Bonjour,

voila j'ai un bleme je ne sais pas comment me debarasser de troja notamment:
trojan-spy.win32.keylogger.aa
trojan-downloader.win32.agent.bq

j'ai essayé cette facon mais rien:
http://www.infos-du-net.com/forum/ [...] alwarebyte

merci de votre aide


Voila un rapport HijackThis::::

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:45:23, on 30.08.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\ZoneLabs\vsmon.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
I:\Program Files\Alwil Software\Avast4\ashServ.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\ATKKBService.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\WINDOWS\eHome\ehRecvr.exe
I:\WINDOWS\eHome\ehSched.exe
I:\WINDOWS\system32\nvsvc32.exe
I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
I:\Program Files\Alwil Software\Avast4\ashWebSv.exe
I:\WINDOWS\system32\dllhost.exe
I:\Program Files\Analog Devices\Core\smax4pnp.exe
I:\Program Files\Analog Devices\SoundMAX\Smax4.exe
I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
I:\WINDOWS\system32\RunDLL32.exe
I:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
I:\Program Files\RocketDock\RocketDock.exe
I:\Program Files\Team MediaPortal\MediaPortal\mptray.exe
I:\WINDOWS\system32\kfcfsdgj.exe
I:\Program Files\C-CHANNEL\PayPen\PayPen.exe
I:\Program Files\C-CHANNEL\PayPen\CPenOCR.exe
I:\Program Files\C-CHANNEL\PayPen\CPenDesk.exe
I:\Program Files\Opera\opera.exe
I:\Program Files\uTorrent\uTorrent.exe
I:\WINDOWS\system32\NOTEPAD.EXE
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe
I:\WINDOWS\system32\kfcfsdgj.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - I:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ehTray] I:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "I:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [JMB36X Configure] I:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "I:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [RocketDock] "I:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [MediaPortal Shell] I:\Program Files\Team MediaPortal\MediaPortal\mptray.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MessLive Auto Update] G:\Logiciel\MessLivePatch.exe -a_update
O4 - HKCU\..\Run: [strapl] I:\WINDOWS\system32\kfcfsdgj.exe
O4 - HKLM\..\Policies\Explorer\Run: [zblsluTn5Z] I:\Documents and Settings\Vincent Villy\Bureau\AdobeFlashPlayerHD.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: C-CHANNEL OnlineUpdate.lnk = ?
O4 - Global Startup: PayPen.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://I:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - I:\Program Files\Yahoo!\Common\yinsthelper.dll
O21 - SSODL: MsgCfgUi - {0491FE2F-4EA6-9304-4080-06F944FDDC0F} - I:\Program Files\avbjzde\MsgCfgUi.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - I:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - I:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - I:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6497 bytes

Bonjour,

Désactive tes protections résidentes (antivirus, Spybot-S&D, etc.) !

• Télécharge ComboFix (sUBs) sur ton Bureau.
• Double clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
• Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\combofix.txt*) dans ta prochaine réponse.

AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
* le nom de la partition peut changer

je peine un max
avec la console de recuperation


EDIT : Je n'arrive pas a installecet P: de console de recup.....
j'ai essayé 2X sans succes

Et le scan ne se fait pas ?

dans le tuto que tu m'as linké ils dise de metre la consolle de .... pour recuperer si il y a un bleme
mais je vais tenter le scan

ComboFix 08-08-29.02 - Vincent Villy 2008-08-30 19:27:52.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1601 [GMT 2:00]
Endroit: I:\Documents and Settings\Vincent Villy\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

