Virus, spyware et bug informatiques...

Salut à tous !

Bon j'ai un problème qui s'avère de plus EN PLUS EMM*RDANT !!... hum... bref j'ai comme un soupçon sur le fait que j'ai été contaminé par un virus (mon pc hein ?). J'avoue j'ai eu un pti indice

ERREUR: surement due au virus... je ne peux pas uploader d'image, sur aucun site... bref ce que je voulais envoyer, c'était mon fond d'écran qui est tout blanc avec une "fausse" fenêtre : "Windows Warning Message", et en tire : "WARNING ! Spyware detected on your computer !" et "install an antivirus or spyware remover to clean your computer"...



a part ça, ya d'autres symptômes comme par exemple si je lance la recherche "idn" sur google, lorsque je clique sur "info du net" ça m'envoie là:
http://206.161.121.82/search.php?i [...] 1708219327

ou alors je reçois de nombreuses publicités, ce qui ne m'étais pas arrivé depuis loooongtemps...

Bref, j'ai besoin d'aide. Merci d'avance !

ça risque d'être plus compliqué... je ne peux pas télécharger de logiciel sur aucun site... bon je vais essayer de me le faire envoyer par mail. J'éditerais ce message pour le log.

ps: t'en fais pas pour ta vie privée ^^ je sais comment fonctionne un forum même si je suis tout nouveau sur celui là

dsl pour le temps de réponse mais j'ai du me connecter dans un cybercafé pck à cause du virus je n'arrive plus a poster sur mon propre pc... et un pote m'a passé hijackthis via clé usb: voici donc le rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:58:18, on 26/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Valve\Steam\Steam.exe
c:\program files\valve\steam\steamapps\fatal1ty22\sourcesdk\bin\SDKLauncher.exe
c:\program files\valve\steam\steamapps\fatal1ty22\sourcesdk\bin\ep1\bin\hammer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mumble\mumble.exe
C:\Program Files\Mumble\bin\dbus-daemon.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fluo.com/?m=We are all full of lies
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf/chicmt.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [lphce53j0e307] C:\WINDOWS\system32\lphce53j0e307.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .tga: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 1713466031
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7DC66C69-F747-49D4-B45A-B2AF890DF4D9}: Domain = chicmt.aquisante.fr
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - Unknown owner - C:\WINDOWS\System32\FTRTSVC.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
O24 - Desktop Component 0: (no name) - http://fc04.deviantart.com/fs10/i/ [...] _mucho.jpg

--
End of file - 9709 bytes

encore dsl pour le temps de réponse mais je ne peux pas poster depuis mon pc... bref voici le rapport combo-fix qui a mis du temps avant de fonctionner car il détéctait des rootkits donc j'ai du nettoyer mon pc avec bit defender:


ComboFix 07-12-21.4 - Hugo 2007-12-29 9:40:14.2 - NTFSx86
Running from: C:\Documents and Settings\Hugo\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Hugo\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\dcads-remove.exe
C:\WINDOWS\system32\dcads_sidebar.dll
C:\WINDOWS\system32\dcads_sidebar_uninstall.exe
C:\WINDOWS\system32\superiorads-uninst.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Hugo\Application Data\ShopperReports
C:\Documents and Settings\Hugo\Application Data\ShopperReports\cs\Config.xml
C:\Documents and Settings\Hugo\Application Data\ShopperReports\cs\db\Aliases.dbs
C:\Documents and Settings\Hugo\Application Data\ShopperReports\cs\db\Sites.dbs
C:\Documents and Settings\Hugo\Application Data\ShopperReports\cs\dwld\WhiteList.xip
C:\Documents and Settings\Hugo\Application Data\ShopperReports\cs\persist.dbs
C:\Documents and Settings\Hugo\Application Data\ShopperReports\cs\report\aggr_storage.xml
C:\Documents and Settings\Hugo\Application Data\ShopperReports\cs\report\send_storage.xml
C:\Documents and Settings\Hugo\Application Data\ShopperReports\cs\res2\WhiteList.dbs
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198012392.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198012453.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198012514.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198012575.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198012636.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198012697.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198012758.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198012819.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198012880.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198012941.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198013002.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198013063.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198013124.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198013185.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198013246.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198013307.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198013393.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198172188.log
C:\Documents and Settings\Hugo\Application Data\ShopperReports\shprrprt_1198172614.log
C:\Documents and Settings\MAMAN\Application Data\ShopperReports
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\cs\Config.xml
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\cs\db\Aliases.dbs
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\cs\db\Sites.dbs
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\cs\dwld\WhiteList.xip
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\cs\persist.dbs
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\cs\report\aggr_storage.xml
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\cs\report\send_storage.xml
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\cs\res2\WhiteList.dbs
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\shprrprt.log
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\shprrprt_1197222441.log
C:\Documents and Settings\MAMAN\Application Data\ShopperReports\shprrprt_1197222876.log
C:\Program Files\ContextTool\ContextHelper.dat
C:\Program Files\ContextTool\ContextTool-1.dll
C:\Program Files\ContextTool\pcre3.dll
C:\Program Files\ContextTool\uninstall.exe
C:\Program Files\Dcads Games Collection
C:\Program Files\Dcads Games Collection\BattlesOfHelicopters.exe
C:\Program Files\Dcads Games Collection\BobAndBill.exe
C:\Program Files\Dcads Games Collection\CrazyBlocks.exe
C:\Program Files\Dcads Games Collection\Lines.exe
C:\Program Files\Dcads Games Collection\uninstall.exe
C:\Program Files\Dcads Games Collection\VideoPool.exe
C:\Program Files\PlayMP3z
C:\Program Files\PlayMP3z\PlayMP3.exe
C:\Program Files\PlayMP3z\uninstall.exe
C:\WINDOWS\system32\dcads-remove.exe
C:\WINDOWS\system32\dcads_sidebar.dll
C:\WINDOWS\system32\dcads_sidebar_uninstall.exe
C:\WINDOWS\system32\superiorads-uninst.exe
C:\Program Files\ContextTool

