Processus en trop ! Besoin d'aide pour un nettoyage

Pour info, voici le rapport HijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:34:29, on 24/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ClamWin\bin\ClamTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Kévin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Kévin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Kévin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Kévin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Kévin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [20a528b9] rundll32.exe "C:\WINDOWS\system32\gaobgrid.dll",b
O4 - HKLM\..\Run: [JeticoPFStartup] "C:\Program Files\Jetico\Jetico Personal Firewall\jpf.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kévin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-F [...] E_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mi [...] 4724982185
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: gyoosy.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Jetico Personal Firewall server - Jetico, Inc. - C:\Program Files\Jetico\Jetico Personal Firewall\jpfsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O24 - Desktop Component 1: Google - http://www.google.fr/

--
End of file - 7816 bytes

Bonsoir,

Merci pour votre aide, j'ai tant bien que mal, en passant par linux, réussi a installer combofix. Voici le logfile :

ComboFix 08-11-23.02 - Kévin 2008-11-24 22:48:37.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1584 [GMT 1:00]
Lancé depuis: c:\documents and settings\ComboFix.exe
* Un nouveau point de restauration a été créé

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\dirgboag.ini
c:\windows\system32\gaobgrid.dll
c:\windows\system32\hgGvTJde.dll
c:\windows\system32\lJaayAqq.dll
c:\windows\system32\pmnoNeFY.dll
c:\windows\system32\qoMgddCt.dll
c:\windows\system32\qqAyaaJl.ini
c:\windows\system32\qqAyaaJl.ini2
c:\windows\system32\urqQHwUL.dll
c:\windows\system32\wlquboio.dll
c:\windows\Tasks\pqblgwlr.job

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-24 au 2008-11-24 ))))))))))))))))))))))))))))))))))))
.

