trojan ???

Bonjour,

Je vais t'aider à résoudre ton problème. Merci de suivre à la lettre mes instructions et de ne pas prendre d'initiatives personnelles. Si tu as la moindre question, je suis à ton écoute.

Merci de prendre en compte que je suis bénévole et que j'ai une vie privée : je passe au moins une fois par jour.

Si tu penses avoir été oublié, envoie-moi un MP pour me le signaler.

1) Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

• Lance l'installation du programme en exécutant le fichier téléchargé.
• Double-clique maintenant sur le raccourci de Toolbar-S&D.
• Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
• Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
• Poste le rapport généré. (C:\TB.txt)

2) Télécharge Gmer.

• Dézippe-le dans un dossier dédié ou sur ton Bureau.
• Déconnecte toi d'Internet puis ferme tous les programmes.
• Double-clique sur Gmer.exe.

Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.

• Clique sur l'onglet Rootkit.
• A droite, coche tout.
• Clique maintenant sur Scan.
• Lorsque le scan est terminé, clique sur Copy.
• Ouvre le Bloc-notes puis clique sur le Menu Edition / Coller.
• Le rapport doit alors apparaître.
• Enregistre le fichier sur ton Bureau et upload-le sur mediafire.

Uploader un fichier sur mediafire :

• Rends-toi sur ce lien : http://www.mediafire.com/
• Clique en haut sur "Upload files To Media fire". Choisis ensuite "I want to upload without an account"
• Une fenêtre de ton explorateur windows va s'ouvrir. Navigue jusqu'au rapport que je te demande d'uploader, sélectionne-le puis clique sur "ouvrir".
• Clique ensuite sur "Upload".
• A droite de l'écran, choisis : "upload to a new folder". Laisse le nom par défaut ( = la date )
• Valide et laisse l'upload se faire.
• Clique sur "Vieuw uploaded file" et copie-moi l'url ( = le lien ) du nouvel onglet ou de la nouvelle fenêtre qui va s'ouvrir dans ton prochain message. Ainsi, je pourrais télécharger le rapport demandé.

3) Télécharge DDS de sUBs et sauvegarde-le sur ton bureau.

• Désactive tout script bloquant, tel q'un antivirus, un logiciel comme ad-block, noscript etc.
• Double-clique sur dds.scr pour lancer l'outil. Ne double clique qu'une seule fois dessus, sois patient !
• Une fois le scan fini, un document texte, DDS.txt, va s'ouvrir .
• Clique Oui à la prochaine invite Optional Scan.
• Sauvegarde les deux rapports sur ton bureau et poste-moi uniquement le DDS.txt, garde l'autre sous la main si jamais je te le demande. Copie/colle le rapport sur le forum. N'uploade des fichiers sur mediafire que si j'en fais la demande explicite.

voici maintenant l'url mediafire:


