[ Résolu ] winfilse.exe

Bonsoir
J'ai kaspersky antivirus qui me detecte winfilse.exe qui tente des installations qui sont bloqués par kaspersky
Je vous joins un rapport Hijackthis
Pouvez-vous m'aider à m'en débarrasser s'il vous plait ?
En vous remerciant
Licke

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:29:27, on 05/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
D:\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\Nero\Nero 9\InCD\InCD.exe
C:\Program Files\Nero\Nero 9\InCD\NBHGui.exe
C:\Program Files\Multimedia Mouse Driver\MouseDrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Fichiers communs\AVerMedia\AVerQuick\AVerQuick.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Wswin\Wswin32.exe
C:\Program Files\Tools&More\FTP-Watchdog\FTP-Watchdog.exe
C:\Program Files\Webcamfirst\webcamfirst.exe
C:\Program Files\Webcamfirst\WF_FTP.exe
C:\Documents and Settings\Licke\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Thunderbird] "d:\Mozilla Thunderbird\thunderbird.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WireLessMouse] C:\Program Files\Multimedia Mouse Driver\StartAutorun.exe MouseDrv.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 9\InCD\InCD.exe
O4 - HKLM\..\Run: [NBHGui] C:\Program Files\Nero\Nero 9\InCD\NBHGui.exe
O4 - HKLM\..\Run: [NeroRebootSetup] "C:\Documents and Settings\Licke\Local Settings\Temp\nro.tmp\SetupX.exe" SC -Reboot PROCESSMODE="0"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [MMAgent] C:\Program Files\Mobile Master\MMAgent.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\winfilse.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AVerQuick.lnk = C:\Program Files\Fichiers communs\AVerMedia\AVerQuick\AVerQuick.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BvrpKrnl - Unknown owner - C:\Program Files\WinFax eXPert\BVRPKrnl.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InCD Helper (InCDSrv) - Nero AG - C:\Program Files\Nero\Nero 9\InCD\InCDSrv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - C:\Program Files\Nero\Nero 9\InCD\NBHRegInCDSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 10340 bytes

RE
Rapport combo

ComboFix 08-11-04.02 - Licke 2008-11-05 22:01:04.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.606 [GMT 1:00]
Lancé depuis: c:\documents and settings\Licke\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.
ADS - WINDOWS: deleted 48 bytes in 1 streams.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Licke\Local Settings\Temporary Internet Files\101.gif
c:\documents and settings\Licke\Local Settings\Temporary Internet Files\102.gif
c:\documents and settings\Licke\Local Settings\Temporary Internet Files\103.gif
c:\documents and settings\Licke\Local Settings\Temporary Internet Files\104.gif
c:\documents and settings\Licke\Local Settings\Temporary Internet Files\105.gif
c:\documents and settings\Licke\Local Settings\Temporary Internet Files\106.gif
c:\program files\Logitech\Video\ManifestEngine.exe
c:\windows\system32\CSys500.dll
c:\windows\system32\drivers\downld
c:\windows\system32\drivers\winfilse.exe

----- BITS: Il y a peut-être des sites infectés -----

hxxp://premium.virginmega.fr
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_srosa


((((((((((((((((((((((((((((( Fichiers créés du 2008-10-05 au 2008-11-05 ))))))))))))))))))))))))))))))))))))
.

