VIRUS ALERT

bonjour

tu posteras tes rapports quand tu auras fini tes scan.
(le rapport hijackthis devra être antérieur à celui de MalwareByte's Anti-Malware)

et n'utilise pas d'autres outils seul stp

non


1-

continue ton scan MBAM et poste le rapport

n'oublie pas:

• Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :

-- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
-- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.
REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.

AIDE : Tuto en images sur MBAM





2-

ajoute celui-ci:


~Télécharge SmitfraudFix

http://siri.urz.free.fr/Fix/SmitfraudFix.exe


Recherche:
~Double clique sur SmitfraudFix.exe
~Sélectionne 1 et presse Entrée dans le menu pour créer un rapport des fichiers responsables de l'infection. Le rapport se trouve à la racine du disque système C:\rapport.txt
~Poste ce rapport.
process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.


3-
~Lance Hijackthis.exe "do a system scan & save log file",et fais un copier coller du rapport généré dans ton prochain post.

SmitFraudFix v2.356

Rapport fait à 13:45:30,68, sam. 04/10/2008
Executé à partir de C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\0.2.149.30\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
F:\Mes documents\Téléchargements\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\0.2.149.30\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\fkebanrw.exe PRESENT !
C:\WINDOWS\xgpsarbm.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\tdssl.dll détecté, utilisez un scanner de Rootkit
C:\WINDOWS\system32\drivers\tdssserv.sys détecté, utilisez un scanner de Rootkit

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Xpl0se

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Xpl0se\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Xpl0se\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
+--------------------------------------------------+
[!] Suspicious: nkefbltdntd.dll
BHO: QXK Olive - {85AF4583-AD9C-4D25-9323-6611490213F0}
TypeLib: {16D1DB95-AAFC-427D-81FD-E98028CA7BB7}
Interface: {0C3F9C5E-34F0-4B16-B8B7-3505CD992ADD}
Interface: {3E83238C-A186-4C98-9A91-44B4BE62A5EC}

[!] Suspicious: dkwqgnbe.dll
Toolbar: dkwqgnbe - {72A002C5-4CB6-4332-B881-460C051844BF}
TypeLib: {87F738CC-03BB-4A76-8688-CB7F2C765F41}
Interface: {33FA89DF-D48C-4BC3-83C3-B3DB06DA63F9}
Classe: dkwqgnbe.bmax
Classe: dkwqgnbe.ToolBar.1

[!] Suspicious: neksolda.dll
SSODL: neksolda - {FC17DFA1-646B-4307-B1BC-E0A8D2E70756}

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Belkin Wireless 54Mbps Desktop Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{857DE454-1062-45BC-96FD-AAEBA60803F3}: NameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{857DE454-1062-45BC-96FD-AAEBA60803F3}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{857DE454-1062-45BC-96FD-AAEBA60803F3}: NameServer=192.168.1.1

Ps : Difficile pour moi d'analyser sa avec une résolution de mode sans échec

Merci encore pour tous

2e scan malware byte et maintenent plein de fichiers infectés :

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1227
Windows 5.1.2600 Service Pack 2

4/10/2008 16:05:57
mbam-log-2008-10-04 (16-05-57).txt

Type de recherche: Examen rapide
Eléments examinés: 42811
Temps écoulé: 1 minute(s), 26 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 14
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 14

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{5182cdda-aa0f-457a-9f21-fc9a5cc2a6b4} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{16d1db95-aafc-427d-81fd-e98028ca7bb7} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{0c3f9c5e-34f0-4b16-b8b7-3505cd992add} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e83238c-a186-4c98-9a91-44b4be62a5ec} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{85af4583-ad9c-4d25-9323-6611490213f0} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{85af4583-ad9c-4d25-9323-6611490213f0} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{87f738cc-03bb-4a76-8688-cb7f2c765f41} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{33fa89df-d48c-4bc3-83c3-b3db06da63f9} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{72a002c5-4cb6-4332-b881-460c051844bf} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fc17dfa1-646b-4307-b1bc-e0a8d2e70756} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dkwqgnbe.bmax (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dkwqgnbe.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\xgpsarbm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{72a002c5-4cb6-4332-b881-460c051844bf} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\neksolda (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2) Good: (http://www.google.com/) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\TDSSl.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\TDSSserv.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qoMeETjJ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\xgpsarbm.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\nkefbltdntd.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\fkebanrw.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\dkwqgnbe.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\neksolda.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Xpl0se\Bureau\Protect Your Privacy.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Xpl0se\Bureau\Malware Defender.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Xpl0se\Bureau\System Error Fixer.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Xpl0se\Local Settings\Temp\TDSSdd8e.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Xpl0se\Local Settings\Temp\TDSSdd9d.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Xpl0se\Local Settings\Temp\TDSSdf14.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

SA MARCHE !