http://www.mediafire.com/?sharekey [...] fc50680295

merci encore et bonne fin de soirée

rapport otmoveit:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\DOCUME~1\niko\Application Data\Azureus\torrents\Crack.Far-Cry.2_New-Serial-TeamFFF.rar.torrent moved successfully.
C:\DOCUME~1\niko\Application Data\Azureus\torrents\Far Cry 2 1.01 Patch crack keygen.torrent moved successfully.
C:\DOCUME~1\niko\Application Data\Azureus\torrents\Far Cry 2 crack Fully Working.rar.torrent moved successfully.
C:\DOCUME~1\niko\Application Data\Azureus\torrents\FARCRY_2_Keygen_1522047.torrent moved successfully.
C:\DOCUME~1\niko\Application Data\Microsoft\Office\Recent\Key serial Crack.doc.LNK moved successfully.
C:\DOCUME~1\niko\Mes documents\log install\Clone CD v5.0.3.1 + Crack.rar moved successfully.
C:\DOCUME~1\niko\Mes documents\log install\CloneCD_5.0.3.1_CrackFile.rar moved successfully.
C:\DOCUME~1\niko\Mes documents\log install\NTI cddvdmaker 7.5 + Fr + Keygen.zip moved successfully.
C:\DOCUME~1\niko\Mes documents\log install\Total Video Converter 3.11 Crack.rar moved successfully.
C:\DOCUME~1\niko\Mes documents\log install\Winiso v5.3 Fr Incl-Keygen.rar moved successfully.
C:\DOCUME~1\niko\Mes documents\log install\Winrar v3.71 Fr Keygen For Windows Xp & Vista.zip moved successfully.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\gps\Dvd Tomtom 6 Multilang Crack Poi Radar Fr 07-06.iso not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\gps\Dvd Tomtom Navigator Europe 6.010 Fr Crack By Lu7.iso not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\gps\Tomtom Maps Product Code Plus Keygen Updated-Fixed Release 06-2007.zip not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\gps\Tomtom Navigator 6 Fr(Crack) Avec Plugin Today Carte De France Lisezmoi.rar not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Crack not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Crack.Far-Cry.2_New-Serial-TeamFFF.rar not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Far Cry 2 1.01 Patch crack keygen not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Far Cry 2 crack Fully Working.rar not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Crack\Call of Duty 4 Serial.txt not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Far Cry 2 1.01 Patch crack keygen\data.cab not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Far Cry 2 1.01 Patch crack keygen\dbm.db not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Far Cry 2 1.01 Patch crack keygen\Enviroment.dll not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Far Cry 2 1.01 Patch crack keygen\settings.dll not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Far Cry 2 1.01 Patch crack keygen\setup.exe not found.
File/Folder C:\DOCUME~1\niko\Mes documents\t‚l‚charg‚\jeu\Far Cry 2 1.01 Patch crack keygen\windows.dll not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5d0.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12102008_233953

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
C:\WINDOWS\temp\Perflib_Perfdata_5d0.dat moved successfully.

et voici l'info.txt:



info.txt logfile of random's system information tool 1.04 2008-12-10 23:48:22

======Uninstall list======

-->"C:\Program Files\Creative\SBAudigy2\Program\Ctzapxx.EXE" /W /U /S /L:FRN
-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1494984B-9AC5-4F16-B61A-C21D5EFCC1C4}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1494984B-9AC5-4F16-B61A-C21D5EFCC1C4}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{169F8893-C1C5-4847-972C-EA1E008112AC}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{169F8893-C1C5-4847-972C-EA1E008112AC}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{236FADD8-58FD-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{236FADD8-58FD-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{266F8C74-5DC6-4405-B79B-4EB82B2FC684}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{266F8C74-5DC6-4405-B79B-4EB82B2FC684}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{435E969D-867E-4364-8E74-3DC8A69C5BDB}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{435E969D-867E-4364-8E74-3DC8A69C5BDB}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5210ED6D-52A9-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5210ED6D-52A9-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CDDF96A-BC34-4D72-9ABA-E1FFF0C39977}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7201B853-5833-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7201B853-5833-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{87499F38-FD69-4A2B-B41A-BAB8DE9B94FE}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9154ED7C-926E-49CC-B677-0CF3C5267457}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9154ED7C-926E-49CC-B677-0CF3C5267457}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1185190-514F-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1185190-514F-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AC157741-3285-4D6A-B934-9174587A3493}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AC157741-3285-4D6A-B934-9174587A3493}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DEBD7BF3-5856-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DEBD7BF3-5856-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x40c /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB2292C6-1F0A-11D7-AB2D-0090271A23A2}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB2292C6-1F0A-11D7-AB2D-0090271A23A2}\setup.exe" -l0x40c /remove
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.3-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003}
Apple Mobile Device Support-->MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ASAPI Update-->C:\WINDOWS\system32\IWUNIN~1.EXE -uninstall C:\WINDOWS\ISUNINST.EXE -fC:\PROGRA~1\VOB\ASAPIU~1\ASAPI.isu
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
ASUSUpdate-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{587178E7-B1DF-494E-9838-FA4DD36E873C}\Setup.exe" -l0x40c
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Azureus Vuze-->C:\Program Files\Azureus\uninstall.exe
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
CloneCD-->"C:\Program Files\SlySoft\CloneCD\ccd-uninst.exe" /D="C:\Program Files\SlySoft\CloneCD"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Creative System Information-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{87499F38-FD69-4A2B-B41A-BAB8DE9B94FE}\setup.exe" -l0x40c /remove
DAEMON Tools-->MsiExec.exe /I{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}
dBpowerAMP Music Converter-->"C:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Music Converter.dat
dMC Power Pack-->"C:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>C:\WINDOWS\system32\SpoonUninstall-dMC Power Pack.dat
eMule-->"C:\Program Files\eMule\Uninstall.exe"
EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
EPSON TWAIN 5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A3EABC0-CA06-11D4-BF77-00104B130C19}\setup.exe" -l0x40c UNINSTALL
Far Cry 2-->"C:\Program Files\InstallShield Installation Information\{F2835483-37F2-4123-B4FE-0E77D58447F2}\setup.exe" -runfromtemp -l0x040c -removeonly
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
High Definition Audio Driver Package - KB888111-->C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.0 (KB932471)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {ECD292A0-0347-4244-8C24-5DBCE990FB40} /package {BAF78226-3200-4DB4-BE33-4D922A799840}
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Format SDK (KB902344)-->"C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe"
iPod for Windows 2006-06-28-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{BD57EA4D-026E-4F08-9B93-080E282B81FE} /l1036
iTunes-->MsiExec.exe /I{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
K-Lite Codec Pack 3.6.5 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LG PC Suite-->C:\Program Files\InstallShield Installation Information\{993960EE-CA4D-443F-8F88-E24260DD5FD2}\setup.exe -runfromtemp -l0x040c -removeonly
LG USB Modem driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C3ABE126-2BB2-4246-BFE1-6797679B3579}\setup.exe" -l0x40c LG -removeonly
livebox-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe" -l0x40c
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
NTI CD & DVD-Maker 7 Platinum-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{95B87E45-CC33-49B6-9B4C-6570941FA90C} CDM7
NTI CD-Maker Platinum French Plugin-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{5AB1E5D8-82C2-47DE-9AA7-2D6234446C3C}
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
NVIDIA ForceWare Network Access Manager-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{1F6423DE-7959-4178-80E0-023C7EAA5347} /l1036
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Package de base Microsoft de service de chiffrement pour cartes à puce-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Panneau de configuration MobileMe-->MsiExec.exe /I{6DA9102E-199F-43A0-A36B-6EF48081A658}
PC Probe II-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}\setup.exe" -l0x40c
Pense-Bete 79f-->"C:\Program Files\Pense-bete\unins000.exe"
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Safari-->MsiExec.exe /I{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868}
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
Security Update for Visio 2007 (KB947590)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
Sound Blaster Audigy 2-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CECB9B3D-E681-4458-85F8-8D182941AF1D}\SETUP.EXE" -l0x40c
SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe" -l0x40c -removeonly
Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
Steinberg WaveLab 5.01b-->C:\PROGRA~1\STEINB~1\WaveLab\UNWISE.EXE C:\PROGRA~1\STEINB~1\WaveLab\INSTALL.LOG
Total Video Converter 3.11 070908-->"C:\Program Files\Total Video Converter\unins000.exe"
TuneUp Utilities 2008-->MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA}
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb958619)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {79B301C1-DBC0-467C-AFDA-2A6CDAFA4302}
VGA Utility-->MsiExec.exe /I{D27BDB5D-3B4C-44F0-A648-BD00B0E79B39}
VideoLAN VLC media player 0.8.6a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation FR Language Pack-->MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

======Security center information======

AV: avast! antivirus 4.8.1296 [VPS 081210-0]
FW: ActiveArmor Firewall (disabled)

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 107 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=6b02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

-----------------EOF-----------------

voici le rapport combofix:

ComboFix 08-12-13.03 - niko 2008-12-14 14:46:03.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2559.2144 [GMT 1:00]
Lancé depuis: c:\documents and settings\niko\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\sc32.dll
c:\windows\system32\43upd.dll
c:\windows\system32\44upd.dll
c:\windows\system32\45upd.dll
c:\windows\system32\46upd.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-14 au 2008-12-14 ))))))))))))))))))))))))))))))))))))
.

