Bonjour, J'ai beaucoup de virus.
J'ai passé spybot,avast,AD-aware j'ai pu éffacé des virus et ensuite je les ai repassé encore une fois en mode sans échec et j'ai trouvé les même virus donc j'ai repassé spybot,avast et AD-aware en mode normal et les virus y été encore.
Ensuite mes moteurs de recherche et autres sites sauf quelques exception comme celui-ci.
Je voudrais que quelqu'un m'aide pour réparer ce problème(en excluant le formatage).
Je possède un windows SP2, je vous fais part de mon rapport hijackthis



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:54:55, on 26/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\802.11 Wireless LAN\802.11b Wireless CardBus & PCI Adapter HW.11 V1.10\WlanCU.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Documents and Settings\Nicolas\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://faq.wow-europe.com/fr/article.php?id=876
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SeekmoOE] C:\Program Files\Seekmo\bin\10.0.341.0\OEAddOn.exe
O4 - HKLM\..\Run: [SeekmoSA] "C:\Program Files\Seekmo\bin\10.0.341.0\SeekmoSA.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [dca0aa7c] rundll32.exe "C:\WINDOWS\system32\ausefcea.dll",b
O4 - HKLM\..\Run: [BMdf9399e0] Rundll32.exe "C:\WINDOWS\system32\fexpswbp.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\802.11 Wireless LAN\802.11b Wireless CardBus & PCI Adapter HW.11 V1.10\WlanCU.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 6798 bytes




Merci de m'aider,Au revoir.
(Excusez-moi de m'être trompé de rubrique :s.)

Bonsoir,

Télécharge ComboFix (de sUBs) sur ton Bureau.

• Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
• Double clique sur ComboFix.exe.
• Accepte la licence en cliquant sur Oui.
• Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

Aide : Comment utiliser ComboFix.

Ben voila merci pour ceci déjà et maintenant je te poste le rapport :

ComboFix 08-07-26.1 - Nicolas 2008-07-26 22:42:59.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.569 [GMT 2:00]
Endroit: C:\Documents and Settings\Nicolas\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\André\Application Data\Seekmo
C:\Documents and Settings\Nico\Application Data\Seekmo
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\1383356.sdf
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\3852203.sdf
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\domains.txt
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\1000027037
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\1000032954
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\22254
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\26664
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\34237
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\34513
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\372500
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\42208
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\44320
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\576702
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\6612
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\dynamic\TooltipXML\66836
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\btntrans.idx
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\btntrans1.dat
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\components.cdf
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\cursors.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_1000.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_2000.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_3000.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_bar.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_bbar1.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_logos.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_buttons_other.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\d_icons_weather.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\default.cdf
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_511745-514279.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_categorize.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_comparison.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_explorer-Mails.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_explorer-people.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_favorites.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Games.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Hide.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_hotbarcom.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Hotmail.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_hsskin.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_Mails.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_new.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_premium.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_searchfor.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_searchgo.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_weather.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Default_yellowpages.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\email-def-511724-548964.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\email-def-511724-9595.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\email-t1-bg.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\icons2.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\ie_games_icon.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\ie_video.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\keywords.idx
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\keywords1.dat
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\layout.cdf
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\linkpathlegal.txt
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\progress.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\s_icons_buttons.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\sales_buttons.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\seekmo.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\seekmo_ie_menu.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\t2_bg.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\theweb.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\top7.cdf
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\Top7_theweb.mnu
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\2\tsd_bg.res
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\BtnTrans.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\BtnTrans1.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\buttondir.txt
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\buttondir.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\cursors.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_1000.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_2000.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_3000.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_bar.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_bbar1.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_logos.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_buttons_other.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\d_icons_weather.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\default.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\icons2.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\ie_games_icon.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\ie_video.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\keywords.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\keywords1.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\layout.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\progress.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\s_icons_buttons.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\sales_buttons.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\samplegroups2.txt
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\samplegroups2.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\seekmo.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\seekmo_ie_menu.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\t2_bg.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\top7.xip
C:\Documents and Settings\Nico\Application Data\Seekmo\v3.0\Seekmo\static\DownLoad\tsd_bg.xip
C:\WINDOWS\BMdf9399e0.txt
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aecfesua.ini
C:\WINDOWS\system32\ajlfwwfu.dll
C:\WINDOWS\system32\ausefcea.dll
C:\WINDOWS\system32\byhfgrwg.dll
C:\WINDOWS\system32\cbXRHwvt.dll
C:\WINDOWS\system32\clidbxjr.dll
C:\WINDOWS\system32\crcrgdcs.dll
C:\WINDOWS\system32\csrfaejw.ini
C:\WINDOWS\system32\fexpswbp.dll
C:\WINDOWS\system32\FNUBHggh.ini
C:\WINDOWS\system32\FNUBHggh.ini2
C:\WINDOWS\system32\gtmahktb.dll
C:\WINDOWS\system32\jsdutchk.dll
C:\WINDOWS\system32\KSsvyyxx.ini
C:\WINDOWS\system32\KSsvyyxx.ini2
C:\WINDOWS\system32\leaiuf.dll
C:\WINDOWS\system32\lymunogl.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mqnqgduu.ini
C:\WINDOWS\system32\mqqlpxrp.dll
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\otnuwexs.dll
C:\WINDOWS\system32\plnleyas.ini
C:\WINDOWS\system32\pmnlMcDw.dll
C:\WINDOWS\system32\povzzk.dll
C:\WINDOWS\system32\pwpfxx.dll
C:\WINDOWS\system32\qoapjjnm.dll
C:\WINDOWS\system32\qopgxahp.dll
C:\WINDOWS\system32\uhwtpphh.ini
C:\WINDOWS\system32\uudgqnqm.dll
C:\WINDOWS\system32\vggaoy.dll
C:\WINDOWS\system32\vlgakbcw.dll
C:\WINDOWS\system32\wDcMlnmp.ini
C:\WINDOWS\system32\wDcMlnmp.ini2
C:\WINDOWS\system32\xxyyvsSK.dll
C:\WINDOWS\system32\zlgyxn.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-26 to 2008-07-26 ))))))))))))))))))))))))))))))))))))
.