I:\DOCUME~1\VINCEN~1\LOCALS~1\Temp\tmp1.tmp
I:\DOCUME~1\VINCEN~1\LOCALS~1\Temp\tmp2.tmp
I:\Program Files\akl
I:\Program Files\akl\akl.dll
I:\Program Files\akl\akl.exe
I:\Program Files\akl\uninstall.exe
I:\Program Files\akl\unsetup.exe
I:\WINDOWS\a.bat
I:\WINDOWS\base64.tmp
I:\WINDOWS\bdn.com
I:\WINDOWS\FVProtect.exe
I:\WINDOWS\iTunesMusic.exe
I:\WINDOWS\mslagent
I:\WINDOWS\mslagent\2_mslagent.dll
I:\WINDOWS\mslagent\mslagent.exe
I:\WINDOWS\mslagent\uninstall.exe
I:\WINDOWS\mssecu.exe
I:\WINDOWS\system32\akttzn.exe
I:\WINDOWS\system32\anticipator.dll
I:\WINDOWS\system32\awtoolb.dll
I:\WINDOWS\system32\bdn.com
I:\WINDOWS\system32\bsva-egihsg52.exe
I:\WINDOWS\system32\dpcproxy.exe
I:\WINDOWS\system32\h@tkeysh@@k.dll
I:\WINDOWS\system32\hoproxy.dll
I:\WINDOWS\system32\hxiwlgpm.dat
I:\WINDOWS\system32\hxiwlgpm.exe
I:\WINDOWS\system32\msgp.exe
I:\WINDOWS\system32\msnbho.dll
I:\WINDOWS\system32\mssecu.exe
I:\WINDOWS\system32\msvchost.exe
I:\WINDOWS\system32\mtr2.exe
I:\WINDOWS\system32\mwin32.exe
I:\WINDOWS\system32\netode.exe
I:\WINDOWS\system32\newsd32.exe
I:\WINDOWS\system32\ps1.exe
I:\WINDOWS\system32\psof1.exe
I:\WINDOWS\system32\psoft1.exe
I:\WINDOWS\system32\regc64.dll
I:\WINDOWS\system32\regm64.dll
I:\WINDOWS\system32\Rundl1.exe
I:\WINDOWS\system32\smp
I:\WINDOWS\system32\smp\msrc.exe
I:\WINDOWS\system32\sncntr.exe
I:\WINDOWS\system32\ssurf022.dll
I:\WINDOWS\system32\ssvchost.com
I:\WINDOWS\system32\ssvchost.exe
I:\WINDOWS\system32\sysreq.exe
I:\WINDOWS\system32\taack.dat
I:\WINDOWS\system32\taack.exe
I:\WINDOWS\system32\temp#01.exe
I:\WINDOWS\system32\thun.dll
I:\WINDOWS\system32\thun32.dll
I:\WINDOWS\system32\VBIEWER.OCX
I:\WINDOWS\system32\vbsys2.dll
I:\WINDOWS\system32\vcatchpi.dll
I:\WINDOWS\system32\vsdatant.sys
I:\WINDOWS\system32\winlogonpc.exe
I:\WINDOWS\system32\winsystem.exe
I:\WINDOWS\system32\WINWGPX.EXE
I:\WINDOWS\userconfig9x.dll
I:\WINDOWS\winsystem.exe
I:\WINDOWS\zip1.tmp
I:\WINDOWS\zip2.tmp
I:\WINDOWS\zip3.tmp
I:\WINDOWS\zipped.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_VSDATANT
-------\Service_vsdatant


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-28 to 2008-08-30 ))))))))))))))))))))))))))))))))))))
.