2008-11-24 22:26 . 2008-11-24 22:22 3,052,195 -r------- c:\documents and settings\ComboFix.exe
2008-11-24 14:27 . 2008-11-24 14:27 <REP> d-------- c:\program files\Avira
2008-11-24 14:27 . 2008-11-24 14:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2008-11-24 11:34 . 2008-11-24 11:34 <REP> d-------- c:\program files\Trend Micro
2008-11-23 23:42 . 2008-11-24 00:21 <REP> d-------- c:\program files\a-squared Free
2008-11-23 23:25 . 2008-11-23 23:26 <REP> d-------- c:\program files\Jetico
2008-11-19 14:40 . 2008-11-19 14:40 <REP> d-------- c:\program files\mIRC
2008-11-19 14:40 . 2008-11-19 14:41 <REP> d-------- c:\documents and settings\Kévin\Application Data\mIRC
2008-11-12 18:30 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 18:30 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 22:58 . 2008-11-11 22:58 <REP> d-------- c:\program files\Audacity 1.3 Beta
2008-11-11 22:58 . 2008-11-15 21:05 <REP> d-------- c:\documents and settings\Kévin\Application Data\Audacity
2008-11-11 19:59 . 2008-11-11 19:59 <REP> d-------- c:\program files\Guitar Pro 5
2008-11-11 19:58 . 2008-11-11 19:58 <REP> d-------- c:\program files\MagicDisc
2008-11-11 19:58 . 2008-07-28 17:19 116,736 --a------ c:\windows\system32\drivers\mcdbus.sys
2008-11-11 19:56 . 2008-11-11 19:56 <REP> d-------- c:\program files\MagicISO
2008-11-11 19:48 . 2008-11-11 19:48 <REP> d-------- c:\program files\DAEMON Tools Lite
2008-11-11 19:46 . 2008-11-11 19:46 <REP> d-------- c:\documents and settings\Kévin\Application Data\DAEMON Tools
2008-11-11 19:46 . 2008-11-11 19:46 717,296 --a------ c:\windows\system32\drivers\sptd.sys
2008-11-10 14:01 . 2008-11-10 14:01 <REP> d-------- c:\program files\EPSON
2008-11-08 12:31 . 2008-11-08 12:37 <REP> d-------- c:\program files\BitComet
2008-11-08 12:31 . 2008-11-20 10:44 <REP> d-------- C:\Downloads
2008-11-07 18:53 . 2008-11-07 18:53 268 --ah----- C:\sqmdata00.sqm
2008-11-07 18:53 . 2008-11-07 18:53 244 --ah----- C:\sqmnoopt00.sqm
2008-11-06 08:01 . 2008-09-11 05:51 266,240 --a------ c:\windows\BCUnInstall.exe
2008-11-06 07:57 . 2008-11-06 07:56 67,688 --a------ c:\windows\system32\drivers\bcftdi.sys
2008-11-06 07:57 . 2008-11-06 07:53 26,984 --a------ c:\windows\system32\drivers\bc_ip_f.sys
2008-11-06 07:57 . 2008-11-06 07:55 23,656 --a------ c:\windows\system32\drivers\bcfilter.sys
2008-11-06 07:57 . 2008-11-06 07:54 23,016 --a------ c:\windows\system32\drivers\bc_tdi_f.sys
2008-11-06 07:57 . 2008-11-06 07:54 18,664 --a------ c:\windows\system32\drivers\bc_ngn.sys
2008-11-06 07:57 . 2008-11-06 07:53 18,280 --a------ c:\windows\system32\drivers\bc_prt_f.sys
2008-11-06 07:57 . 2008-11-06 07:52 14,568 --a------ c:\windows\system32\drivers\bc_hash_f.sys
2008-11-06 07:57 . 2008-11-06 07:53 14,440 --a------ c:\windows\system32\drivers\bc_pat_f.sys
2008-11-04 11:58 . 2008-11-04 11:58 <REP> d-------- c:\program files\Sibelius Software
2008-11-02 23:12 . 2008-11-13 01:02 <REP> d-------- c:\documents and settings\Kévin\Application Data\skypePM
2008-11-02 23:12 . 2008-11-02 23:12 56 --ah----- c:\windows\system32\ezsidmv.dat
2008-11-02 23:11 . 2008-11-13 01:36 <REP> d-------- c:\documents and settings\Kévin\Application Data\Skype
2008-11-02 23:10 . 2008-11-02 23:10 <REP> d-------- c:\program files\Skype
2008-11-02 23:10 . 2008-11-02 23:10 <REP> d-------- c:\program files\Fichiers communs\Skype
2008-11-02 23:10 . 2008-11-02 23:10 <REP> d-------- c:\documents and settings\All Users\Application Data\Skype
2008-10-31 15:10 . 2008-11-03 01:51 <REP> d-------- c:\program files\Wakfu
2008-10-31 12:23 . 2008-10-31 12:23 <REP> d-------- c:\program files\PDFCreator Toolbar
2008-10-31 12:23 . 2008-10-31 12:23 <REP> d-------- c:\program files\PDFCreator
2008-10-31 12:23 . 2004-03-09 01:00 662,288 --a------ c:\windows\system32\MSCOMCT2.OCX
2008-10-31 12:23 . 2008-10-31 12:23 253,139 --a------ c:\windows\PDFCreator_Toolbar_Uninstaller_2828.exe
2008-10-31 12:23 . 1998-07-13 02:08 141,312 --a------ c:\windows\system32\MSCMCFR.DLL
2008-10-31 12:23 . 1998-06-24 01:00 137,000 --a------ c:\windows\system32\MSMAPI32.OCX
2008-10-31 12:23 . 1998-07-13 02:08 119,568 --a------ c:\windows\system32\VB6FR.DLL
2008-10-31 12:23 . 2001-10-28 17:42 116,224 --a------ c:\windows\system32\pdfcmnnt.dll
2008-10-31 12:23 . 1998-07-13 02:08 59,904 --a------ c:\windows\system32\MSCC2FR.DLL
2008-10-31 12:23 . 1998-07-06 01:00 23,552 --a------ c:\windows\system32\MSMPIDE.DLL
2008-10-31 01:54 . 2008-10-31 01:54 <REP> d-------- c:\program files\CodeBlocks
2008-10-31 01:54 . 2008-11-19 21:19 <REP> d-------- c:\documents and settings\Kévin\Application Data\codeblocks
2008-10-31 01:39 . 2008-10-31 01:39 <REP> d-------- c:\program files\7-Zip
2008-10-29 11:31 . 2008-10-29 11:31 <REP> d-------- c:\windows\Sun
2008-10-29 02:54 . 2008-10-29 02:54 <REP> d-------- c:\program files\ffdshow
2008-10-29 02:54 . 2008-06-08 23:58 60,273 --a------ c:\windows\system32\pthreadGC2.dll
2008-10-29 02:54 . 2008-06-12 20:36 7,680 --a------ c:\windows\system32\ff_vfw.dll
2008-10-29 02:54 . 2008-06-12 20:37 6,144 --a------ c:\windows\system32\ff_acm.acm
2008-10-29 02:54 . 2007-07-10 18:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2008-10-28 18:18 . 2008-10-28 18:18 <REP> d-------- c:\program files\Java
