Virus virtumonde et problème WindowUpdate

Tiens je viens aussi de remarqué que quand j'essaye de télécharger quelque chose , ma barre démaré disparrait ainsi que tout mon bureau...

ComboFix 08-08-26.03 - gledel 2008-08-27 19:14:07.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.189 [GMT 2:00]
Endroit: C:\Documents and Settings\gledel\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.
/wow section - STAGE 40
pv: No matching processes found


(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\gledel\err.log
C:\WINDOWS\system32\awtqrOHW.dll
C:\WINDOWS\system32\dao350.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\UpMedia
C:\WINDOWS\system32\urlmsnlink.dat
C:\WINDOWS\system32\vvFLlnpo.ini
C:\WINDOWS\system32\vvFLlnpo.ini2

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-27 to 2008-08-27 ))))))))))))))))))))))))))))))))))))
.

2008-08-27 19:29 . 2008-08-27 19:31 963 --ahs---- C:\WINDOWS\system32\vvFLlnpo.ini
2008-08-27 19:01 . 2008-08-24 05:08 <REP> d-------- C:\SDFix
2008-08-27 17:34 . 2008-08-27 17:34 <REP> d-------- C:\Program Files\Trend Micro
2008-08-27 16:24 . 2004-09-13 08:45 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2008-08-27 16:24 . 2002-09-25 17:05 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-08-27 16:24 . 2002-09-25 17:05 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-08-27 16:24 . 2002-09-25 16:11 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-08-27 16:24 . 2002-09-25 16:22 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-08-27 16:24 . 2002-09-25 17:05 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-08-27 16:24 . 2002-09-25 16:22 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-08-27 16:24 . 2002-09-25 17:05 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-08-27 16:24 . 2008-08-27 16:24 <REP> d-------- C:\Documents and Settings\Administrateur
2008-08-27 14:00 . 2008-08-27 14:00 91 --a------ C:\WINDOWS\wininit.ini
2008-08-27 12:00 . 2008-08-27 12:00 312,832 --a------ C:\WINDOWS\system32\opnlLFvv.dll
2008-08-16 14:42 . 2008-08-16 14:42 268 --ah----- C:\sqmdata19.sqm
2008-08-16 14:42 . 2008-08-16 14:42 244 --ah----- C:\sqmnoopt19.sqm
2008-08-14 13:21 . 2008-05-01 16:31 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-07 18:19 . 2008-08-07 18:19 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\agi
2008-08-07 18:19 . 2008-08-07 18:19 <REP> d-------- C:\Documents and Settings\gledel\Application Data\agi
2008-08-07 18:19 . 2008-08-07 18:19 2,113,536 --a------ C:\WINDOWS\system32\python25.dll
2008-08-07 18:19 . 2008-08-07 18:19 327,680 --a------ C:\WINDOWS\system32\pythoncom25.dll
2008-08-07 18:19 . 2008-08-07 18:19 102,400 --a------ C:\WINDOWS\system32\pywintypes25.dll
2008-07-31 19:01 . 2008-07-31 19:02 <REP> d-------- C:\Program Files\PhotoFiltre Studio
2008-07-31 18:28 . 2008-07-31 18:28 244 --ah----- C:\sqmnoopt18.sqm
2008-07-31 18:28 . 2008-07-31 18:28 232 --ah----- C:\sqmdata18.sqm
2008-07-30 14:54 . 2008-07-30 17:04 <REP> d-------- C:\Program Files\FRoG Creator V0.4