2008-08-30 16:56 . 2008-08-30 16:56 <REP> d-------- I:\Program Files\VirtualDub-1.6.18
2008-08-30 15:45 . 2008-08-30 15:45 <REP> d-------- I:\Program Files\Trend Micro
2008-08-30 13:03 . 2008-08-30 13:03 <REP> d-------- I:\Program Files\Malwarebytes' Anti-Malware
2008-08-30 13:03 . 2008-08-30 13:03 <REP> d-------- I:\Documents and Settings\Vincent Villy\Application Data\Malwarebytes
2008-08-30 13:03 . 2008-08-30 13:03 <REP> d-------- I:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-30 13:03 . 2008-08-17 15:01 38,472 --a------ I:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-30 13:03 . 2008-08-17 15:01 17,144 --a------ I:\WINDOWS\system32\drivers\mbam.sys
2008-08-30 12:57 . 2008-08-30 13:02 <REP> d-a------ I:\Documents and Settings\All Users\Application Data\TEMP
2008-08-30 10:15 . 2008-08-30 19:31 682,016 --ahs---- I:\WINDOWS\system32\drivers\fidbox.dat
2008-08-30 10:15 . 2008-08-30 19:30 10,088 --ahs---- I:\WINDOWS\system32\drivers\fidbox.idx
2008-08-30 10:11 . 2008-08-30 10:11 <REP> d-------- I:\Program Files\Zone Labs
2008-08-30 10:11 . 2008-08-30 10:11 <REP> d-------- I:\Documents and Settings\All Users\Application Data\MailFrontier
2008-08-30 10:10 . 2008-08-30 17:41 <REP> d-------- I:\WINDOWS\Internet Logs
2008-08-30 09:55 . 2008-08-30 09:55 <REP> d-------- I:\Documents and Settings\Vincent Villy\Application Data\Jetico Personal Firewall
2008-08-30 02:13 . 2008-08-30 02:13 <REP> d-------- I:\Documents and Settings\All Users\Application Data\ytohqzuh
2008-08-29 15:06 . 2008-08-29 15:06 <REP> d-------- I:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-08-29 14:13 . 2008-08-29 14:13 <REP> d-------- I:\Program Files\avbjzde
2008-08-29 14:13 . 2008-08-29 14:13 <REP> d-------- I:\Documents and Settings\All Users\Application Data\ytefapsl
2008-08-29 14:13 . 2008-08-29 14:13 98,304 --a------ I:\WINDOWS\system32\kfcfsdgj.exe
2008-08-29 14:13 . 2008-08-29 14:13 66,048 --a------ I:\WINDOWS\system32\yhwfwfsj.exe
2008-08-25 23:30 . 2008-08-25 23:30 <REP> d-------- I:\Program Files\CDisplay
2008-08-20 17:13 . 2008-08-20 17:13 <REP> d-------- I:\Program Files\SHARP
2008-08-18 22:07 . 2008-08-18 22:08 <REP> d-------- I:\Documents and Settings\Vincent Villy\Logitech
2008-08-18 22:06 . 2008-08-18 22:06 <REP> d-------- I:\Program Files\Fichiers communs\Remote Control USB Driver
2008-08-17 11:31 . 2004-03-29 17:23 90,112 --a------ I:\WINDOWS\unvise32.exe
2008-08-17 10:43 . 2008-08-17 10:43 <REP> d-------- I:\Documents and Settings\All Users\Application Data\FLEXnet
2008-08-17 10:39 . 2008-08-17 10:39 <REP> d-------- I:\Documents and Settings\All Users\Application Data\ALM
2008-08-17 10:33 . 2008-08-30 17:57 <REP> d-------- I:\Program Files\Bonjour
2008-08-17 10:30 . 2008-08-17 10:30 <REP> d-------- I:\Program Files\Fichiers communs\Macrovision Shared
2008-08-14 21:26 . 2008-08-14 21:26 <REP> d-------- I:\Program Files\Yahoo!
2008-08-14 13:52 . 2008-08-14 13:52 <REP> d-------- I:\Program Files\MSECache
2008-08-13 22:48 . 2008-05-01 16:36 331,776 -----c--- I:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 18:04 . 2008-08-11 18:04 <REP> d-------- I:\Program Files\InfraRecorder
2008-08-11 18:04 . 2008-08-11 18:24 <REP> d-------- I:\Documents and Settings\Vincent Villy\Application Data\InfraRecorder
2008-08-05 19:14 . 2008-08-17 08:10 <REP> d-------- I:\Program Files\MediaCoder
2008-08-04 12:21 . 2008-08-04 16:27 <REP> d-------- I:\Program Files\Gabest
2008-08-04 12:09 . 2008-08-04 12:09 <REP> d-------- I:\Program Files\Real Alternative
2008-08-04 12:09 . 2008-08-04 12:09 <REP> d-------- I:\Program Files\Haali
2008-08-04 12:08 . 2008-08-04 12:08 <REP> d-------- I:\Program Files\ffdshow
2008-08-04 12:08 . 2007-01-01 00:00 60,273 --a------ I:\WINDOWS\system32\pthreadGC2.dll