HIJACK THIS :

Logfile of HijackThis v1.99.1
Scan saved at 16:09:15, on 4/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\LClock\lclock.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\wuauclt.exe
F:\Mes documents\Téléchargements\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IeMonitorBho Class - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\MegaIEMn.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{857DE454-1062-45BC-96FD-AAEBA60803F3}: NameServer = 192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files\Stardock\IconPackager\iprepair.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

ComboFix :

ComboFix 08-10-05.08 - Xpl0se 2008-10-06 16:02:21.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.551 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Xpl0se\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Xpl0se\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
C:\install.exe
C:\WINDOWS\jestertb.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


((((((((((((((((((((((((((((( Fichiers créés du 2008-09-06 au 2008-10-06 ))))))))))))))))))))))))))))))))))))
.

2008-10-06 14:29 . 2008-10-06 14:30 <REP> d-------- C:\Program Files\Reader 9.0
2008-10-06 14:29 . 2008-10-06 14:30 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-10-05 17:29 . 2008-10-05 17:29 <REP> d-------- C:\Program Files\No-IP
2008-10-04 23:15 . 2008-10-04 23:15 <REP> d-------- C:\Documents and Settings\Xpl0se\Application Data\Disney Interactive Studios
2008-10-04 23:14 . 2008-07-12 08:18 3,851,784 --a------ C:\WINDOWS\system32\D3DX9_39.dll
2008-10-04 23:13 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-10-04 23:13 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
2008-10-04 23:13 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
2008-10-04 23:13 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
2008-10-04 23:12 . 2008-10-04 23:12 <REP> d-------- C:\WINDOWS\Logs
2008-10-04 12:18 . 2008-10-04 12:18 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-04 12:18 . 2008-10-04 12:18 <REP> d-------- C:\Documents and Settings\Xpl0se\Application Data\Malwarebytes
2008-10-04 12:18 . 2008-10-04 12:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-04 12:18 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-04 12:18 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-01 18:49 . 2008-10-01 18:49 <REP> d--h-c--- C:\Documents and Settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2008-10-01 18:45 . 2008-10-01 18:45 <REP> d-------- C:\ProgramData
2008-10-01 18:45 . 2008-10-01 18:45 <REP> d-------- C:\Program Files\Electronic Arts
2008-10-01 17:35 . 2008-10-01 17:35 1,142 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg
2008-10-01 15:07 . 2008-10-01 20:54 <REP> d-------- C:\Documents and Settings\Xpl0se\Application Data\FrostWire
2008-10-01 15:06 . 2008-10-02 22:06 <REP> d-------- C:\Program Files\Java
2008-10-01 15:06 . 2008-10-01 15:06 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-10-01 15:06 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-10-01 15:05 . 2008-10-01 15:07 <REP> d-------- C:\Program Files\FrostWire
2008-09-25 18:15 . 2008-04-14 19:51 171,136 -rahs---- C:\grldr
2008-09-25 06:01 . 2008-09-25 18:00 <REP> d--hs---- C:\Boot
2008-09-25 06:01 . 2006-11-02 11:53 438,840 -rahs---- C:\bootmgr
2008-09-25 06:01 . 2008-09-25 06:01 8,192 -ra-s---- C:\BOOTSECT.BAK
2008-09-24 20:12 . 2008-09-24 20:12 <REP> d--hs---- C:\$RECYCLE.BIN
