Infecté par virtumonde et Smitfraud.c

Bonjour je suis infecté par les trojans Smitfraud.C et virtumonde (.generic),
Mon antivirus ne le détecte pas en faisant un scan, mais il me signale des alertes provenant du registre lorsque je démarre un navigateur (fenêtre publicitaire qui s'ouvre sous IE mais pas sur firefox)
Seul Spybot - Search & Destroy les trouves mais ne les supprime pas (ils reviennent a chaque fois.)

Le resultat du scan par spybot
http://img510.imageshack.us/my.php [...] trefm5.jpg

Voila mon rapport HijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:28:37, on 28/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jonathan\Bureau\Nouveau dossier\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0505E481-478C-4C7D-A79D-23242B6142E6} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-F [...] E_UNO1.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com [...] 0_0_29.cab
O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/l2/bin/cortvrml.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{979FD9B7-9083-4AFF-80FC-C46645031BAD}: NameServer = 192.168.1.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{FDF7C903-6B13-4098-A132-93444A41F0A7}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll ocxgcz.dll
O20 - Winlogon Notify: cbXRJCus - cbXRJCus.dll (file missing)
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

--
End of file - 6136 bytes

Merci pour votre aide .

Merci, de ta reponse,
Je pense avoir réussi a les eliminer :
Pour smitfraud j'ai utilisé Smitfraudfix en mode sans echec
et pour virtumonde Malware bytes en mode sans echec (trouvé sur un site avec un tuto pour l'eliminer)

J'ai refait un scan par spybot ( en mode sans echec, puis normal) , et il ne trouve plus aucun des 2, Je voudrais quand meme etre sûr ( les lignes 2 et 20 n'ont pas l'air d'avoir changer)
Voici le rapport Hijackthis
Plus bas le log de ComboFix

Sinon voici, le rapport ComboFix:

ComboFix 08-11-27.07 - Jonathan 2008-11-28 20:14:10.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.582 [GMT 1:00]
Lancé depuis: c:\documents and settings\Jonathan\Bureau\Nouveau dossier\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Jonathan\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
c:\windows\system32\Dvbpws.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-28 au 2008-11-28 ))))))))))))))))))))))))))))))))))))
.