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-27 17:30 82,944 ----a-w C:\WINDOWS\system32\hbafggxv.dll
2008-08-27 17:30 115,712 ----a-w C:\WINDOWS\system32\haqvcndh.dll
2008-08-27 10:27 --------- d-----w C:\Documents and Settings\gledel\Application Data\BitTorrent
2008-08-27 09:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-19 13:11 --------- d-----w C:\Program Files\100%Naruto
2008-08-12 11:45 --------- d-----w C:\Program Files\Java
2008-08-06 12:04 --------- d-----w C:\Program Files\Steam
2008-07-27 13:50 --------- d-----w C:\Documents and Settings\gledel\Application Data\DNA
2008-07-27 12:10 --------- d-----w C:\Program Files\Sony
2008-07-24 16:25 --------- d-----w C:\Documents and Settings\gledel\Application Data\GetRightToGo
2008-07-24 16:11 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-07-24 16:11 --------- d-----w C:\Documents and Settings\gledel\Application Data\Sony
2008-07-24 16:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony
2008-07-24 16:08 --------- d-----w C:\Program Files\Sony Setup
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-17 11:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-16 12:08 --------- d-----w C:\Program Files\Maxis
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-21 12:56 2,829 ----a-w C:\WINDOWS\W3DemoUnin.pif
2008-06-21 12:56 126,976 ----a-w C:\WINDOWS\W3DemoUnin.exe
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2007-05-26 08:31 538 -c--a-w C:\Documents and Settings\gledel\Application Data\internaldb8467.dat
2007-05-26 08:31 374 -c--a-w C:\Documents and Settings\gledel\Application Data\internaldb6334.dat
2007-05-26 08:31 18,432 -c--a-w C:\Documents and Settings\gledel\Application Data\internaldb41.dat
2006-02-12 11:17 66,382 -c-ha-w C:\Program Files\PFINISH.GID
2004-10-30 09:47 8,192 -csha-w C:\WINDOWS\o2cLicStore.bin
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97B89E96-C404-42D0-94D9-3B329126380D}]
2008-08-27 12:00 312832 --a------ C:\WINDOWS\system32\opnlLFvv.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 19:41 1832272]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-01-20 21:10 335872]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-11-25 18:36 1232946]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-15 14:28 196608]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58 282624]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\opnlLFvv

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^gledel^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.4.lnk]
path=C:\Documents and Settings\gledel\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.4.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a------ 2008-05-24 11:40 289088 C:\Program Files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-07-08 18:08 1271032 c:\Program Files\Steam\Steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Documents and Settings\\gledel\\Mes documents\\nico fichier\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\ValuSoft\\Chris Moneymakers World Poker Championship\\poker.exe"=
"C:\\Documents and Settings\\gledel\\Mes documents\\nico fichier\\Limewire 1\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Steam\\SteamApps\\warfire44\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\FRoG Creator V0.4\\Serveur\\Server.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 16:37]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2003-04-08 09:56]
S3 archbus;NEC WMC USB_BJ1 Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\archbus.sys [2005-08-30 13:17]
S3 archmdm;NEC WMC USB_BJ1 Port Drivers;C:\WINDOWS\system32\DRIVERS\archmdm.sys [2005-08-30 13:17]
S3 fbxusb;FreeBox USB Network Adapter;C:\WINDOWS\system32\DRIVERS\fbxusb.sys [2003-12-31 12:35]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{06faf982-893a-11db-a710-0008d30706ab}]
\Shell\Auto\command - RavMon.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMon.exe e
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2007-03-01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]

2008-08-27 C:\WINDOWS\Tasks\User_Feed_Synchronization-{4E1904F0-B94C-44CB-B067-4D8C91BA52BA}.job
- C:\WINDOWS\system32\msfeedssync.exe [2006-10-17 12:58]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\agi\common\_agcutils.pyd
BHO-{047BFEC7-5C1E-466F-B3E8-47A507A7D19A} - (no file)
HKCU-Run-msnmsgr - C:\Program Files\MSN Messenger\msnmsgr.exe
Notify-awtqrOHW - (no file)
MSConfigStartUp-iTunesHelper - C:\Program Files\iTunes\iTunesHelper.exe
MSConfigStartUp-msnmsgr - C:\Program Files\MSN Messenger\msnmsgr.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\gledel\Application Data\Mozilla\Firefox\Profiles\u7zssin4.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.orange.fr
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 19:29:34
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...


C:\WINDOWS\system32\haqvcndh.dll 115712 bytes executable
C:\WINDOWS\system32\hbafggxv.dll 82944 bytes executable
C:\WINDOWS\system32\vvFLlnpo.ini 1252 bytes
C:\WINDOWS\system32\vvFLlnpo.ini2 1252 bytes

Scan termin‚ avec succŠs
Les fichiers cach‚s: 4

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\opnlLFvv.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\opnlLFvv.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Realtek\Rtl8180\RtlWake.exe
C:\Program Files\Hercules\WiFi Station\WiFiStation.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-27 19:37:32 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-27 17:37:09

Pre-Run: 40,025,337,856 octets libres
Post-Run: 40,203,137,024 octets libres

210 --- E O F --- 2008-08-16 09:09:32


____________________


Voilà le compte rendu

Re,

Copie (Ctrl+C) le texte se situant dans le cadre ci-dessous :

Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :


Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
NOTE : S'il n'y a pas de rédémarrage, poste quand même les rapports demandés.