2008-09-24 14:04 . 2008-09-24 15:37 32 --a------ C:\WINDOWS\GunzLauncher.INI
2008-09-24 14:03 . 2008-09-24 14:03 <REP> d-------- C:\Program Files\Common Files
2008-09-24 14:03 . 2003-07-17 20:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
2008-09-24 14:03 . 2005-01-01 11:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2008-09-24 13:24 . 2008-09-24 13:24 <REP> d-------- C:\Program Files\NHN USA
2008-09-24 13:24 . 2008-09-24 13:24 <REP> d-------- C:\ijji
2008-09-24 13:24 . 2008-09-24 14:00 <REP> d--h----- C:\Documents and Settings\Xpl0se\Application Data\ijjigame
2008-09-24 13:24 . 2008-06-17 19:28 710,064 --a------ C:\WINDOWS\system32\ijjiSetup.exe
2008-09-24 13:24 . 2008-04-23 14:02 157,152 --a------ C:\WINDOWS\system32\PubPlugin.dll
2008-09-24 13:24 . 2008-06-11 23:01 58,800 --a------ C:\WINDOWS\system32\ijjiPlugin2.dll
2008-09-24 13:22 . 2008-09-24 13:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\IJJIGame
2008-09-22 17:11 . 2008-10-03 09:22 <REP> d-------- C:\Documents and Settings\Xpl0se\Application Data\OpenOffice.org2
2008-09-22 17:10 . 2008-09-22 17:10 <REP> d-------- C:\Program Files\OpenOffice.org 2.3
2008-09-21 20:05 . 2008-09-21 20:05 319 --a------ C:\WINDOWS\game.ini
2008-09-21 19:56 . 2008-09-21 19:56 <REP> d-------- C:\Program Files\Activision
2008-09-20 14:49 . 2008-10-05 15:04 <REP> d-------- C:\[Download]
2008-09-20 14:45 . 2008-10-05 14:53 <REP> d-------- C:\Program Files\Universal Share Downloader
2008-09-13 21:48 . 2004-08-04 00:54 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-09-13 21:48 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-13 21:48 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-13 21:48 . 2001-08-23 17:47 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-09-13 16:18 . 2008-09-13 16:28 <REP> d-------- C:\Program Files\PhotoFiltre Studio
2008-09-13 16:18 . 2008-09-13 16:18 45 ---h----- C:\WINDOWS\dloc8532.dat
2008-09-13 15:49 . 2008-09-13 15:49 <REP> d-------- C:\Program Files\WinSCP
2008-09-12 19:38 . 2004-08-05 14:00 1,036,288 --a--c--- C:\WINDOWS\system32\dllcache\explorer.exe
2008-09-12 19:38 . 2004-08-05 14:00 1,036,288 --a------ C:\WINDOWS\explorer.exe
2008-09-11 21:25 . 2008-09-11 21:25 <REP> d-------- C:\Program Files\iTunes
2008-09-11 21:25 . 2008-09-11 21:25 <REP> d-------- C:\Program Files\iPod
2008-09-11 21:25 . 2008-09-11 21:25 <REP> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-10 20:15 . 2008-09-10 20:15 <REP> d-------- C:\Program Files\QuickTime
2008-09-10 20:15 . 2008-09-10 20:15 <REP> d-------- C:\Program Files\Bonjour
2008-09-10 20:14 . 2008-09-05 22:16 1,900,544 --a------ C:\WINDOWS\system32\usbaaplrc.dll
2008-09-10 14:14 . 2008-09-10 14:14 <REP> d-------- C:\Documents and Settings\Xpl0se\Application Data\Logitech
2008-09-10 14:14 . 2008-09-10 14:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-09-10 13:46 . 2008-09-10 13:46 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-09-10 13:45 . 2008-09-10 14:29 <REP> d-------- C:\Program Files\Fichiers communs\Logishrd
2008-09-10 13:45 . 2008-09-10 13:45 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-09-10 13:45 . 2008-09-10 13:45 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-10 13:45 . 2008-09-10 13:45 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-09-06 13:56 . 2008-09-13 15:00 <REP> d-------- C:\Documents and Settings\Xpl0se\Application Data\Mumble