2008-12-10 23:48 . 2008-12-10 23:48 <REP> d-------- C:\rsit
2008-12-10 23:39 . 2008-12-10 23:39 <REP> d-------- C:\_OTMoveIt
2008-12-09 23:22 . 2008-12-09 23:25 250 --a------ c:\windows\gmer.ini
2008-12-09 23:15 . 2008-12-09 23:17 <REP> d-------- C:\ToolBar SD
2008-12-09 22:07 . 2008-12-10 23:35 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-09 20:23 . 2008-12-10 23:35 <REP> d-------- c:\program files\a-squared Free
2008-12-09 20:03 . 2008-12-09 20:03 <REP> d-------- c:\program files\Trend Micro
2008-12-09 19:27 . 2008-12-14 14:46 403 --a------ c:\windows\iexplore.htm
2008-12-09 18:46 . 2008-12-09 18:46 <REP> d-------- c:\program files\Lavasoft
2008-12-05 08:39 . 2008-12-05 08:39 25,600 --a------ c:\windows\system32\upd46.exe
2008-12-05 08:39 . 2008-12-05 08:39 25,600 --a------ c:\windows\system32\LSHPRN.EXE
2008-11-27 21:53 . 2008-11-27 21:58 <REP> d-------- c:\windows\NV17002656.TMP
2008-11-27 21:31 . 2008-11-27 21:35 24,576 --a------ c:\windows\system32\upd42.exe
2008-11-27 21:31 . 2008-11-27 21:35 24,576 --a------ c:\windows\system32\LSGPRN.EXE
2008-11-26 20:42 . 2008-11-26 20:42 <REP> dr-h----- c:\documents and settings\niko\Application Data\SecuROM
2008-11-26 20:16 . 2008-11-26 20:16 <REP> d-------- c:\windows\Logs
2008-11-26 20:16 . 2008-11-26 20:16 22,328 --a------ c:\documents and settings\niko\Application Data\PnkBstrK.sys
2008-11-26 20:12 . 2008-11-26 20:12 <REP> d-------- c:\program files\Ubisoft
2008-11-25 10:23 . 2008-11-25 10:24 <REP> d-------- c:\program files\Pense-bete
2008-11-25 10:23 . 2008-12-12 10:11 <REP> d-------- c:\documents and settings\niko\Application Data\Pense-bete
2008-11-23 22:12 . 2008-11-23 22:12 319 --a------ c:\windows\game.ini
2008-11-23 22:07 . 2008-11-23 22:07 <REP> d-------- c:\program files\Activision
2008-11-23 21:53 . 2008-11-23 21:53 <REP> d--hs---- c:\windows\ftpcache
2008-11-14 13:23 . 2008-11-14 13:23 <REP> d--h----- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-12 22:28 --------- d-----w c:\program files\eMule
2008-12-12 22:27 --------- d-----w c:\documents and settings\niko\Application Data\Azureus
2008-12-12 09:24 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-12-10 10:13 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-09 17:46 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-09 17:45 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-12-09 10:58 --------- d-----w c:\program files\Windows Live Safety Center
2008-11-27 23:06 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-11-27 20:47 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-11-27 06:49 109,249 ----a-w c:\program files\MSWINSCK.OCX
2008-11-26 19:12 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-26 12:27 --------- d-----w c:\program files\Azureus
2008-11-11 15:55 --------- d-----w c:\program files\VOB
2008-11-11 15:53 --------- d-----w c:\program files\Steinberg
2008-11-06 19:59 --------- d-----w c:\documents and settings\niko\Application Data\TuneUp Software
2008-11-06 19:59 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-11-06 15:06 --------- d-----w c:\documents and settings\All Users\Application Data\Azureus
2008-10-24 11:21 455,296 ------w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 10:32 --------- d-----w c:\program files\Microsoft Silverlight
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-22 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"PrinterSecurityLayer"="c:\windows\system32\LSHPRN.EXE" [2008-12-05 25600]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-02-23 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\niko\Menu D‚marrer\Programmes\D‚marrage\
Pense-Bˆte 79f.lnk - c:\program files\Pense-bete\pb79f.exe [2008-11-25 2184192]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\regedit.exe]
"Debugger"=0