2008-07-26 13:16 . 2008-07-26 13:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-26 13:15 . 2008-07-26 13:15 65,536 ---hs---- C:\Documents and Settings\Nicolas\MediaTubeCodec_ver1.1463.0.exe
2008-07-25 00:11 . 2008-07-25 00:11 <REP> d-------- C:\Program Files\mIRC
2008-07-24 20:56 . 2008-07-26 15:45 <REP> d-------- C:\Program Files\PKR
2008-07-24 14:08 . 2008-07-24 14:15 585 --a------ C:\WINDOWS\DR2.INI
2008-07-22 21:57 . 2008-07-26 22:41 111,562 --a------ C:\WINDOWS\BMdf9399e0.xml
2008-07-22 21:57 . 2008-07-23 14:57 43,641 ---hs---- C:\WINDOWS\system32\bndjikql.ini
2008-07-22 21:51 . 2008-07-23 15:02 <REP> d-------- C:\Program Files\Serious Sam 2
2008-07-22 16:25 . 2008-07-22 16:25 <REP> d-------- C:\Program Files\DAEMON Tools
2008-07-21 15:10 . 2008-07-21 15:10 <REP> d-------- C:\Diablo
2008-07-21 15:10 . 2008-07-21 15:10 86,528 --a------ C:\WINDOWS\bnetunin.exe
2008-07-21 15:10 . 2008-07-21 15:10 61,440 --a------ C:\WINDOWS\diabunin.exe
2008-07-21 13:10 . 2008-07-21 13:10 <REP> d-------- C:\Program Files\Guitar Pro 5
2008-07-21 13:07 . 2008-07-21 13:07 <REP> d-------- C:\Program Files\PowerISO
2008-07-21 02:11 . 2008-07-21 02:11 <REP> d-------- C:\Program Files\1964
2008-07-20 21:32 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe
2008-07-20 13:32 . 2008-07-25 17:37 <REP> d-------- C:\Program Files\Project64 1.6
2008-07-20 13:24 . 2008-07-20 13:24 <REP> d-------- C:\Program Files\StepMania CVS
2008-07-20 10:40 . 2008-07-20 10:41 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\fretsonfire
2008-07-08 14:19 . 2008-07-08 14:19 <REP> d-------- C:\HSF
2008-07-08 14:19 . 2008-07-20 20:54 34 --a------ C:\WINDOWS\WINDOWS.PÏP
2008-07-08 14:16 . 2008-07-08 14:16 <REP> d-------- C:\PLANETE PERMIS
2008-07-08 14:16 . 2008-07-20 20:54 26 --a------ C:\WINDOWS\WD.INI
2008-07-07 09:40 . 2008-07-07 09:40 56,108 --a------ C:\WINDOWS\system32\drivers\scdemu.sys
2008-07-02 19:11 . 2008-07-24 10:28 <REP> d-------- C:\Program Files\PokerStars
2008-07-01 17:15 . 2008-07-10 14:54 <REP> d-------- C:\Program Files\Frets on Fire
2008-06-28 15:40 . 2008-06-28 15:40 <REP> d-------- C:\Program Files\DivX