2008-11-28 18:13 . 2008-11-28 18:13 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-28 18:13 . 2008-11-28 18:13 <REP> d-------- c:\documents and settings\Jonathan\Application Data\Malwarebytes
2008-11-28 18:13 . 2008-11-28 18:13 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-28 18:13 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-28 18:13 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-28 17:19 . 2008-11-28 17:35 2,028 --a------ c:\windows\system32\tmp.reg
2008-11-28 17:18 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
2008-11-28 17:18 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
2008-11-28 17:18 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe
2008-11-28 17:18 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe
2008-11-28 17:18 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe
2008-11-28 17:18 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe
2008-11-28 17:18 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe
2008-11-28 17:18 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe
2008-11-28 17:18 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
2008-11-28 17:18 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
2008-11-28 17:13 . 2008-11-28 17:59 <REP> d-------- c:\windows\BDOSCAN8
2008-11-28 16:47 . 2008-11-28 16:47 <REP> d-------- C:\VundoFix Backups
2008-11-27 21:01 . 2008-11-27 21:01 <REP> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-27 20:59 . 2008-11-28 16:26 <REP> d-------- c:\program files\SUPERAntiSpyware
2008-11-17 17:47 . 2008-11-17 17:47 <REP> d-------- c:\program files\Room Arranger
2008-11-12 12:14 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 12:13 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-04 12:04 . 2008-11-04 12:04 <REP> d-------- c:\windows\Logs
2008-11-04 11:59 . 2008-11-04 12:00 <REP> d-------- c:\program files\Hamachi
2008-11-04 11:57 . 2008-11-04 11:57 <REP> d-------- c:\program files\Ubisoft
2008-11-04 11:21 . 2008-11-15 09:09 54,156 --ah----- c:\windows\QTFont.qfn
2008-11-04 11:21 . 2008-11-04 11:21 1,409 --a------ c:\windows\QTFont.for
2008-11-02 19:21 . 2006-04-17 08:34 16,143,872 -r------- c:\windows\RTHDCPL.exe
2008-11-02 19:21 . 2006-03-14 08:49 9,711,104 -r------- c:\windows\RTLCPL.exe
2008-11-02 19:21 . 2006-04-17 09:31 4,262,912 -r------- c:\windows\system32\drivers\RtkHDAud.Sys
2008-11-02 19:21 . 2006-03-14 08:45 2,809,344 -r------- c:\windows\alcwzrd.exe
2008-11-02 19:21 . 2006-03-10 12:32 2,158,592 -r------- c:\windows\MicCal.exe
2008-11-02 19:21 . 2006-03-09 10:45 364,544 -r------- c:\windows\RtlUpd.exe
2008-11-02 19:21 . 2005-09-21 03:25 299,008 -r------- c:\windows\system32\ALSndMgr.Cpl
2008-11-02 19:21 . 2006-01-10 06:58 266,240 -r------- c:\windows\system32\RTSndMgr.Cpl
2008-11-02 19:21 . 2006-02-20 10:00 86,016 -r------- c:\windows\SoundMan.exe
2008-11-02 19:21 . 2005-05-03 11:43 69,632 -r------- c:\windows\Alcmtr.exe
2008-11-02 19:21 . 2005-07-15 09:48 40,960 -r------- c:\windows\system32\ChCfg.exe
2008-11-02 19:20 . 2008-11-02 19:20 <REP> d-------- c:\program files\Realtek
2008-11-02 19:20 . 2005-04-16 15:20 487,424 -r------- c:\windows\RtlExUpd.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-28 19:18 73,489,952 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-28 19:18 3,284,256 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-28 19:16 991,412 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-28 19:16 313,052 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-28 18:10 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-11-28 17:54 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-28 15:26 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-11-27 18:25 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-27 17:29 --------- d-----w c:\program files\Activision
2008-11-27 16:48 --------- d-----w c:\documents and settings\Jonathan\Application Data\Hamachi
2008-11-26 13:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-25 12:36 --------- d-----w c:\documents and settings\Jonathan\Application Data\Kaspersky_Key_Finder_(KKF
2008-11-24 17:15 --------- d-----w c:\documents and settings\Jonathan\Application Data\Canon
2008-11-23 16:41 --------- d-----w c:\documents and settings\Jonathan\Application Data\OpenOffice.org2
2008-11-20 17:30 --------- d-----w c:\program files\Electronic Arts
2008-11-20 16:30 --------- d-----w c:\program files\ASUS
2008-11-16 19:20 --------- d-----w c:\documents and settings\Jonathan\Application Data\U3
2008-11-04 11:03 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-04 11:03 22,328 ----a-w c:\documents and settings\Jonathan\Application Data\PnkBstrK.sys
2008-11-04 10:59 17,480 ----a-w c:\windows\system32\drivers\hamachi.sys
2008-11-03 16:36 --------- d-----w c:\program files\Microsoft ActiveSync
2008-11-02 18:05 --------- d-----w c:\program files\SystemRequirementsLab
2008-11-02 18:05 --------- d-----w c:\documents and settings\Jonathan\Application Data\SystemRequirementsLab
2008-11-02 17:59 --------- d-----w c:\program files\ma-config.com
2008-11-02 17:59 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-21 16:04 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-16 18:18 --------- d-----w c:\program files\REALTEK RTL8187 Wireless LAN Driver
2008-10-08 15:23 --------- d-----w c:\program files\Messenger Plus! Live
2008-10-08 15:20 --------- d-----w c:\program files\Windows Live
2008-10-08 15:20 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-10-07 11:33 6,133,856 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2008-10-04 08:29 --------- d-----w c:\program files\UltraDefrag
2008-10-01 18:32 --------- dc-h--w c:\documents and settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2008-10-01 16:44 --------- d-----w c:\documents and settings\All Users\Application Data\nView_Profiles
2008-10-01 12:32 82,272 ----a-w c:\windows\system32\drivers\jraid.sys
2008-09-30 18:01 --------- d-----w c:\program files\REALTEK RTL8187B Wireless LAN Driver
2008-09-30 18:01 --------- d-----w c:\documents and settings\Jonathan\Application Data\InstallShield
2008-09-30 17:57 --------- d-----w c:\documents and settings\Jonathan\Application Data\TMP
2005-10-26 11:48 40,448 ----a-w c:\documents and settings\Jonathan\trial_setup52.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1970176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\zellnoella@hotmail.com\\source sdk base\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\zellnoella@hotmail.com\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Java\\jre1.6.0_02\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Valve\\Steam\\Steam.exe"=
"c:\\Program Files\\ASUS\\AsusUpdate\\Update.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\zellnoella@hotmail.com\\counter-strike\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\trackmania nations forever\\TmForever.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\al3x77340\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\al3x77340\\source sdk base\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\enemy territory quake wars demo 2\\etqw.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\zellnoella@hotmail.com\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\al3x77340\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 7.0\\avp.exe"=
"c:\\Documents and Settings\\Jonathan\\Mes documents\\Documents Alex\\le4de-UpbyNems54ForHomicideTeam\\left 4 dead\\hl2.exe"=