2008-08-04 12:08 . 2007-12-15 16:11 7,680 --a------ I:\WINDOWS\system32\ff_vfw.dll
2008-08-04 12:08 . 2007-12-15 16:11 6,144 --a------ I:\WINDOWS\system32\ff_acm.acm
2008-08-04 12:08 . 2007-01-01 00:00 547 --a------ I:\WINDOWS\system32\ff_vfw.dll.manifest
2008-08-02 17:04 . 2008-08-08 17:36 <REP> d-------- I:\Program Files\musikCube_1.0
2008-08-02 17:03 . 2008-08-30 10:36 <REP> d-------- I:\Documents and Settings\Vincent Villy\.musikproject
2008-08-01 07:06 . 2001-08-23 17:47 8,704 --a------ I:\WINDOWS\system32\kbdjpn.dll
2008-08-01 07:06 . 2001-08-23 17:47 8,704 --a--c--- I:\WINDOWS\system32\dllcache\kbdjpn.dll
2008-08-01 07:06 . 2008-04-14 04:31 6,144 --a------ I:\WINDOWS\system32\kbd106.dll
2008-08-01 07:06 . 2008-04-14 04:31 6,144 --a--c--- I:\WINDOWS\system32\dllcache\kbd106.dll
2008-08-01 06:59 . 2008-08-01 06:59 <REP> d-------- I:\WINDOWS\system32\fr-fr
2008-08-01 06:59 . 2008-08-01 06:59 <REP> d-------- I:\WINDOWS\system32\fr
2008-08-01 06:59 . 2008-08-01 06:59 <REP> d-------- I:\WINDOWS\system32\bits
2008-08-01 06:59 . 2008-08-01 06:59 <REP> d-------- I:\WINDOWS\l2schemas
2008-08-01 06:58 . 2008-08-01 06:59 <REP> d-------- I:\WINDOWS\ServicePackFiles
2008-07-31 12:23 . 2008-07-31 12:23 <REP> d-------- I:\Program Files\Exact Audio Copy
2008-07-31 12:23 . 2008-07-31 13:28 <REP> d-------- I:\Documents and Settings\Vincent Villy\Application Data\AccurateRip
2008-07-31 12:16 . 2008-07-31 12:16 9,557 --a------ I:\WINDOWS\EAC.CFG
2008-07-31 11:55 . 2008-07-31 11:55 164,112 --a------ I:\WINDOWS\system32\wnaspi32.dll
2008-07-27 17:41 . 2008-07-27 17:41 <REP> d-------- I:\Documents and Settings\Vincent Villy\Application Data\Media Player Classic
2008-07-27 09:19 . 2008-08-30 15:38 <REP> d-------- I:\Program Files\Mozilla Thunderbird
2008-07-27 09:19 . 2008-07-27 09:19 <REP> d-------- I:\Documents and Settings\Vincent Villy\Application Data\Thunderbird
2008-07-26 11:03 . 2008-07-26 11:03 <REP> d--h----- I:\WINDOWS\PIF
2008-07-26 09:47 . 2008-07-26 09:47 <REP> d-------- I:\Program Files\Brownie
2008-07-26 09:46 . 2008-07-26 09:47 <REP> d-------- I:\Program Files\Brother
2008-07-26 09:46 . 2004-10-12 01:24 188,416 --a------ I:\WINDOWS\system32\Pdrvinst.dll
2008-07-26 09:46 . 2002-10-31 01:09 81,920 --a------ I:\WINDOWS\system32\BrWebIns.dll
2008-07-26 09:46 . 2003-07-03 01:08 65,536 --a------ I:\WINDOWS\system32\BRWEBUP.EXE
2008-07-26 09:46 . 2008-04-13 20:47 25,856 --------- I:\WINDOWS\system32\drivers\usbprint.sys
2008-07-26 09:46 . 2008-07-26 09:46 425 --a------ I:\WINDOWS\BRWMARK.INI
2008-07-26 09:46 . 2008-07-26 09:46 34 --a------ I:\WINDOWS\system32\BD2030.DAT
2008-07-25 15:17 . 2008-08-17 10:41 <REP> d-------- I:\Program Files\Fichiers communs\Adobe
2008-07-25 13:07 . 2008-07-25 13:07 <REP> d-------- I:\Program Files\CCleaner
2008-07-25 12:20 . 2008-07-25 12:20 <REP> d-------- I:\Program Files\Lavasoft
2008-07-25 12:20 . 2008-07-25 12:21 <REP> d-------- I:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-25 12:19 . 2008-07-25 12:19 <REP> d-------- I:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-25 12:06 . 2007-07-30 19:19 271,224 --a------ I:\WINDOWS\system32\mucltui.dll
2008-07-25 12:06 . 2007-07-30 19:19 207,736 --a------ I:\WINDOWS\system32\muweb.dll
2008-07-25 12:06 . 2007-07-30 19:18 30,072 --a------ I:\WINDOWS\system32\mucltui.dll.mui
2008-07-24 20:32 . 2008-07-24 20:35 1,143 --a------ I:\WINDOWS\mozver.dat
2008-07-24 17:54 . 2008-07-25 12:57 <REP> d-------- I:\Documents and Settings\All Users\Application Data\part dead amok eggs
2008-07-24 17:41 . 2008-07-24 17:53 <REP> d-------- I:\Documents and Settings\Vincent Villy\Contacts
2008-07-24 17:34 . 2008-08-18 22:06 <REP> d----c--- I:\WINDOWS\system32\DRVSTORE
2008-07-24 17:28 . 2008-07-25 12:56 <REP> d-------- I:\Program Files\Windows Live