2008-11-04 09:48 . 2008-11-04 09:48 <REP> d-------- c:\program files\Poster Forge
2008-11-04 09:31 . 2008-11-05 21:26 7,168 --a------ c:\windows\system32\drivers\srosa2.sys
2008-11-03 13:57 . 2008-11-03 13:57 <REP> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-11-03 13:53 . 2008-11-03 13:53 <REP> d-------- c:\program files\Messenger Plus! Live
2008-11-01 16:00 . 2008-11-01 16:07 <REP> d-------- C:\Mes Sites Web
2008-11-01 15:58 . 2008-11-01 15:58 <REP> d-------- c:\program files\WinHTTrack
2008-10-30 14:55 . 2008-10-30 14:55 <REP> d-------- C:\Webcam_1
2008-10-30 14:54 . 2008-10-30 15:44 <REP> d-------- c:\program files\Webcamfirst test -v4-
2008-10-29 14:16 . 2008-10-29 14:26 <REP> d-------- c:\program files\hpHosts
2008-10-29 14:01 . 2005-12-27 16:02 65,536 --a------ c:\windows\system32\StripMyRights.exe
2008-10-29 13:58 . 2008-10-29 13:58 <REP> d-------- c:\program files\Strip_My_Rights
2008-10-24 02:06 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-10-21 14:59 . 2008-10-21 14:59 <REP> d-------- c:\program files\Windows Sidebar
2008-10-21 14:33 . 2008-09-19 15:53 129,560 --a------ c:\windows\system32\drivers\InCDFs.sys
2008-10-21 14:33 . 2008-09-19 15:53 41,752 --a------ c:\windows\system32\drivers\InCDRm.sys
2008-10-21 14:33 . 2008-09-19 15:53 19,352 --a------ c:\windows\system32\drivers\InCDRec.sys
2008-10-21 14:32 . 2008-09-19 15:53 40,216 --a------ c:\windows\system32\drivers\InCDPass.sys
2008-10-21 11:54 . 2008-10-21 15:03 4,767 --a------ c:\windows\Irremote.ini
2008-10-19 12:00 . 2008-10-19 12:00 <REP> d-------- c:\program files\Fichiers communs\Jumping Bytes
2008-10-18 21:38 . 2008-10-18 21:38 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-10-18 21:38 . 2008-10-18 21:38 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-10-18 21:37 . 2008-10-21 14:33 <REP> d----c--- c:\windows\system32\DRVSTORE
2008-10-18 21:37 . 2006-11-13 14:45 1,419,232 --a------ c:\windows\system32\wdfcoinstaller01005.dll
2008-10-18 21:37 . 2007-06-18 14:18 23,680 --a------ c:\windows\system32\drivers\motmodem.sys
2008-10-18 21:36 . 2008-10-18 21:36 <REP> d-------- c:\program files\Fichiers communs\Motorola Shared
2008-10-18 21:36 . 2008-10-18 21:36 <REP> d-------- c:\program files\Common Files
2008-10-17 08:04 . 2008-10-25 09:29 <REP> d-------- c:\program files\FileZilla FTP Client
2008-10-16 10:38 . 2008-10-16 10:41 <REP> d-------- c:\program files\StartClock
2008-10-15 00:30 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-15 00:29 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 00:29 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 00:29 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 00:29 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-15 00:29 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-10-11 20:13 . 2008-10-11 20:13 <REP> d-------- c:\documents and settings\All Users\Application Data\Elaborate Bytes
2008-10-11 20:07 . 2008-10-11 20:07 <REP> d-------- c:\program files\Elaborate Bytes
2008-10-11 16:56 . 2008-10-11 16:56 <REP> d-------- c:\program files\Microsoft
2008-10-11 16:54 . 2008-10-11 16:54 <REP> d-------- c:\program files\Fichiers communs\Windows Live