R2 WFCXVCAP;WinFast TV Video Capture Driver;c:\windows\system32\drivers\wfcxvcap.sys [2008-10-22 167296]
R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc []
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-04-04 24344]
R3 wfcxdtun;WinFast DTV BDA Tuner/Demod Driver;c:\windows\system32\drivers\wfcxdtun.sys [2008-10-22 21248]
R3 wfcxtcap;WinFast DTV BDA Transport Stream Capture Driver;c:\windows\system32\drivers\wfcxtcap.sys [2008-10-22 15872]
R3 wfcxxbar;WinFast TV Crossbar Driver;c:\windows\system32\drivers\wfcxxbar.sys [2008-10-22 10368]
S3 Asushwio;Asushwio;\??\c:\windows\system32\drivers\Asushwio.sys [2007-08-29 5824]
S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-11-02 195752]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2007-08-29 332928]
S3 se59bus;Sony Ericsson Device 089 driver (WDM);c:\windows\system32\DRIVERS\se59bus.sys [2008-06-24 61536]
S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter;c:\windows\system32\DRIVERS\se59mdfl.sys [2008-06-24 9360]
S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver;c:\windows\system32\DRIVERS\se59mdm.sys [2008-06-24 97088]
S3 se59mgmt;Sony Ericsson Device 089 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\se59mgmt.sys [2008-06-24 88624]
S3 se59nd5;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (NDIS);c:\windows\system32\DRIVERS\se59nd5.sys [2008-06-24 18704]
S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\se59obex.sys [2008-06-24 86432]
S3 se59unic;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (WDM);c:\windows\system32\DRIVERS\se59unic.sys [2008-06-24 90800]
S3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys [2007-08-29 13532]
S3 WFIOCTL;WFIOCTL;\??\c:\program files\WinFast\WFDTV\WFIOCTL.SYS [2007-08-29 9446]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{0505E481-478C-4C7D-A79D-23242B6142E6} - (no file)
Notify-cbXRJCus - cbXRJCus.dll


.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\Jonathan\Application Data\Mozilla\Firefox\Profiles\r18srus9.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/
FF -: plugin - c:\documents and settings\Jonathan\Application Data\Mozilla\Firefox\Profiles\r18srus9.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF -: plugin - c:\program files\ma-config.com\nphardwaredetection.dll
FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll
FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-28 20:17:52
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1128)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\klogon.dll

- - - - - - - > 'lsass.exe'(1184)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2008-11-28 20:22:08 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-28 19:22:05

Avant-CF: 53 479 038 976 octets libres
Après-CF: 53,385,359,360 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

216 --- E O F --- 2008-11-12 15:00:26

Le voici :
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1432
Windows 5.1.2600 Service Pack 3

28/11/2008 18:53:38
mbam-log-2008-11-28 (18-53-38).txt

Type de recherche: Examen rapide
Eléments examinés: 46238
Temps écoulé: 6 minute(s), 13 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Tout est réglé merci pour tout