2008-07-24 17:28 . 2008-07-24 17:34 <REP> d--hsc--- I:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-07-24 17:28 . 2008-07-24 17:28 <REP> d-------- I:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-24 16:52 . 2008-07-24 16:52 <REP> d---s---- I:\Documents and Settings\Vincent Villy\UserData
2008-07-24 16:30 . 2008-07-24 16:30 <REP> d-------- I:\Program Files\MSXML 4.0
2008-07-24 15:23 . 2008-07-24 15:23 <REP> d-------- I:\Program Files\Enregistrer sous
2008-07-24 14:34 . 2008-07-24 19:11 <REP> dr------- I:\WINDOWS\system32\000 - Icones
2008-07-24 13:26 . 2008-06-14 19:33 272,768 --------- I:\WINDOWS\system32\drivers\bthport.sys
2008-07-24 13:26 . 2008-06-14 19:33 272,768 -----c--- I:\WINDOWS\system32\dllcache\bthport.sys
2008-07-24 13:25 . 2008-05-08 16:02 203,136 -----c--- I:\WINDOWS\system32\dllcache\rmcast.sys
2008-07-24 13:21 . 2008-07-24 13:21 <REP> d-------- I:\Program Files\RocketDock
2008-07-23 20:42 . 2003-06-25 16:05 266,360 --a------ I:\WINDOWS\system32\TweakUI.exe
2008-07-23 20:42 . 2002-06-21 15:09 160,217 --a------ I:\WINDOWS\system32\PowerToysLicense.rtf
2008-07-23 19:27 . 2008-07-23 19:27 228 --a------ I:\WINDOWS\CCPen200.ini
2008-07-23 19:25 . 2008-07-23 19:25 <REP> d-------- I:\WINDOWS\system32\URTTEMP
2008-07-23 19:07 . 2005-02-14 15:27 32,408 --------- I:\WINDOWS\system32\drivers\pendfu.sys
2008-07-23 18:51 . 2008-07-24 13:59 <REP> d-------- I:\Program Files\uTorrent
2008-07-23 18:51 . 2008-08-30 17:52 <REP> d-------- I:\Documents and Settings\Vincent Villy\Application Data\uTorrent
2008-07-23 18:45 . 2008-07-23 18:45 <REP> d-------- I:\Program Files\QuickTime Alternative
2008-07-23 18:45 . 2008-07-23 18:45 <REP> d-------- I:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-23 18:45 . 2008-05-27 10:50 90,112 --a------ I:\WINDOWS\system32\QuickTimeVR.qtx
2008-07-23 18:45 . 2008-05-27 10:50 57,344 --a------ I:\WINDOWS\system32\QuickTime.qts
2008-07-23 18:34 . 2008-07-23 18:34 <REP> d-------- I:\Program Files\Team MediaPortal
2008-07-23 18:34 . 2008-07-23 18:34 <REP> d-------- I:\Documents and Settings\All Users\Application Data\Team MediaPortal
2008-07-23 18:14 . 2008-07-23 18:14 0 --a------ I:\WINDOWS\ccwinpay.INI
2008-07-23 18:08 . 2008-07-23 18:08 <REP> d-------- I:\Program Files\Microsoft WSE
2008-07-23 18:08 . 2008-08-22 17:13 <REP> d-------- I:\Program Files\Fichiers communs\C-CHANNEL
2008-07-23 18:08 . 2008-07-23 19:27 <REP> d-------- I:\Program Files\C-CHANNEL
2008-07-23 18:08 . 2008-07-23 19:27 <REP> d-------- I:\Documents and Settings\All Users\Application Data\C-CHANNEL
2008-07-23 17:41 . 2008-07-23 17:41 <REP> d-------- I:\Documents and Settings\Vincent Villy\Application Data\IrfanView
2008-07-23 17:16 . 2008-07-23 17:16 <REP> d-------- I:\Program Files\VideoLAN
2008-07-23 17:16 . 2008-07-23 17:16 <REP> d-------- I:\Documents and Settings\Vincent Villy\Application Data\vlc
2008-07-23 17:10 . 2008-07-23 17:12 <REP> d-------- I:\WINDOWS\SHELLNEW
2008-07-23 17:10 . 2008-08-29 07:22 <REP> d-------- I:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-23 17:09 . 2008-07-23 17:09 <REP> dr-h----- I:\MSOCache
2008-07-23 16:19 . 2008-07-23 16:20 <REP> d-------- I:\Program Files\MozBackup
2008-07-23 16:07 . 2008-07-23 16:07 <REP> d-------- I:\Documents and Settings\All Users\Application Data\NVIDIA
2008-07-23 16:03 . 2008-07-23 16:03 <REP> d-------- I:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-07-23 16:01 . 2008-07-23 16:01 <REP> d-------- I:\Program Files\My Company Name
2008-07-23 16:00 . 2008-07-23 16:03 <REP> d-------- I:\WINDOWS\nview
2008-07-23 16:00 . 2006-06-01 11:22 208,896 --a------ I:\WINDOWS\system32\nvudisp.exe
2008-07-23 16:00 . 2008-08-30 19:31 63,804 --a------ I:\WINDOWS\system32\nvapps.xml
2008-07-23 16:00 . 2006-06-01 11:22 16,960 --a------ I:\WINDOWS\system32\nvdisp.nvu