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-28 to 2007-12-29 ))))))))))))))))))))))))))))))))))))
.

2007-12-25 01:19 . 2007-12-25 01:19 <REP> d-------- C:\Documents and Settings\Hugo\Application Data\Application Data
2007-12-12 23:05 . 2007-12-12 23:07 1,393 --a------ C:\WINDOWS\imsins.BAK
2007-12-12 20:33 . 2007-12-12 20:33 13,266 --a------ C:\papi nouyel seek.jpg
2007-12-10 20:32 . 2007-12-23 23:59 21,017 --a------ C:\hey papi c'est nouyel !!.jpg
2007-12-06 19:50 . 2007-12-06 19:50 <REP> d-------- C:\Program Files\MSXML 6.0
2007-12-06 19:47 . 2007-12-06 19:47 <REP> d-------- C:\Program Files\MSBuild
2007-12-06 19:43 . 2007-12-06 19:49 <REP> d-------- C:\WINDOWS\system32\XPSViewer
2007-12-06 19:42 . 2007-12-06 19:42 <REP> d-------- C:\Program Files\Reference Assemblies
2007-12-06 19:40 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2007-12-06 19:04 . 2007-10-11 00:49 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-12-06 19:04 . 2007-04-17 10:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-12-06 19:04 . 2007-03-08 06:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-12-06 19:04 . 2007-10-11 00:49 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-12-06 19:04 . 2007-10-11 00:49 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-12-06 19:04 . 2007-10-11 00:49 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-12-06 19:04 . 2007-10-11 00:49 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2007-12-06 19:04 . 2007-10-11 00:49 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-12-06 19:04 . 2007-10-10 11:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 19:03 . 2007-12-06 19:49 <REP> d-------- C:\WINDOWS\system32\fr-fr
2007-12-06 18:58 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2007-12-05 23:04 . 2002-12-17 16:23 33,340 --------- C:\WINDOWS\system32\dbmsqlgc.dll
2007-12-05 23:04 . 2002-10-20 14:05 24,576 --------- C:\WINDOWS\system32\dbmsgnet.dll
2007-12-05 23:02 . 2007-12-05 23:02 <REP> d-------- C:\Program Files\Microsoft SQL Server
2007-12-05 23:01 . 2007-12-05 23:01 <REP> d-------- C:\Documents and Settings\Hugo\Application Data\Sony
2007-12-05 22:57 . 2007-12-21 23:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Sony
2007-12-05 22:54 . 2007-12-05 22:54 <REP> d-------- C:\Program Files\Sony Setup
2007-12-05 19:12 . 2007-12-09 00:23 <REP> d-------- C:\Fraps
2007-12-05 19:12 . 2007-12-09 00:28 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-03 19:28 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
2007-12-03 19:28 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax
2007-12-03 17:37 . 2007-12-03 17:40 <REP> d-------- C:\Program Files\DebugMode
2007-12-03 17:37 . 2007-10-07 20:43 3,249,629 --a------ C:\wink20.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 15:16 --------- d-----w C:\Program Files\OpenOffice.org1.1.2
2007-12-26 18:58 --------- d-----w C:\Program Files\mIRC
2007-12-21 22:48 --------- d-----w C:\Program Files\Skype
2007-12-21 22:48 --------- d-----w C:\Program Files\Fichiers communs\Acronis
2007-12-21 22:46 --------- d-----w C:\Program Files\Windows Live
2007-12-21 22:32 --------- d-----w C:\Program Files\Sony
2007-12-21 22:30 --------- d-----w C:\Program Files\Warcraft III
2007-12-16 20:43 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-12-01 10:13 --------- d-----w C:\Program Files\LimeWire
2007-11-21 18:23 81,920 ----a-w C:\WINDOWS\system32\frapsvid.dll
2007-11-19 19:18 --------- d-----w C:\Program Files\Motherboard Monitor 5
2007-11-18 17:30 65,167 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2007-11-18 17:30 6,112 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-11-18 17:30 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-24 00:47 96,760 ----a-w C:\WINDOWS\system32\dfshim.dll
2007-10-24 00:47 84,480 ----a-w C:\WINDOWS\system32\mscories.dll
2007-10-24 00:47 282,112 ----a-w C:\WINDOWS\system32\mscoree.dll
2007-10-24 00:47 158,720 ----a-w C:\WINDOWS\system32\mscorier.dll
2007-10-18 07:44 546,304 ----a-w C:\WINDOWS\system32\AutoPartNt.exe
2007-10-17 17:23 10,752 ----a-w C:\WINDOWS\system32\WhoisCL.exe
2007-10-17 15:34 37,888 ----a-w C:\WINDOWS\system32\setupnt.dll
2007-10-08 18:15 79,752 ----a-w C:\Preparation_Messenger.exe
2007-10-01 19:41 1,882,020 ----a-w C:\PhotoFiltre.zip
2006-08-25 15:51 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
2004-08-19 23:09 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2003-04-24 14:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
2004-08-19 23:09 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-19 23:09 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2003-04-24 14:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2004-08-19 23:09 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-28_23.42.07,39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-29 08:47:17 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_f4.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-04-23 10:48]
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 23:05]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2004-01-15 13:33 C:\WINDOWS\system32\VTTimer.exe]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-04-23 10:48]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 02:36]
"F-Secure Manager"="C:\Program Files\AntivirusFirewall\Common\FSM32.exe" [2005-10-26 02:51]
"F-Secure TNB"="C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" [2005-07-18 15:51]
"F-Secure Startup Wizard"="C:\Program Files\AntivirusFirewall\FSGUI\FSSW.exe" [2005-10-18 09:29]
"News Service"="C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe" [2005-05-31 13:45]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09]