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-05 21:04 8,372,256 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-05 21:04 665,888 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-05 21:04 64,544 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-05 21:04 116,336 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-05 20:26 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-11-05 17:40 --------- d-----w c:\documents and settings\Licke\Application Data\FileZilla
2008-11-04 08:23 --------- d-----w c:\program files\eMule
2008-10-24 10:39 --------- d-----w c:\program files\Tomtomax Maxi-Box
2008-10-24 09:07 --------- d-----w c:\documents and settings\Licke\Application Data\Canon
2008-10-23 17:15 --------- d-----w c:\documents and settings\Licke\Application Data\Mobile Master
2008-10-21 14:25 --------- d-----w c:\program files\Fichiers communs\Nero
2008-10-21 13:35 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2008-10-21 13:29 --------- d-----w c:\program files\Nero
2008-10-21 11:54 --------- d-----w c:\documents and settings\Licke\Application Data\Nero
2008-10-20 10:50 --------- d-----w c:\documents and settings\Licke\Application Data\uTorrent
2008-10-19 11:01 --------- d-----w c:\program files\Mobile Master
2008-10-19 11:00 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-10-15 01:06 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-10-11 15:56 --------- d-----w c:\program files\Windows Live
2008-10-10 13:53 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink
2008-10-01 17:46 --------- d-----w c:\program files\Free Audio Pack
2008-10-01 17:41 630,784 ----a-w c:\windows\is-O3DJH.exe
2008-09-29 17:45 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-09-29 17:32 --------- d-----w c:\program files\Kaspersky Lab
2008-09-29 17:30 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-09-26 17:16 --------- d-----w c:\program files\AVerMedia
2008-09-26 17:10 --------- d-----w c:\program files\Fichiers communs\AVerMedia
2008-09-26 16:36 --------- d--h--w c:\program files\InstallShield Installation Information
2008-09-26 16:28 --------- d-----w c:\program files\Multimedia Mouse Driver
2008-09-26 16:05 --------- d-----w c:\program files\Fichiers communs\logishrd
2008-09-23 08:03 --------- d-----w c:\documents and settings\All Users\Application Data\Pinnacle
2008-09-21 17:03 --------- d-----w c:\program files\pese_courrier
2008-09-19 13:05 --------- d-----w c:\program files\ChèquesEditor5.02
2008-09-19 13:04 --------- d-----w c:\program files\ImprimCh
2008-09-19 08:23 2,437 ----a-w c:\windows\Api32.dll
2008-09-17 15:28 6,107 ----a-w c:\windows\itc.dll
2008-09-17 14:23 --------- d-----w c:\program files\EuroThink
2008-09-17 11:54 --------- d-----w c:\documents and settings\Licke\Application Data\System
2008-09-17 08:14 --------- d-----w c:\program files\VB RezQ
2008-09-17 08:10 --------- d-----w c:\program files\VB Decompiler Pro
2008-09-17 07:47 --------- d-----w c:\program files\VBReFormer
2008-09-16 18:52 --------- d-----w c:\program files\AVANQUEST UPDATE
2008-09-16 18:52 --------- d-----w c:\documents and settings\All Users\Application Data\BVRP Software
2008-09-16 18:12 --------- d-----w c:\program files\Microsoft Web Designer Tools
2008-09-16 17:50 --------- d-----w c:\program files\Microsoft.NET
2008-09-16 17:49 --------- d-----w c:\program files\Microsoft SQL Server
2008-09-16 17:41 --------- d-----w c:\program files\Microsoft Visual Studio 9.0
2008-09-16 17:35 --------- d-----w c:\program files\MSBuild
2008-09-16 16:48 --------- d-----w c:\program files\Business Objects
2008-09-16 15:51 --------- d-----w c:\program files\Microsoft SDKs
2008-09-16 15:30 --------- d-----w c:\program files\Reference Assemblies
2008-09-16 11:38 --------- d-----w c:\documents and settings\Licke\Application Data\Download Manager
2008-09-16 09:35 --------- d-----w c:\program files\Tools&More
2008-09-16 08:58 --------- d-----w c:\program files\Sisulizer 2008
2008-09-15 22:27 --------- d-----w c:\program files\AXE3
2008-09-15 21:49 --------- d-----w c:\program files\Ressource_Hacker
2008-09-15 17:52 --------- d-----w c:\program files\WinHex
2008-09-15 12:52 --------- d-----w c:\program files\FastStone Capture
2008-09-15 12:22 --------- d-----w c:\program files\Conduit
2008-09-12 13:18 --------- d-----w c:\program files\LivePix 1.1
2008-09-09 14:29 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2008-09-09 12:07 --------- d-----w c:\documents and settings\Licke\Application Data\GRETECH
2008-09-09 12:07 --------- d-----w c:\documents and settings\All Users\Application Data\GRETECH
2008-09-09 12:06 --------- d-----w c:\program files\GRETECH
2008-09-08 10:41 333,824 ----a-w c:\windows\system32\drivers\srv.sys
2008-09-07 15:24 --------- d-----w c:\documents and settings\Licke\Application Data\Apple Computer
2008-09-07 15:23 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-09-07 15:21 --------- d-----w c:\program files\QuickTime
2008-09-07 15:20 --------- d-----w c:\program files\Apple Software Update
2008-09-07 15:20 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-09-07 14:29 --------- d-----w c:\program files\illiminable
2008-09-07 09:52 --------- d-----w c:\documents and settings\All Users\Application Data\TomTom
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-09-19 15:53 98328 --a------ c:\program files\Nero\Nero 9\InCD\NBHshx.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-09-21 3513344]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [2008-09-26 206184]
"MMAgent"="c:\program files\Mobile Master\MMAgent.exe" [2008-10-14 1347008]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-09-02 160832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-10-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-10-08 217088]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-09 7311360]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-09 86016]
"Thunderbird"="d:\mozilla thunderbird\thunderbird.exe" [2008-09-26 8501360]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-02-28 63048]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"WireLessMouse"="c:\program files\Multimedia Mouse Driver\StartAutorun.exe" [2005-11-30 94208]
"InCD"="c:\program files\Nero\Nero 9\InCD\InCD.exe" [2008-09-19 1111064]
"NBHGui"="c:\program files\Nero\Nero 9\InCD\NBHGui.exe" [2008-09-19 2079256]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088]
"nwiz"="nwiz.exe" [2005-12-09 c:\windows\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-12-22 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Licke\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
AVerQuick.lnk - c:\program files\Fichiers communs\AVerMedia\AVerQuick\AVerQuick.exe [2008-09-26 606208]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2008-09-02 585728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-05-28 11:32 87352 c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\firefox.exe]
"Debugger"=StripMyRights.exe /D /L N