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-23 11:03 --------- d-----w I:\Program Files\Realtek
2008-07-23 09:37 --------- d-----w I:\Program Files\microsoft frontpage
2008-07-23 09:35 --------- d-----w I:\Program Files\Services en ligne
2008-07-23 09:29 --------- d-----w I:\Program Files\Windows Plus
2008-07-09 07:05 75,248 ----a-w I:\WINDOWS\zllsputility.exe
2008-07-09 07:05 42,384 ----a-w I:\WINDOWS\zllsputility_loc040c.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="I:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 13:58 495616]
"MediaPortal Shell"="I:\Program Files\Team MediaPortal\MediaPortal\mptray.exe" [2006-09-22 08:57 200704]
"MsnMsgr"="I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"strapl"="I:\WINDOWS\system32\kfcfsdgj.exe" [2008-08-29 14:13 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="I:\WINDOWS\ehome\ehtray.exe" [2004-08-10 04:04 59392]
"SoundMAXPnP"="I:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 12:07 843776]
"JMB36X Configure"="I:\WINDOWS\system32\JMRaidTool.exe" [2006-06-02 10:45 385024]
"NvCplDaemon"="I:\WINDOWS\system32\NvCpl.dll" [2006-06-01 11:22 7618560]
"Adobe Reader Speed Launcher"="I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"ZoneAlarm Client"="I:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05 919016]
"nwiz"="nwiz.exe" [2006-06-01 11:22 1519616 I:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 86016 I:\WINDOWS\system32\nvmctray.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:33 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= I:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= I:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"MsgCfgUi"= {0491FE2F-4EA6-9304-4080-06F944FDDC0F} - I:\Program Files\avbjzde\MsgCfgUi.dll [2008-08-29 14:13 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"I:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"I:\\Program Files\\Messenger\\msmsgs.exe"=
"I:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"I:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"I:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;I:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;I:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R3 PayPen;PayPen;I:\WINDOWS\system32\Drivers\PayPen.sys [2005-02-16 08:53]
R3 usbstor;Pilote de stockage de masse USB;I:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 20:45]
S3 pendfu;PenDfu (pendfu.sys);I:\WINDOWS\system32\Drivers\pendfu.sys [2005-02-14 15:27]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3180ad7-58a3-11dd-bb0a-806d6172696f}]
\Shell\AutoRun\command - G:\ASUSACPI.exe
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MessLive Auto Update - G:\Logiciel\MessLivePatch.exe
HKLM-Explorer_Run-zblsluTn5Z - I:\Documents and Settings\Vincent Villy\Bureau\AdobeFlashPlayerHD.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - I:\Documents and Settings\Vincent Villy\Application Data\Mozilla\Firefox\Profiles\e3z9n9p8.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.karloff.ch/wd110awp/wd110awp.exe/connect/EKARLOFF
FF -: plugin - I:\Program Files\Opera\program\plugins\NPOFF12.DLL
FF -: plugin - I:\Program Files\Opera\program\plugins\nppl3260.dll
FF -: plugin - I:\Program Files\Opera\program\plugins\nprpjplug.dll
FF -: plugin - I:\Program Files\Yahoo!\Common\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-30 19:31:37
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
I:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
I:\Program Files\Alwil Software\Avast4\ashServ.exe
I:\WINDOWS\ATKKBService.exe
I:\WINDOWS\ehome\ehRecvr.exe
I:\WINDOWS\ehome\ehSched.exe
I:\WINDOWS\system32\nvsvc32.exe
I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
I:\Program Files\Alwil Software\Avast4\ashWebSv.exe
I:\WINDOWS\system32\dllhost.exe
I:\WINDOWS\ehome\ehmsas.exe
I:\WINDOWS\system32\rundll32.exe
I:\Program Files\C-CHANNEL\PayPen\PayPen.exe
I:\Program Files\C-CHANNEL\PayPen\CPenOCR.exe
I:\Program Files\C-CHANNEL\PayPen\CPenDesk.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-30 19:33:41 - machine was rebooted [Vincent Villy]
ComboFix-quarantined-files.txt 2008-08-30 17:33:37