2008-10-28 18:18 . 2008-10-28 18:18 410,976 --a------ c:\windows\system32\deploytk.dll
2008-10-28 18:18 . 2008-10-28 18:18 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-10-28 18:15 . 2008-10-28 18:15 <REP> d-------- c:\program files\GanttProject
2008-10-28 13:40 . 2008-10-28 13:40 <REP> d-------- c:\documents and settings\Kévin\Application Data\vlc
2008-10-28 13:40 . 2008-11-24 12:11 <REP> d-------- c:\documents and settings\Kévin\Application Data\dvdcss
2008-10-28 13:39 . 2008-10-28 13:39 <REP> d-------- c:\program files\VideoLAN
2008-10-28 13:24 . 2008-04-13 20:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2008-10-28 13:24 . 2008-04-13 20:45 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2008-10-28 03:08 . 2008-10-29 02:56 <REP> d-------- c:\program files\foobar2000
2008-10-28 03:08 . 2008-10-29 14:41 <REP> d-------- c:\documents and settings\Kévin\Application Data\foobar2000
2008-10-26 21:07 . 2008-10-26 21:07 <REP> d-------- c:\program files\TVAnts
2008-10-24 21:25 . 2008-10-24 21:25 <REP> d-------- c:\documents and settings\All Users\Application Data\nView_Profiles
2008-10-24 17:58 . 2008-10-24 17:58 <REP> d-------- c:\program files\ClamWin
2008-10-24 17:58 . 2008-10-24 17:58 <REP> d-------- c:\documents and settings\Kévin\Application Data\.clamwin
2008-10-24 17:58 . 2008-10-24 17:58 <REP> d-------- c:\documents and settings\All Users\.clamwin
2008-10-24 10:16 . 2008-10-24 10:23 <REP> d-------- c:\program files\Dofus
2008-10-24 08:08 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-12 22:09 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-11 16:29 --------- d-----w c:\program files\Windows Live Safety Center
2008-11-05 01:36 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-05 01:36 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 10:06 --------- d-----w c:\program files\MSBuild
2008-10-23 10:06 --------- d-----w c:\program files\Microsoft Works
2008-10-23 00:46 --------- d-----w c:\program files\NOS
2008-10-23 00:46 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2008-10-23 00:00 --------- d-----w c:\program files\Windows Live
2008-10-22 23:58 --------- dcsh--w c:\program files\Fichiers communs\WindowsLiveInstaller
2008-10-22 23:55 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-10-22 23:11 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-10-22 18:37 2,100 ----a-w c:\windows\system32\drivers\sthdae.log
2008-10-22 15:53 --------- d-----w c:\program files\MSXML 6.0
2008-10-22 14:20 --------- d-----w c:\program files\CONEXANT
2008-10-22 13:22 --------- d-----w c:\documents and settings\All Users\Application Data\Dell
2008-10-22 13:11 5 ----a-w c:\windows\system32\drivers\DELL_XPS_MP061 .MRK
2008-10-22 13:11 5 ----a-w c:\windows\system32\drivers\1028_DELL_XPS_MP061 .MRK
2008-10-22 13:10 --------- d-----w c:\program files\Dell
2008-10-22 13:06 --------- d-----w c:\program files\Synaptics
2008-10-22 12:50 --------- d-----w c:\documents and settings\Kévin\Application Data\InstallShield
2008-10-22 12:30 --------- d-----w c:\program files\SigmaTel
2008-10-22 12:30 --------- d-----w c:\program files\Intel Desktop Boards
2008-10-22 12:23 376,832 ----a-w c:\windows\system32\AegisI5Installer.exe
2008-10-22 12:23 21,361 ----a-w c:\windows\system32\drivers\AegisP.sys
2008-10-22 12:23 21,361 ----a-w c:\windows\AegisP.sys
2008-10-22 12:23 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\Intel
2008-10-22 12:23 --------- d-----w c:\program files\Intel
2008-10-22 12:23 --------- d-----w c:\documents and settings\NetworkService\Application Data\Intel
2008-10-22 12:23 --------- d-----w c:\documents and settings\LocalService\Application Data\Intel
2008-10-22 12:23 --------- d-----w c:\documents and settings\Kévin\Application Data\Intel
2008-10-22 12:23 --------- d-----w c:\documents and settings\All Users\Application Data\Intel
2008-10-22 12:21 --------- d-----w c:\program files\Broadcom
2008-10-21 21:15 --------- d-----w c:\program files\microsoft frontpage
2008-10-21 21:13 --------- d-----w c:\program files\Services en ligne
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:15 1,307,648 ----a-w c:\windows\system32\msxml6.dll
2008-09-04 17:16 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2007-12-10 16:40 6,275,816 ----a-w c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Google Update"="c:\documents and settings\Kévin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-23 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-28 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-28 81920]
"ClamWin"="c:\program files\ClamWin\bin\ClamTray.exe" [2008-11-04 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-10-28 136600]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"JeticoPFStartup"="c:\program files\Jetico\Jetico Personal Firewall\jpf.exe" [2008-11-06 455408]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"nwiz"="nwiz.exe" [2007-04-28 c:\windows\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2007-04-28 c:\windows\system32\nvhotkey.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=gyoosy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm