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-26 16:52 --------- d-----w C:\Program Files\Steam
2008-07-26 11:16 --------- d-----w C:\Program Files\Lavasoft
2008-07-26 11:16 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-26 11:15 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\uTorrent
2008-07-26 11:05 --------- d-----w C:\Program Files\Sony
2008-07-26 11:02 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-20 10:57 1,775 ----a-w C:\WINDOWS\OEM0.tmp
2008-07-20 10:50 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2008-07-16 20:45 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-16 08:08 --------- d-----w C:\Program Files\World of Warcraft
2008-06-27 17:46 --------- d-----w C:\Program Files\torrent
2008-06-25 07:05 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-06-25 07:05 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\DAEMON Tools
2008-06-24 11:31 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\teamspeak2
2008-06-22 15:22 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-06-17 09:07 --------- d-----w C:\Program Files\WowCartographe
2008-06-11 20:56 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-11 20:56 --------- d-----w C:\Program Files\Realtek
2008-06-11 17:08 69,632 ----a-w C:\WINDOWS\uinst001.exe
2008-06-10 08:53 --------- d-----w C:\Program Files\MSN Messenger
2008-06-03 20:42 98,304 ----a-w C:\WINDOWS\DUMP6a14.tmp
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 12:55 5674352]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-22 23:47 68856]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools\daemon.exe" [2008-07-17 14:20 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 22:05 344064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-10-22 22:45 185632]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-07-07 09:34 167936]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 49152 C:\WINDOWS\KHALMNPR.Exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-27 08:20 16844800 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2007-08-03 07:22 1826816 C:\WINDOWS\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage d'Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage d'Office.lnk
backup=C:\WINDOWS\pss\Démarrage d'Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Recherche accélérée.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Recherche accélérée.lnk
backup=C:\WINDOWS\pss\Microsoft Recherche accélérée.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 04:34 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2006-07-21 10:14 86016 C:\WINDOWS\SoundMan.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\aMSN\\bin\\wish.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Steam\\steamapps\\sasuke123336\\counter-strike\\hl.exe"=
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\Nicolas\\Bureau\\Blobby Volley\\volley.exe"=
"C:\\Program Files\\EA GAMES\\MOHDA\\MOHAA.exe"=
"C:\\Program Files\\TrackMania United\\TmUnited.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\StepMania CVS\\Program\\StepMania.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
"C:\\Program Files\\Steam\\steamapps\\sasuke123336\\condition zero\\hl.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader
"53:UDP"= 53:UDP:WoW
"2713:UDP"= 2713:UDP:Windows Media Format SDK (firefox.exe)
"2712:UDP"= 2712:UDP:Windows Media Format SDK (firefox.exe)
"2723:UDP"= 2723:UDP:Windows Media Format SDK (firefox.exe)
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 trm3x5;trm3x5;C:\WINDOWS\system32\DRIVERS\trm3x5.sys [1999-06-16 18:26]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 rtl8180;IEEE 802.11b Wireless Cardbus/PCI Adapter;C:\WINDOWS\system32\DRIVERS\rtl8180.SYS [2003-12-03 11:47]
R3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 08:57]
S3 PPJoyBus;Parallel Port Joystick Bus device driver;C:\WINDOWS\system32\drivers\PPJoyBus.sys [2004-10-24 08:11]
S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE2Ebus.sys [2006-11-10 18:23]
S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE2Emdfl.sys [2006-11-10 18:23]
S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE2Emdm.sys [2006-11-10 18:23]
S3 SE2Emgmt;Sony Ericsson Device 046 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE2Emgmt.sys [2006-11-10 18:23]
S3 se2End5;Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (NDIS);C:\WINDOWS\system32\DRIVERS\se2End5.sys [2006-11-10 18:23]
S3 SE2Eobex;Sony Ericsson Device 046 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE2Eobex.sys [2006-11-10 18:23]
S3 se2Eunic;Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (WDM);C:\WINDOWS\system32\DRIVERS\se2Eunic.sys [2006-11-10 18:24]
S3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\tnet1130.sys []
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 14:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fcd53d06-9757-11db-bb79-806d6172696f}]
\Shell\AutoRun\command - F:\setupSNK.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{137D2C53-280A-277A-0705-040707040403}]
C:\WINDOWS\svchost.exe
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
2008-07-18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - ::C:\Program Files\Apple Software Update\SoftwareUpdate.exe-taskSYSTEM0 []
.
- - - - ORPHANS REMOVED - - - -