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\French\\setup.exe"=
"c:\\Program Files\\Webcamfirst\\WF_FTP.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 HFXP2;HFXP2;c:\windows\system32\DRIVERS\HFXP2.SYS [2007-01-22 17264]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2008-02-28 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-03-07 45848]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe [2008-09-30 935208]
R2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero 9\InCD\NBHRegInCDSrv.exe [2008-09-19 108568]
R3 AVerBDA3x;AVerMedia SAA713x BDA Service;c:\windows\system32\DRIVERS\AVerBDA3x.sys [2006-12-14 1171456]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;c:\windows\system32\DRIVERS\fetnd5bv.sys [2008-06-25 43520]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
S3 BvrpKrnl;BvrpKrnl;c:\program files\WinFax eXPert\BVRPKrnl.exe [2007-01-05 573440]
S3 se44bus;Sony Ericsson Device 068 driver (WDM);c:\windows\system32\DRIVERS\se44bus.sys [2006-11-30 61536]
S3 se44mdfl;Sony Ericsson Device 068 USB WMC Modem Filter;c:\windows\system32\DRIVERS\se44mdfl.sys [2006-11-30 9360]
S3 se44mdm;Sony Ericsson Device 068 USB WMC Modem Driver;c:\windows\system32\DRIVERS\se44mdm.sys [2006-11-30 97088]
S3 se44mgmt;Sony Ericsson Device 068 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\se44mgmt.sys [2006-11-30 88624]
S3 se44nd5;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (NDIS);c:\windows\system32\DRIVERS\se44nd5.sys [2006-11-30 18704]
S3 se44obex;Sony Ericsson Device 068 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\se44obex.sys [2006-11-30 86432]
S3 se44unic;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (WDM);c:\windows\system32\DRIVERS\se44unic.sys [2006-11-30 90800]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20fe065d-7b27-11dd-8550-000fea41f856}]
\Shell\AutoRun\command - J:\InstallTomTomHOME.exe
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-LogitechSoftwareUpdate - c:\program files\Logitech\Video\ManifestEngine.exe
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-NeroRebootSetup - c:\documents and settings\Licke\Local Settings\Temp\nro.tmp\SetupX.exe
HKLM-Run-Cmaudio - cmicnfg.cpl


.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\Licke\Application Data\Mozilla\Firefox\Profiles\z4j1jf4q.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://meteo-pont-saint-mard.com
FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-05 22:06:47
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Nero\Nero 9\InCD\InCDSrv.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Multimedia Mouse Driver\MouseDrv.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\program files\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Heure de fin: 2008-11-05 22:18:02 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-05 21:17:50

Avant-CF: 60 356 927 488 octets libres
Après-CF: 64,117,141,504 octets libres

262 --- E O F --- 2008-10-24 07:34:10


Rapport hijackthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:23:29, on 05/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero 9\InCD\InCDSrv.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Nero\Nero 9\InCD\InCD.exe
C:\Program Files\Nero\Nero 9\InCD\NBHGui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Fichiers communs\AVerMedia\AVerQuick\AVerQuick.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Multimedia Mouse Driver\MouseDrv.exe
C:\Program Files\Nero\Nero 9\InCD\NBHRegInCDSrv.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Licke\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Thunderbird] "d:\Mozilla Thunderbird\thunderbird.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WireLessMouse] C:\Program Files\Multimedia Mouse Driver\StartAutorun.exe MouseDrv.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 9\InCD\InCD.exe
O4 - HKLM\..\Run: [NBHGui] C:\Program Files\Nero\Nero 9\InCD\NBHGui.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [MMAgent] C:\Program Files\Mobile Master\MMAgent.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AVerQuick.lnk = C:\Program Files\Fichiers communs\AVerMedia\AVerQuick\AVerQuick.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BvrpKrnl - Unknown owner - C:\Program Files\WinFax eXPert\BVRPKrnl.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InCD Helper (InCDSrv) - Nero AG - C:\Program Files\Nero\Nero 9\InCD\InCDSrv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - C:\Program Files\Nero\Nero 9\InCD\NBHRegInCDSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 9937 bytes