[HKLM\~\startupfolder\C:^Documents and Settings^Kévin^Menu Démarrer^Programmes^Démarrage^MagicDisc.lnk]
path=c:\documents and settings\Kévin\Menu Démarrer\Programmes\Démarrage\MagicDisc.lnk
backup=c:\windows\pss\MagicDisc.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Kévin^Menu Démarrer^Programmes^Démarrage^Microsoft Office Groove.lnk]
path=c:\documents and settings\Kévin\Menu Démarrer\Programmes\Démarrage\Microsoft Office Groove.lnk
backup=c:\windows\pss\Microsoft Office Groove.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-08-08 13:11 490952 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
--a------ 2007-05-14 13:23 1191936 c:\program files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2007-08-24 07:00 33648 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-09-29 17:57 21755688 c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18514:TCP"= 18514:TCP:BitComet 18514 TCP
"18514:UDP"= 18514:UDP:BitComet 18514 UDP

R1 bc_hash_f;BC_HASH_Filter;c:\windows\system32\drivers\bc_hash_f.sys [2008-11-06 14568]
R3 BcfilterMP;BcfilterMP;c:\windows\system32\DRIVERS\bcfilter.sys [2008-11-06 23656]
S2 Jetico Personal Firewall server;Jetico Personal Firewall server;"c:\program files\Jetico\Jetico Personal Firewall\jpfsrv.exe" [2008-11-06 459504]
S3 Bcfilter;Jetico Personal Firewall Network Monitor;c:\windows\system32\DRIVERS\bcfilter.sys [2008-11-06 23656]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d95c64b7-b03d-11dd-90bf-001b7712c7ab}]
\Shell\AutoRun\command - I:\CruzerProfile.exe /autorun
.
Contenu du dossier 'Tâches planifiées'

2008-11-24 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\K []
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{81CA481F-7052-42AB-A65E-F427FF8EB584} - c:\windows\system32\lJaayAqq.dll
BHO-{A2587760-63ED-4EF5-B30D-A7C5B53EE597} - c:\windows\system32\wvUlihIX.dll
BHO-{b8fe4d08-637b-4e6a-8065-7078ef75b80c} - c:\windows\system32\gyoosy.dll
ShellExecuteHooks-{A2587760-63ED-4EF5-B30D-A7C5B53EE597} - c:\windows\system32\wvUlihIX.dll
Notify-wvUlihIX - wvUlihIX.dll


.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\Kévin\Application Data\Mozilla\Firefox\Profiles\d3rtpbjt.default\
FF -: plugin - c:\documents and settings\Kévin\Local Settings\Application Data\Google\Update\1.2.131.27\npGoogleOneClick6.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\np_gp.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-24 22:52:28
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1252)
c:\windows\system32\WgaLogon.dll
c:\windows\System32\BCMLogon.dll
c:\windows\System32\MSVCR71.dll
c:\windows\system32\netprovcredman.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\a-squared Free\a2service.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Heure de fin: 2008-11-24 22:54:13 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-24 21:54:09

Avant-CF: 21 194 641 408 octets libres
Après-CF: 21,213,143,040 octets libres

287 --- E O F --- 2008-11-12 22:09:08

Bonjour,

A priori, MalwareByte n'a rien detecté.
En fait, j'avais fait quelques scan avec antivir qui m'avait viré quelques trojans. Ainsi, FF ne plante plus, je n'ai plus de page IE qui s'ouvre, mon ordi reste en veille.

J'ai aussi fait un tour avec Gmer pour voir si j'avais des RootKit. Bon je ne l'ai pas fait en mode sans echec car je n'arrive pas a la booté en Safeboot, mais il ne m'a rien trouvé en mode normal !

Donc a priori, mon ordi est clean !

Le temps nous le dire !

Merci beaucoup pour votre aide !

Cordialement,

Kevin