BHO-{650D562C-549D-4C00-BE5C-CF5C7C7896B3} - C:\WINDOWS\system32\hggHBUNF.dll
HKCU-Run-LDM - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
HKLM-Run-Adobe Photo Downloader - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
HKLM-Run-dca0aa7c - C:\WINDOWS\system32\uudgqnqm.dll
HKLM-Run-BMdf9399e0 - C:\WINDOWS\system32\qoapjjnm.dll


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Search Page = hxxp://www.google.com
R0 -: HKCU-Main,Search Bar = hxxp://www.google.com/ie
R0 -: HKLM-Main,Default_Search_URL = hxxp://www.google.com/ie
R0 -: HKCU-Search,SearchAssistant = hxxp://www.google.com/ie
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
R0 -: HKLM-Search,SearchAssistant = hxxp://www.google.com/ie
O8 -: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 -: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 -: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 -: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 -: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-26 22:58:14
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\802.11 Wireless LAN\802.11b Wireless CardBus & PCI Adapter HW.11 V1.10\WlanCU.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.bin
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-26 23:05:10 - machine was rebooted [C‚line]
ComboFix-quarantined-files.txt 2008-07-26 21:05:07

Pre-Run: 66,861,600,768 octets libres
Post-Run: 69,181,034,496 octets libres

344 --- E O F --- 2008-07-22 16:00:22

Re,

Sélectionne l'intégralité du cadre ci-dessous :

• Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
• Enregistre le sous sur ton bureau sous le nom de CFScript.txt
• Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :

• Cela va relancer Combofix.
• ComboFix créera ces fichiers sur ton Bureau :

- Un fichier zippé nommé Submit [Date Time].zip
- Un second fichier nommé - CF-Submit.htm

• ComboFix peut exiger un redémarrage pour compléter son travail. Accepte.
• Lorsque l'outil aura terminé, un rapport ComboFix.log apparaîtra à l'écran.
• Une nouvelle fenêtre avec invite "Submit Files for further analysis" s'ouvrira. Clique "OK"
• Ton navigateur se lancera automatiquement avec le fichier CF-Submit.htm et une fenêtre s'ouvrira :

- Clique sur le bouton "Browse"("Parcourir" ) et navigue vers le fichier
Submit [Date Time].zip qui est sur ton Bureau.
- Clique sur le fichier afin de le sélectionner.