Bonjour
Bien dormi?
Licke

Rapport scan:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, November 6, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, November 05, 2008 18:52:49
Records in database: 1370589
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Files scanned: 161852
Threat name: 7
Infected objects: 28
Suspicious objects: 0
Duration of the scan: 03:19:13


File name / Threat name / Threats count
C:\Qoobox\Quarantine\Registry_backups\Service_srosa.reg.dat Infected: Trojan-Downloader.Win32.Bagle.hp 1
D:\_Sites luc\Royale-safeliste\template\res.tar.gz Infected: Backdoor.PHP.Rst.ai 1
D:\_Sites luc\Royale-safeliste\template\res.tar.gz Infected: Backdoor.PHP.C99Shell.a 1
D:\_Sites luc\Backups\royalesafeliste\backup-Dec-20-2006-3.tar.gz Infected: Backdoor.PHP.Rst.ai 2
D:\_Sites luc\Backups\royalesafeliste\backup-Dec-20-2006-3.tar.gz Infected: Backdoor.PHP.C99Shell.a 2
D:\_Sites luc\Backups\royalesafeliste\backup-Dec-20-2006-2.tar.gz Infected: Backdoor.PHP.Rst.ai 2
D:\_Sites luc\Backups\royalesafeliste\backup-Dec-20-2006-2.tar.gz Infected: Backdoor.PHP.C99Shell.a 2
D:\_Sites luc\Backups\royalesafeliste\backup-Jan-5-2007-1.tar.gz Infected: Backdoor.PHP.Rst.ai 2
D:\_Sites luc\Backups\royalesafeliste\backup-Jan-5-2007-1.tar.gz Infected: Backdoor.PHP.C99Shell.a 2
E:\Backup site Luc\Tous les sites\royale.tar.gz Infected: Backdoor.PHP.Rst.ai 2
E:\Backup site Luc\Tous les sites\royale.tar.gz Infected: Backdoor.PHP.C99Shell.a 2
E:\Royale Safeliste\template\res.tar.gz Infected: Backdoor.PHP.Rst.ai 1
E:\Royale Safeliste\template\res.tar.gz Infected: Backdoor.PHP.C99Shell.a 1
F:\UTIL_17\Nero premium 7\Nero 9\Update 9.0.9.4c\Move_it\Nero_Move_it-1.0.12.1_trial.exe Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.bm 1
F:\UTIL_17\Nero premium 7\Nero 9\Update 9.0.9.4c\Nero BackItUp\Nero_BackItUp-4.0.38.0c_trial.exe Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.bm 1
F:\1\npdlplug-1.5.0.1-0147-setup.exe Infected: Trojan.Win32.Obfuscated.en 1
F:\1\npdlplug-1.5.0.1-0147-setup.exe Infected: not-a-virus:AdWare.Win32.PluginDL.c 2
F:\_SITE_LUC\Doc_Euro-Banco-Clic\Users_Euro-banco-Clic\setup1_4.exe Infected: not-a-virus:AdWare.Win32.VB.ah 1
F:\_SITE_LUC\Doc_Euro-Banco-Clic\Users_Euro-banco-Clic\setup.exe Infected: not-a-virus:AdWare.Win32.VB.ah 1

The selected area was scanned.

Re
Je crois que j'ai fait une bêtise car j'ai supprimé les fichiers qui etaient infectés des DD suivants: d, e et f.
Je n'ai donc rien fait de ce que tu dis dans ton message car je ne voudrais pas m'enfoncer encore plus dans la bêtise
Excuse moi de ne pas avoir attendu ta réponse.
J'ai donc refait un scan kaspersky online et cela donne ceci :
J'attends ta reponse sur ce qu'il faut faire cette fois-ci
Excuse-moi encore du temps que je te fais perdre mais cela ne se reproduira plus
Licke


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, November 6, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, November 06, 2008 16:44:32
Records in database: 1372588
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
I:\

Scan statistics:
Files scanned: 161902
Threat name: 5
Infected objects: 8
Suspicious objects: 0
Duration of the scan: 03:07:10