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-11-18 16:04]
R2 BackWeb Plug-in - 6588780;Antivirus Firewall;C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE [2006-12-20 11:26]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 16:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSgk.sys [2007-06-06 16:29]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2004-06-01 10:03]
R3 Camdrv30;Philips ToUcam XS;C:\WINDOWS\system32\Drivers\camdrv30.sys [2001-08-17 22:04]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-12-20 07:00]
S3 portio;portio;C:\Program Files\Zinf\portio.sys []
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\sscdbus.sys [2005-05-23 07:27]
S3 sscdmdfl;SAMSUNG CDMA Modem Filter;C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys [2005-05-23 07:27]
S3 sscdmdm;SAMSUNG CDMA Modem Drivers;C:\WINDOWS\system32\DRIVERS\sscdmdm.sys [2005-05-23 07:27]
S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-04 07:04]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08]
S3 Vsp;Vsp;C:\WINDOWS\System32\drivers\Vsp.sys [2003-05-27 16:45]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-29 08:31:22 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\ANTIVI~1\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\ANTIVI~1\ANTI-V~1\report.txt
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 09:47:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-29 9:49:56 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-28 23:43
.
2007-12-12 22:09:24 --- E O F ---

voilà mon rapport, mais je précise qu'a la fin de la suppression de la selection, un message d'erreur est apparu comme quoi certains élements n'ont pas été supprimés...

Malwarebytes' Anti-Malware 1.26
Version de la base de données: 1103
Windows 5.1.2600 Service Pack 2

07/09/2008 14:21:27
mbam-log-2008-09-07 (14-21-27).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 106252
Temps écoulé: 1 hour(s), 9 minute(s), 19 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 19

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphce53j0e307 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\WhoisCL.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssserf.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Hugo\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Hugo\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Hugo\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Hugo\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Hugo\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Hugo\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Hugo\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Hugo\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Hugo\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Hugo\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.