• Soumets le fichier en cliquant "OK"
• Lorsque cette opération sera complétée, tu peux supprimer ces deux fichiers qui se trouvent sur ton Bureau.

Poste le contenu du rapport ComboFix.txt après redémarrage s'il y en a un.

-----------------

Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
- Coche Afficher les fichiers et dossiers cachés
- Décoche Masquer les extensions des fichiers dont le type est connu
- Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)
clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal

• Clique sur Parcourir en haut, choisis Poste de travail et cherche ce fichier : C:\WINDOWS\DR2.INI
• Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
• Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
• Lorsque l'analyse est terminée ("Situation actuelle: terminé" ), clique sur Formaté
• Une nouvelle fenêtre de ton navigateur va apparaître
• Clique alors sur cette image :
• Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
• Enfin colle le résultat dans ta prochaine réponse.

Re je vais vous posté le rapport mais dois-je continué à partir de
"Poste le contenu du rapport ComboFix.txt après redémarrage s'il y en a un" où devrais-je suivre ce que vous allez me dire en réponse de ce post et laisser tomber l'autre ?

Rapport ComboFix :



ComboFix 08-07-26.1 - Nicolas 2008-07-27 12:57:34.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.582 [GMT 2:00]
Endroit: C:\Documents and Settings\Nicolas\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Nicolas\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BMdf9399e0.xml
C:\WINDOWS\system32\bndjikql.ini

.
((((((((((((((((((((((((((((( Fichiers créés 2008-06-27 to 2008-07-27 ))))))))))))))))))))))))))))))))))))
.

2008-07-27 12:51 . 2008-07-27 12:51 <REP> d-------- C:\WINDOWS\LastGood
2008-07-26 23:05 . 2008-07-26 23:05 <REP> d-------- C:\Documents and Settings\CÚline
2008-07-26 23:05 . 2008-07-26 23:05 <REP> d-------- C:\Documents and Settings\AndrÚ
2008-07-26 13:16 . 2008-07-26 13:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-26 13:15 . 2008-07-26 13:15 65,536 ---hs---- C:\Documents and Settings\Nicolas\MediaTubeCodec_ver1.1463.0.exe
2008-07-25 00:11 . 2008-07-25 00:11 <REP> d-------- C:\Program Files\mIRC
2008-07-24 20:56 . 2008-07-26 15:45 <REP> d-------- C:\Program Files\PKR
2008-07-24 14:08 . 2008-07-24 14:15 585 --a------ C:\WINDOWS\DR2.INI
2008-07-22 21:51 . 2008-07-23 15:02 <REP> d-------- C:\Program Files\Serious Sam 2
2008-07-22 16:25 . 2008-07-22 16:25 <REP> d-------- C:\Program Files\DAEMON Tools
2008-07-22 16:24 . 2008-07-22 16:24 <REP> d-------- C:\Documents and Settings\Céline\Application Data\DAEMON Tools
2008-07-22 16:24 . 2008-07-22 16:24 <REP> d-------- C:\Documents and Settings\Céline\Application Data\DAEMON Tools
2008-07-22 16:24 . 2008-07-22 16:24 <REP> d-------- C:\Documents and Settings\Céline\Application Data\DAEMON Tools
2008-07-21 15:10 . 2008-07-21 15:10 <REP> d-------- C:\Diablo
2008-07-21 15:10 . 2008-07-21 15:10 86,528 --a------ C:\WINDOWS\bnetunin.exe
2008-07-21 15:10 . 2008-07-21 15:10 61,440 --a------ C:\WINDOWS\diabunin.exe
2008-07-21 13:10 . 2008-07-21 13:10 <REP> d-------- C:\Program Files\Guitar Pro 5
2008-07-21 13:07 . 2008-07-21 13:07 <REP> d-------- C:\Program Files\PowerISO
2008-07-21 02:11 . 2008-07-21 02:11 <REP> d-------- C:\Program Files\1964
2008-07-20 21:32 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe
2008-07-20 13:32 . 2008-07-25 17:37 <REP> d-------- C:\Program Files\Project64 1.6
2008-07-20 13:24 . 2008-07-20 13:24 <REP> d-------- C:\Program Files\StepMania CVS
2008-07-20 10:40 . 2008-07-20 10:41 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\fretsonfire
2008-07-14 19:54 . 2008-07-14 20:57 <REP> d-------- C:\Documents and Settings\Céline\Application Data\Teeworlds
2008-07-14 19:54 . 2008-07-14 20:57 <REP> d-------- C:\Documents and Settings\Céline\Application Data\Teeworlds
2008-07-14 19:54 . 2008-07-14 20:57 <REP> d-------- C:\Documents and Settings\Céline\Application Data\Teeworlds
2008-07-08 14:19 . 2008-07-08 14:19 <REP> d-------- C:\HSF
2008-07-08 14:19 . 2008-07-20 20:54 34 --a------ C:\WINDOWS\WINDOWS.P¤P
2008-07-08 14:16 . 2008-07-08 14:16 <REP> d-------- C:\PLANETE PERMIS
2008-07-08 14:16 . 2008-07-20 20:54 26 --a------ C:\WINDOWS\WD.INI
2008-07-07 09:40 . 2008-07-07 09:40 56,108 --a------ C:\WINDOWS\system32\drivers\scdemu.sys
2008-07-02 19:11 . 2008-07-24 10:28 <REP> d-------- C:\Program Files\PokerStars
2008-07-01 17:15 . 2008-07-10 14:54 <REP> d-------- C:\Program Files\Frets on Fire
2008-07-01 17:15 . 2008-07-01 17:15 <REP> d-------- C:\Documents and Settings\Céline\Application Data\fretsonfire
2008-07-01 17:15 . 2008-07-01 17:15 <REP> d-------- C:\Documents and Settings\Céline\Application Data\fretsonfire
2008-07-01 17:15 . 2008-07-01 17:15 <REP> d-------- C:\Documents and Settings\Céline\Application Data\fretsonfire
2008-06-28 15:40 . 2008-06-28 15:40 <REP> d-------- C:\Program Files\DivX