ComboFix 08-08-26.03 - gledel 2008-08-27 21:13:11.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.204 [GMT 2:00]
Endroit: C:\Documents and Settings\gledel\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\gledel\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]

FILE ::
C:\WINDOWS\system32\haqvcndh.dll
C:\WINDOWS\system32\hbafggxv.dll
C:\WINDOWS\system32\opnlLFvv.dll
C:\WINDOWS\system32\vvFLlnpo.ini
.
/wow section - STAGE 40
pv: No matching processes found


(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\haqvcndh.dll
C:\WINDOWS\system32\hbafggxv.dll
C:\WINDOWS\system32\opnlLFvv.dll
C:\WINDOWS\system32\vvFLlnpo.ini
C:\WINDOWS\system32\vvFLlnpo.ini2

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-27 to 2008-08-27 ))))))))))))))))))))))))))))))))))))
.

2008-08-27 19:01 . 2008-08-24 05:08 <REP> d-------- C:\SDFix
2008-08-27 17:34 . 2008-08-27 17:34 <REP> d-------- C:\Program Files\Trend Micro
2008-08-27 16:24 . 2004-09-13 08:45 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2008-08-27 16:24 . 2002-09-25 17:05 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-08-27 16:24 . 2002-09-25 17:05 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-08-27 16:24 . 2002-09-25 16:11 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-08-27 16:24 . 2002-09-25 16:22 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-08-27 16:24 . 2002-09-25 17:05 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-08-27 16:24 . 2002-09-25 16:22 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-08-27 16:24 . 2002-09-25 17:05 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-08-27 16:24 . 2008-08-27 16:24 <REP> d-------- C:\Documents and Settings\Administrateur
2008-08-27 14:00 . 2008-08-27 14:00 91 --a------ C:\WINDOWS\wininit.ini
2008-08-16 14:42 . 2008-08-16 14:42 268 --ah----- C:\sqmdata19.sqm
2008-08-16 14:42 . 2008-08-16 14:42 244 --ah----- C:\sqmnoopt19.sqm
2008-08-14 13:21 . 2008-05-01 16:31 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-07 18:19 . 2008-08-07 18:19 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\agi
2008-08-07 18:19 . 2008-08-07 18:19 <REP> d-------- C:\Documents and Settings\gledel\Application Data\agi
2008-08-07 18:19 . 2008-08-07 18:19 2,113,536 --a------ C:\WINDOWS\system32\python25.dll
2008-08-07 18:19 . 2008-08-07 18:19 327,680 --a------ C:\WINDOWS\system32\pythoncom25.dll
2008-08-07 18:19 . 2008-08-07 18:19 102,400 --a------ C:\WINDOWS\system32\pywintypes25.dll
2008-07-31 19:01 . 2008-07-31 19:02 <REP> d-------- C:\Program Files\PhotoFiltre Studio
2008-07-31 18:28 . 2008-07-31 18:28 244 --ah----- C:\sqmnoopt18.sqm
2008-07-31 18:28 . 2008-07-31 18:28 232 --ah----- C:\sqmdata18.sqm
2008-07-30 14:54 . 2008-07-30 17:04 <REP> d-------- C:\Program Files\FRoG Creator V0.4