Pre-Run: 38,207,086,592 octets libres
Post-Run: 38,590,668,800 octets libres

313 --- E O F --- 2008-08-29 05:22:15

Reposte un rapport Hijackthis.

J'ai toujours les problemes avec ces trojan

voici le rapport:::

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:48:23, on 30.08.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
I:\Program Files\Alwil Software\Avast4\ashServ.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Analog Devices\Core\smax4pnp.exe
I:\WINDOWS\system32\RunDLL32.exe
I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
I:\Program Files\RocketDock\RocketDock.exe
I:\Program Files\Team MediaPortal\MediaPortal\mptray.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\WINDOWS\system32\kfcfsdgj.exe
I:\Program Files\C-CHANNEL\PayPen\PayPen.exe
I:\Program Files\C-CHANNEL\PayPen\CPenOCR.exe
I:\Program Files\C-CHANNEL\PayPen\CPenDesk.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\ATKKBService.exe
I:\WINDOWS\eHome\ehRecvr.exe
I:\WINDOWS\eHome\ehSched.exe
I:\WINDOWS\system32\nvsvc32.exe
I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
I:\Program Files\Alwil Software\Avast4\ashWebSv.exe
I:\WINDOWS\system32\dllhost.exe
I:\Program Files\Opera\opera.exe
I:\Program Files\Windows Live\Messenger\usnsvc.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - I:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ehTray] I:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [JMB36X Configure] I:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [RocketDock] "I:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [MediaPortal Shell] I:\Program Files\Team MediaPortal\MediaPortal\mptray.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [strapl] I:\WINDOWS\system32\kfcfsdgj.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: C-CHANNEL OnlineUpdate.lnk = ?
O4 - Global Startup: PayPen.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://I:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - I:\Program Files\Yahoo!\Common\yinsthelper.dll
O21 - SSODL: MsgCfgUi - {0491FE2F-4EA6-9304-4080-06F944FDDC0F} - I:\Program Files\avbjzde\MsgCfgUi.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - I:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - I:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - I:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5843 bytes