File name / Threat name / Threats count
C:\Qoobox\Quarantine\Registry_backups\Service_srosa.reg.dat Infected: Trojan-Downloader.Win32.Bagle.hp 1
F:\System Volume Information\_restore{DA015CA1-E18A-4AD9-A389-8E7551EC4EE2}\RP221\A0032084.exe Infected: Trojan.Win32.Obfuscated.en 1
F:\System Volume Information\_restore{DA015CA1-E18A-4AD9-A389-8E7551EC4EE2}\RP221\A0032084.exe Infected: not-a-virus:AdWare.Win32.PluginDL.c 2
F:\System Volume Information\_restore{DA015CA1-E18A-4AD9-A389-8E7551EC4EE2}\RP221\A0032085.exe Infected: not-a-virus:AdWare.Win32.VB.ah 1
F:\System Volume Information\_restore{DA015CA1-E18A-4AD9-A389-8E7551EC4EE2}\RP221\A0032086.exe Infected: not-a-virus:AdWare.Win32.VB.ah 1
F:\System Volume Information\_restore{DA015CA1-E18A-4AD9-A389-8E7551EC4EE2}\RP221\A0032087.exe Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.bm 1
F:\System Volume Information\_restore{DA015CA1-E18A-4AD9-A389-8E7551EC4EE2}\RP221\A0032092.exe Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.bm 1

The selected area was scanned.

Re
Rapport Findykill



----------------- FindyKill V4.095 ------------------

* User : Licke - LUC
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 06/11/08 par Chiquitine29
* Suppression effectuée à 9:40:48 le 07/11/2008
* Windows XP - Internet Explorer 7.0.5730.13


((((((((((((((( *** Suppression *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\spoolsv.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------


»»»» Suppression des fichiers dans C:


»»»» Suppression des fichiers dans C:\WINDOWS


»»»» Suppression des fichiers dans C:\WINDOWS\Prefetch

Supprimé ! - C:\WINDOWS\prefetch\WINTEMS.EXE-26D98C75.pf

»»»» Suppression des fichiers dans C:\WINDOWS\system32


»»»» Suppression des fichiers dans C:\WINDOWS\system32\drivers


»»»» Suppression des fichiers dans C:\Documents and Settings\Licke\Application Data


»»»» Suppression des fichiers dans C:\DOCUME~1\Licke\LOCALS~1\Temp


»»»» Suppression des fichiers dans C:\Documents and Settings\Licke\Local Settings\Temporary Internet Files\Content.IE5


--------------- [ Registre / Clés infectieuses ] ----------------


--------------- [ Etat / Redémarage des services ] ----------------


+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

Ndisuio - Type de démarrage = 3

EapHost - Type de démarrage = 2

Ip6Fw - Type de démarrage = 2

SharedAccess - Type de démarrage = 2

wuauserv - Type de démarrage = 2

wscsvc - Type de démarrage = 2


--------------- [ Nettoyage des supports amovibles ] ----------------

+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe

E: - Lecteur fixe

F: - Lecteur fixe


+- Suppression des fichiers :


--------------- [ Registre / Moutpoint2 ] ----------------


-> Recherche négative.


--------------- [ Recherche Cracks / Keygen ] ----------------

C:\Documents and Settings\Licke\Recent\Clone dvd 2.9.1.9--July--.rar.lnk


---------------- ! Fin du rapport ! ------------------

Re,
MalwareByte's Anti-Malware

Pas d'infection

Re
J'arrive pas a désinstaller combofix
J'avais renommer le fichier Combo-Fix.exe
et quand je fais la manœuvre que tu dis:
Cela donne un message d'erreur suivant:

Vous ne pouvez pas renommer ComboFix en COMBO-~1
Veuillez choisisr un autre nom, de préférence composé de caractères alphanumériques

Bon j'y suis arrivé quand même.
Je fais donc la suite

bonjour
comment se comporte ton pc?

re

http://support.microsoft.com/kb/307654/fr

Supprime tous les programmes installés pour la désinfection.


Merci de consulter ce dossier (en pdf) pour en connaître davantage sur les risques du Net.



Si tu trouves ce document intéressant, n'hésite pas à le transmettre à tes contacts.

Si tu en as assez d'être assailli de publicités durant ta navigation, installe Firefox sécurisé avec les extensions noscript et AdBlock Plus.

~Edite ton premier message (en cliquant sur la gomme) et marque [résolu] dans le titre.
Si ton nom de session correspond à ton véritable nom, tu as la possibilité de le changer en éditant tes posts.

de rien
bon surf