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-27 10:27 --------- d-----w C:\Documents and Settings\gledel\Application Data\BitTorrent
2008-08-27 09:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-19 13:11 --------- d-----w C:\Program Files\100%Naruto
2008-08-12 11:45 --------- d-----w C:\Program Files\Java
2008-08-06 12:04 --------- d-----w C:\Program Files\Steam
2008-07-27 13:50 --------- d-----w C:\Documents and Settings\gledel\Application Data\DNA
2008-07-27 12:10 --------- d-----w C:\Program Files\Sony
2008-07-24 16:25 --------- d-----w C:\Documents and Settings\gledel\Application Data\GetRightToGo
2008-07-24 16:11 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-07-24 16:11 --------- d-----w C:\Documents and Settings\gledel\Application Data\Sony
2008-07-24 16:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony
2008-07-24 16:08 --------- d-----w C:\Program Files\Sony Setup
2008-07-17 11:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-16 12:08 --------- d-----w C:\Program Files\Maxis
2008-06-21 12:56 2,829 ----a-w C:\WINDOWS\W3DemoUnin.pif
2008-06-21 12:56 126,976 ----a-w C:\WINDOWS\W3DemoUnin.exe
2007-05-26 08:31 538 -c--a-w C:\Documents and Settings\gledel\Application Data\internaldb8467.dat
2007-05-26 08:31 374 -c--a-w C:\Documents and Settings\gledel\Application Data\internaldb6334.dat
2007-05-26 08:31 18,432 -c--a-w C:\Documents and Settings\gledel\Application Data\internaldb41.dat
2006-02-12 11:17 66,382 -c-ha-w C:\Program Files\PFINISH.GID
2004-10-30 09:47 8,192 -csha-w C:\WINDOWS\o2cLicStore.bin
.

((((((((((((((((((((((((((((( snapshot@2008-08-27_19.35.34.00 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-27 19:23:24 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_248.dat
+ 2008-08-27 19:23:16 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_64c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-01-20 21:10 335872]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-11-25 18:36 1232946]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-15 14:28 196608]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58 282624]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\opnlLFvv

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^gledel^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.4.lnk]
path=C:\Documents and Settings\gledel\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.4.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a------ 2008-05-24 11:40 289088 C:\Program Files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-07-08 18:08 1271032 c:\Program Files\Steam\Steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Documents and Settings\\gledel\\Mes documents\\nico fichier\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\ValuSoft\\Chris Moneymakers World Poker Championship\\poker.exe"=
"C:\\Documents and Settings\\gledel\\Mes documents\\nico fichier\\Limewire 1\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Steam\\SteamApps\\warfire44\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\FRoG Creator V0.4\\Serveur\\Server.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 16:37]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2003-04-08 09:56]
S3 archbus;NEC WMC USB_BJ1 Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\archbus.sys [2005-08-30 13:17]
S3 archmdm;NEC WMC USB_BJ1 Port Drivers;C:\WINDOWS\system32\DRIVERS\archmdm.sys [2005-08-30 13:17]
S3 fbxusb;FreeBox USB Network Adapter;C:\WINDOWS\system32\DRIVERS\fbxusb.sys [2003-12-31 12:35]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{06faf982-893a-11db-a710-0008d30706ab}]
\Shell\Auto\command - RavMon.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMon.exe e
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2007-03-01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 18:13]

2008-08-27 C:\WINDOWS\Tasks\User_Feed_Synchronization-{4E1904F0-B94C-44CB-B067-4D8C91BA52BA}.job
- C:\WINDOWS\system32\msfeedssync.exe [2006-10-17 12:58]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)



**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 21:24:12
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Realtek\Rtl8180\RtlWake.exe
C:\Program Files\Hercules\WiFi Station\WiFiStation.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\update\update.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-27 21:33:18 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-27 19:33:04
ComboFix2.txt 2008-08-27 17:37:35

Pre-Run: 40,193,740,800 octets libres
Post-Run: 40,163,651,584 octets libres

178 --- E O F --- 2008-08-16 09:09:32


_________


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:35:31, on 27/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Realtek\Rtl8180\RtlWake.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\update\update.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: RtlWake.lnk = C:\Program Files\Realtek\Rtl8180\RtlWake.exe
O4 - Global Startup: WiFi Station.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.fr
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/too [...] ontrol.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-F [...] E_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/bina [...] b56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicma [...] Plugin.CAB
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/ [...] meHost.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/bina [...] b57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 8262 bytes[#5500aa]

Re,

Désinstalle correctement Avast! pour le remplacer par AntiVir.
Pourquoi changer ? Avast! vs AntiVir

Fais un scan complet puis poste le rapport en fin d'analyse.
AIDE : Tutorial sur l'antivirus AntiVir Personal Edition Classic

Laisse les fichiers en quarantaine et reposte un rapport Hijackthis

Tu as d'autres soucis ?

Bon surf

Tu devrais voir dans la section Hardware pour ça.

Bonne chance.