009.dat
+ 2008-05-17 09:53:55 439,224 ----a-w C:\windows\system32\perfh009.dat
- 2008-05-17 07:55:55 511,964 ----a-w C:\windows\system32\perfh00C.dat
+ 2008-05-17 09:53:55 511,964 ----a-w C:\windows\system32\perfh00C.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d2e57eff-1336-40b0-97c9-38b4371ca742}]
2008-05-17 15:02 134144 --a------ C:\windows\system32\uutpbtba.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 18:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 15:07 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ULiRaid5289"="C:\Program Files\ULI5289\ULi5289.exe" [2005-06-07 15:16 409600]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-07-11 11:34 122880]
"CTHelper"="CTHELPER.EXE" [2006-08-17 11:32 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 11:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2004-03-18 10:33 892928]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe]
"NvCplDaemon"="C:\windows\system32\NvCpl.dll" [2007-06-29 00:43 8466432]
"nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\windows\system32\NvMcTray.dll" [2007-06-29 00:43 81920]
"BM3f80a264"="C:\windows\system32\bqwhffgn.dll" [2008-05-17 14:57 125952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-05-06 08:29:21 688128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\AlienGUIse\fastload.dll 2001-12-20 22:34 24576 C:\Program Files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage d'Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage d'Office.lnk
backup=C:\windows\pss\Démarrage d'Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Recherche accélérée.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Recherche accélérée.lnk
backup=C:\windows\pss\Microsoft Recherche accélérée.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"EVEREST AutoStart"=C:\Program Files\Everest Ultimate Edition v.3.0\everest.exe
"ctfmon.exe"=C:\windows\system32\ctfmon.exe
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Device Detector"=DevDetect.exe -autorun
"CTDVDDET"="C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
"ISUSPM Startup"=C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
"SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\FlashGet\\FlashGet.exe"=
"C:\\Program Files\\FileZilla\\FileZilla.exe"=
"C:\\Jeux\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Jeux\\Hellgate London\\Launcher.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Jeux\\Battlefield 2142\\BF2142.exe"=
"C:\\ijji\\ENGLISH\\u_skid.exe"=
"C:\\Jeux\\DriftCity\\DriftCity.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
"C:\\Jeux\\TmUnitedForever\\TmForever.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8352:TCP"= 8352:TCP:BitComet 8352 TCP
"8352:UDP"= 8352:UDP:BitComet 8352 UDP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 m5289;m5289;C:\windows\system32\drivers\m5289.sys [2005-07-04 14:21]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\windows\system32\drivers\sfsync03.sys [2005-12-06 17:11]
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\windows\system32\DRIVERS\agpkx.sys [2005-05-03 17:31]
R3 LCcfltr;Logitech USB Filter Driver;C:\windows\system32\drivers\lccfltr.sys [2004-03-03 10:50]
S1 oreans32;oreans32;C:\windows\system32\drivers\oreans32.sys [2007-07-21 08:50]
S2 UxTuneUp;Extension de conception TuneUp;C:\windows\System32\svchost.exe [2004-08-19 16:10]
S3 ha20x2k;Creative 20X HAL Driver;C:\windows\system32\drivers\ha20x2k.sys [2006-08-17 11:16]
S3 hamachi_oem;PlayLinc Adapter;C:\windows\system32\DRIVERS\gan_adapter.sys [2006-10-19 13:11]
S3 ULI5261XP;ULi M526X Ethernet NT Driver;C:\windows\system32\DRIVERS\ULILAN51.SYS [2005-03-22 20:36]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-11 15:16:03 C:\windows\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-17 18:43:48
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-05-17 18:46:16
ComboFix-quarantined-files.txt 2008-05-17 16:46:15
ComboFix2.txt 2008-05-17 13:29:01
ComboFix3.txt 2008-05-17 12:32:33
ComboFix4.txt 2008-05-17 11:44:28
ComboFix5.txt 2008-05-17 11:22:25

Pre-Run: 33,674,719,232 octets libres
Post-Run: 33,662,332,928 octets libres

239 --- E O F --- 2008-05-17 13:59:10


-----------------------------------------------------------------------------------------------
Et Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:56:07, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\Program Files\ULI5289\ULi5289.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\windows\CTHELPER.EXE
C:\windows\system32\CTXFIHLP.EXE
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Eset\nod32krn.exe
C:\windows\system32\nvsvc32.exe
C:\windows\system32\RUNDLL32.EXE
C:\windows\system32\Rundll32.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\windows\SYSTEM32\CTXFISPI.EXE
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\windows\system32\PnkBstrA.exe
C:\windows\System32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
C:\windows\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\system32\NOTEPAD.EXE
C:\Documents and Settings\Fred\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.diskeeper.com/updates/u [...] atform=x86
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: {247ac173-4b83-9c79-0b04-6331ffe75e2d} - {d2e57eff-1336-40b0-97c9-38b4371ca742} - C:\windows\system32\uutpbtba.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [ULiRaid5289] C:\Program Files\ULI5289\ULi5289.exe
O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BM3f80a264] Rundll32.exe "C:\windows\system32\bqwhffgn.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O18 - Protocol: bw+0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)

--
End of file - 22286 bytes



C'est bon ou non????

Merci enormement pour le temps que tu passe à m'aider.

C'est super sympa.

Juste un question: aprés l'utilisation de Cureit sur le dernier redemarrage avant l'utilisation de combofix, ce dernier redemarrage doit se faire en mode sans echec ou en mode normal??