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-27 10:53 --------- d-----w C:\Documents and Settings\Céline\Application Data\OpenOffice.org2
2008-07-27 10:53 --------- d-----w C:\Documents and Settings\Céline\Application Data\OpenOffice.org2
2008-07-27 10:53 --------- d-----w C:\Documents and Settings\Céline\Application Data\OpenOffice.org2
2008-07-26 16:52 --------- d-----w C:\Program Files\Steam
2008-07-26 11:16 --------- d-----w C:\Program Files\Lavasoft
2008-07-26 11:16 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-26 11:15 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\uTorrent
2008-07-26 11:05 --------- d-----w C:\Program Files\Sony
2008-07-26 11:02 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-25 16:53 --------- d-----w C:\Documents and Settings\Céline\Application Data\uTorrent
2008-07-25 16:53 --------- d-----w C:\Documents and Settings\Céline\Application Data\uTorrent
2008-07-25 16:53 --------- d-----w C:\Documents and Settings\Céline\Application Data\uTorrent
2008-07-24 23:25 --------- d-----w C:\Documents and Settings\Céline\Application Data\mIRC
2008-07-24 23:25 --------- d-----w C:\Documents and Settings\Céline\Application Data\mIRC
2008-07-24 23:25 --------- d-----w C:\Documents and Settings\Céline\Application Data\mIRC
2008-07-20 10:57 1,775 ----a-w C:\WINDOWS\OEM0.tmp
2008-07-20 10:50 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2008-07-16 20:45 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-16 18:26 --------- d-----w C:\Documents and Settings\Céline\Application Data\teamspeak2
2008-07-16 18:26 --------- d-----w C:\Documents and Settings\Céline\Application Data\teamspeak2
2008-07-16 18:26 --------- d-----w C:\Documents and Settings\Céline\Application Data\teamspeak2
2008-07-16 08:08 --------- d-----w C:\Program Files\World of Warcraft
2008-06-27 17:46 --------- d-----w C:\Program Files\torrent
2008-06-25 07:05 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-06-25 07:05 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\DAEMON Tools
2008-06-24 11:31 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\teamspeak2
2008-06-22 15:22 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-06-17 09:07 --------- d-----w C:\Program Files\WowCartographe
2008-06-14 09:53 3,727,720 ----a-w C:\WINDOWS\system32\d3dx9_35.dll
2008-06-11 20:56 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-11 20:56 --------- d-----w C:\Program Files\Realtek
2008-06-11 17:08 69,632 ----a-w C:\WINDOWS\uinst001.exe
2008-06-10 08:53 --------- d-----w C:\Program Files\MSN Messenger
2008-06-03 20:42 98,304 ----a-w C:\WINDOWS\DUMP6a14.tmp
2008-05-23 19:41 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-05-22 22:20 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-16 09:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
.