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-04 11:45 1,540 ----a-w C:\WINDOWS\system32\tmp.reg
2008-10-01 16:50 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-10-01 16:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-01 13:51 87,552 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-09-24 12:01 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\Free Download Manager
2008-09-20 12:29 --------- d-----w C:\Program Files\LocalCooling
2008-09-20 12:28 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\Bioshock
2008-09-19 17:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-09-10 18:15 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-09-10 11:29 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\Apple Computer
2008-09-08 21:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-06 11:56 --------- d-----w C:\Program Files\Mumble
2008-09-05 20:16 36,864 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2008-09-05 07:20 --------- d-----w C:\Program Files\KGB Archiver
2008-09-02 16:09 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\DeepBurner
2008-09-02 15:49 --------- d-----w C:\Program Files\DeepBurner
2008-09-02 15:34 --------- d-----w C:\Program Files\7-Zip
2008-09-01 11:49 --------- d-----w C:\Program Files\TightVNC
2008-09-01 11:15 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-01 11:12 --------- d-----w C:\Program Files\MessengerLog
2008-09-01 11:11 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\MessengerLog6
2008-08-31 23:33 --------- d-----w C:\Program Files\SpeedFan
2008-08-30 14:57 --------- d-----w C:\Program Files\Fichiers communs\Stardock
2008-08-30 12:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-08-29 19:28 --------- dc-h--w C:\Documents and Settings\All Users\Application Data\{8CC5CF4A-124E-41BA-B58C-A41F05BE09CC}
2008-08-29 19:28 --------- d-----w C:\Program Files\Stardock
2008-08-29 18:31 --------- d-----w C:\Program Files\Yahoo!
2008-08-29 18:31 --------- d-----w C:\Program Files\CCleaner
2008-08-29 17:54 --------- d-----w C:\Program Files\LClock
2008-08-29 08:18 87,336 ----a-w C:\WINDOWS\system32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll
2008-08-26 22:20 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\dvdcss
2008-08-21 19:31 --------- d-----w C:\Program Files\Google
2008-08-20 00:21 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\DivX
2008-08-19 23:08 --------- d-----w C:\Program Files\DivX
2008-08-18 10:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-08-16 11:27 --------- d-----w C:\Program Files\Free FLV Converter
2008-08-14 12:20 258,048 ----a-w C:\WINDOWS\system32\TubeFinder.exe
2008-08-13 20:23 --------- d-----w C:\Program Files\Free Download Manager
2008-08-13 20:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG
2008-08-11 14:03 --------- d-----w C:\Program Files\DVD Decrypter
2008-08-10 20:31 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-10 20:31 22,328 ----a-w C:\Documents and Settings\Xpl0se\Application Data\PnkBstrK.sys
2008-08-10 20:31 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-08-10 20:30 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-08-10 20:30 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-10 17:47 --------- d--h--r C:\Documents and Settings\Xpl0se\Application Data\SecuROM
2008-08-10 17:39 --------- d-----w C:\Program Files\2K Games
2008-08-10 16:34 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-08-10 12:37 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-08-10 12:35 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\DAEMON Tools
2008-08-10 12:15 --------- d-----w C:\Program Files\Megaupload
2008-08-10 12:15 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\Megaupload
2008-08-10 12:14 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\InstallShield
2008-08-10 11:00 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-08-10 10:55 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-10 09:50 --------- d-----w C:\Documents and Settings\Xpl0se\Application Data\vlc
2008-08-09 22:19 --------- d-----w C:\Program Files\VideoLAN
2008-08-09 20:14 --------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment
2008-08-09 19:40 --------- d-----w C:\Program Files\Apple Software Update
2008-08-09 19:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-09 19:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-08-09 19:07 --------- d-----w C:\Program Files\WinPcap
2008-08-09 18:55 64,419 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-08-09 18:55 6,116 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-08-09 18:55 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-08-09 18:50 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-08-09 18:50 --------- d-----w C:\Program Files\Realtek
2008-08-09 18:45 --------- d-----w C:\Program Files\Avira
2008-08-09 18:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-08-09 18:09 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-08-09 18:09 --------- d-----w C:\Program Files\Windows Live
2008-08-09 18:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-09 17:43 --------- d-----w C:\Program Files\Attansic
2008-08-09 17:32 --------- d-----w C:\Program Files\Services en ligne
2008-08-09 17:32 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-31 08:41 68,616 ----a-w C:\WINDOWS\system32\XAPOFX1_1.dll
2008-07-31 08:41 238,088 ----a-w C:\WINDOWS\system32\xactengine3_2.dll
2008-07-31 08:40 509,448 ----a-w C:\WINDOWS\system32\XAudio2_2.dll
2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-07-23 16:50 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-07-23 16:50 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2008-07-23 16:50 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-12 06:18 467,984 ----a-w C:\WINDOWS\system32\d3dx10_39.dll
.

HijackThis :

Logfile of HijackThis v1.99.1
Scan saved at 16:08, on 2008-10-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\LClock\lclock.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
F:\Mes documents\Téléchargements\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IeMonitorBho Class - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\MegaIEMn.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Xpl0se\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{857DE454-1062-45BC-96FD-AAEBA60803F3}: NameServer = 192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files\Stardock\IconPackager\iprepair.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Et bien mon pc ce comporte très bien a par des plantage de explorer.exe toute les 10 minutes... et je ne vois pas de ComboFix.txt dans C