Merci

Re,

Redémarre normalement.
Puis retourne en mode sans échec pour ComboFix

Le premier lien est en effet invalide, va sur le deuxième

Et celui-là ?
-> http://www.infos-du-net.com/forum/ [...] ]Redémarre en mode sans échec

Tant que j'y suis j'ai repassé un petit coup de HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:48:06, on 18/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Eset\nod32krn.exe
C:\windows\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\windows\system32\PnkBstrA.exe
C:\Program Files\ULI5289\ULi5289.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\windows\CTHELPER.EXE
C:\windows\System32\svchost.exe
C:\windows\system32\CTXFIHLP.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\windows\SYSTEM32\CTXFISPI.EXE
C:\windows\system32\RUNDLL32.EXE
C:\windows\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\system32\wscntfy.exe
C:\Documents and Settings\Fred\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.diskeeper.com/updates/u [...] atform=x86
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [ULiRaid5289] C:\Program Files\ULI5289\ULi5289.exe
O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O18 - Protocol: bw+0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {34D1BCC9-1AB4-4051-8C67-3B7CCB457F5C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)

--
End of file - 21880 bytes

Il me semble que c'est bel et bien fini les soucis avec ce trojan, non??

Cette fois, ça a l'air bon oui?
Nod32 marche correctement ?
Et ZoneAlarm? <- apparemment non.

Re,

Relance HijackThis (clique droit -> lancer en tant qu'adminstrateur sous Vista), do a system scan only, coche ces lignes (si toujours présentes) :

Ferme toutes les applications en cours (particulièrement ton navigateur Internet).
Puis Fix Checked !

Relance HijackThis

• Clique sur Open the Misc Tools Section.
• Choisis Delete an NT Service .
• Tape TUWinStylerThemeSvc et valide.

Fais la même chose avec vsmon

Un service.

Re,

Sélectionne l’intégralité du cadre ci-dessous :

Copie/colle le dans le Bloc-notes (Démarrer\Tous les programmes\Accessoires\Bloc-notes.)
Enregistre le sous sur ton bureau sous le nom de Correction.bat
Double-clique dessus. Poste le rapport généré (si présent).

L'infection est revenue ..

voici le rapport de ton fichier bat:

Rapport commencé sur l'ordinateur de Fred le 18/05/2008 @ 15:43:55,12


****** Désactivation des services ******

Le service TUWinStylerThemeSvc a bien été désactivé.
Le service vsmon a bien été désactivé.

****** Suppression des services ******

Le service TUWinStylerThemeSvc a bien été supprimé.
Le service vsmon a bien été supprimé.

Rapport terminé à 15:43:55,73

Re,

On recommence ..

Repasse ComboFix, poste son rapport.

Re,

Sélectionne l'intégralité du cadre ci-dessous :

Cela va relancer Combofix. Après redémarrage, poste le contenu du rapport ComboFix.txt.
S'il n'y a pas de rédémarrage, poste quand même le rapport.

• Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
• Enregistre le sous sur ton bureau sous le nom de CFScript.txt
• Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :

• Cela va relancer Combofix. Poste le contenu du rapport ComboFix.txt après redémarrage s'il y en a un.

ça semble Ok,

reposte un Hijack'

Re,

Télécharge Clean (de Malekal) sur ton Bureau.

• Dézippe le sur ton bureau. Double-clic sur le dossier Clean qui vient d'apparaître.
• Double-clic sur Clean.cmd. (L’extension cmd peut ne pas apparaître) Cela va ouvrir une fenêtre noire.
• Un menu va apparaître, choisis l'option 1 puis entrée. Ensuite appuies sur une touche comme il te sera demandé.
• Poste le rapport qui se trouve ici : C:\rapport_clean.txt

Si tu obtiens un fichier C:\upload_moi.zip, merci de faire ceci.

Aide : Comment utiliser Clean.

Re,

Télécharge MalwareByte's Anti-Malware sur ton Bureau.

• Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.

Une fois l'installation et la mise à jour effectuées :
Redémarre en mode sans échec
/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\

• Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".
• Afin de lancer la recherche, clic sur"Rechercher".
• Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :

-- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
-- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.

REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.

Aide : Comment utiliser MBAM.

**********

Toujours en mode sans échec :

• Relance Clean
• Fais l’option 2 cette fois-ci et poste le rapport.
• Le rapport se trouve ici : C:\rapport_clean.txt

Aide : Comment utiliser Clean.

Voila donc les deux rapport que tu m'a demandé:

Malwarebytes's:

Malwarebytes' Anti-Malware 1.12
Version de la base de données: 762

Type de recherche: Examen complet (C:\|)
Eléments examinés: 192819
Temps écoulé: 58 minute(s), 23 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Clean:

Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 19/05/2008 a 18:57:11,21

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:

*** Suppression des fichiers dans C:\windows\

*** Suppression des fichiers dans C:\windows\system32
tentative de suppression de C:\windows\system32\SpoonUninstall.exe

*** Suppression des fichiers dans C:\Program Files

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !

Merci.

Je lance le scan et envoi le rapport des qu'il est disponible.

Le scan a tourné toute la nuit, il a trouvé des trucs, mais impossible d'accéder a l'enregistrement du rapport !!!!!!

bonjour
comme tu veux, je veux surtout voir un rapport de scan

re

c'est ok

d'autres soucis?