((((((((((((((((((((((((((((( snapshot@2008-07-26_23.04.52,43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-27 10:47:54 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6f0.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 04:34 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 22:05 344064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 49152 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

C:\Documents and Settings\Andr‚\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 22:57:56 393216]

C:\Documents and Settings\C‚line\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 22:57:56 393216]
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2008-05-24 18:21:25 2746104]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-08-18 14:25:15 434176]
Wireless Configuration Utility.lnk - C:\Program Files\802.11 Wireless LAN\802.11b Wireless CardBus & PCI Adapter HW.11 V1.10\WlanCU.exe [2003-08-08 11:24:02 425984]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage d'Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage d'Office.lnk
backup=C:\WINDOWS\pss\Démarrage d'Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Recherche accélérée.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Recherche accélérée.lnk
backup=C:\WINDOWS\pss\Microsoft Recherche accélérée.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 04:34 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2006-07-21 10:14 86016 C:\WINDOWS\SoundMan.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\aMSN\\bin\\wish.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Steam\\steamapps\\sasuke123336\\counter-strike\\hl.exe"=
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\Nicolas\\Bureau\\Blobby Volley\\volley.exe"=
"C:\\Program Files\\EA GAMES\\MOHDA\\MOHAA.exe"=
"C:\\Program Files\\TrackMania United\\TmUnited.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\StepMania CVS\\Program\\StepMania.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
"C:\\Program Files\\Steam\\steamapps\\sasuke123336\\condition zero\\hl.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader
"53:UDP"= 53:UDP:WoW
"2713:UDP"= 2713:UDP:Windows Media Format SDK (firefox.exe)
"2712:UDP"= 2712:UDP:Windows Media Format SDK (firefox.exe)
"2723:UDP"= 2723:UDP:Windows Media Format SDK (firefox.exe)
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 trm3x5;trm3x5;C:\WINDOWS\system32\DRIVERS\trm3x5.sys [1999-06-16 18:26]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 rtl8180;IEEE 802.11b Wireless Cardbus/PCI Adapter;C:\WINDOWS\system32\DRIVERS\rtl8180.SYS [2003-12-03 11:47]
R3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 08:57]
S3 PPJoyBus;Parallel Port Joystick Bus device driver;C:\WINDOWS\system32\drivers\PPJoyBus.sys [2004-10-24 08:11]
S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE2Ebus.sys [2006-11-10 18:23]
S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE2Emdfl.sys [2006-11-10 18:23]
S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE2Emdm.sys [2006-11-10 18:23]
S3 SE2Emgmt;Sony Ericsson Device 046 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE2Emgmt.sys [2006-11-10 18:23]
S3 se2End5;Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (NDIS);C:\WINDOWS\system32\DRIVERS\se2End5.sys [2006-11-10 18:23]
S3 SE2Eobex;Sony Ericsson Device 046 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE2Eobex.sys [2006-11-10 18:23]
S3 se2Eunic;Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (WDM);C:\WINDOWS\system32\DRIVERS\se2Eunic.sys [2006-11-10 18:24]
S3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\tnet1130.sys []
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 14:00]

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
2008-07-18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - ::C:\Program Files\Apple Software Update\SoftwareUpdate.exe-taskSYSTEM0 []
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-swg - C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-27 13:01:11
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...