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\taskmgr.exe]
"Debugger"=0

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=c:\windows\pss\Outil de mise à jour Google.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^niko^Menu Démarrer^Programmes^Démarrage^GIGABYTE VGA Utility.lnk]
path=c:\documents and settings\niko\Menu Démarrer\Programmes\Démarrage\GIGABYTE VGA Utility.lnk
backup=c:\windows\pss\GIGABYTE VGA Utility.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-10-15 01:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-09-03 19:12 111936 c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AsusStartupHelp]
-ra--c--- 2006-11-14 07:25 363008 c:\program files\ASUS\AASP\1.00.16\AsRunHelp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a--c--- 2004-09-02 22:57 57344 c:\program files\SlySoft\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
--a--c--- 2003-06-18 01:00 45056 c:\program files\Creative\SBAudigy2\DVDAudio\CTDVDDET.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
--a--c--- 2003-09-17 10:43 57344 c:\program files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a--c--- 2004-08-22 16:05 81920 c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a--c--- 2005-08-11 09:30 249856 c:\program files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a--c--- 2005-08-11 09:30 81920 c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBDrvDet]
--a--c--- 2002-12-03 18:06 45056 c:\program files\Creative\SB Drive Det\SBDrvDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
-----c--- 2006-07-13 07:12 729088 c:\program files\Analog Devices\SoundMAX\SMax4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
-ra--c--- 2006-12-18 14:34 868352 c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-01-22 10:41 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-23 13:45 185896 c:\program files\Fichiers communs\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
-----c--- 2000-05-11 01:00 90112 c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a--c--- 2008-08-04 00:02 36352 c:\program files\Winamp\winampa.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
"PrinterSecurityLayer"=c:\windows\system32\LSHPRN.EXE
"nwiz"=nwiz.exe /install
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"CTHelper"=CTHELPER.EXE
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Fichiers communs\\NewTech Infosystems\\LiveUpdate\\LiveUpdate.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=

R1 Asapi;Asapi;c:\windows\system32\drivers\Asapi.sys [2008-11-11 11264]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-06-26 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-06-26 20560]
S2 FAH@C:+DOCUME~1+niko+LOCALS~1+Temp+IXP000.TMP+s.exe;FAH@C:+DOCUME~1+niko+LOCALS~1+Temp+IXP000.TMP+s.exe;c:\docume~1\niko\LOCALS~1\Temp\IXP000.TMP\s.exe -svcstart []
S3 NikeDrv;Pilote nike psa[play;c:\windows\system32\Drivers\NikeDrv.sys [2001-08-17 22:24:44 12032]
S3 SaiHFF0D;SaiHFF0D;c:\windows\system32\DRIVERS\SaiHFF0D.sys [2008-08-24 176000]
S3 SaiUFF0D;SaiUFF0D;c:\windows\system32\DRIVERS\SaiUFF0D.sys [2008-08-24 27136]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2008-12-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-05 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-06-20 09:23]
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe
MSConfigStartUp-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

c:\windows\Downloaded Program Files\InstallerControl.dll - O16 -: CabBuilder
hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
c:\windows\Downloaded Program Files\OSDED4D.OSD
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-14 14:48:15
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
"ServiceDll"="c:\windows\system32\es.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@C:+DOCUME~1+niko+LOCALS~1+Temp+IXP000.TMP+s.exe]
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\MsPMSPSv.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\program files\Windows Live\Messenger\usnsvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2008-12-14 14:50:03 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-14 13:50:01

Avant-CF: 443 002 683 392 octets libres
Après-CF: 443,101,245,440 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect /usepmtimer

235 --- E O F --- 2008-12-12 09:40:59

voici le résultat :

Fichier LSHPRN.EXE reçu le 2008.12.17 12:23:40 (CET)Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.12.17.3 2008.12.17 -
AntiVir 7.9.0.45 2008.12.17 TR/Downloader.Gen
Authentium 5.1.0.4 2008.12.17 -
Avast 4.8.1281.0 2008.12.16 -
AVG 8.0.0.199 2008.12.17 -
BitDefender 7.2 2008.12.17 DeepScan:Generic.Malware.SYd!dld.3139AED9
CAT-QuickHeal 10.00 2008.12.17 -
ClamAV 0.94.1 2008.12.17 -
Comodo 771 2008.12.17 -
DrWeb 4.44.0.09170 2008.12.17 DLOADER.Trojan
eSafe 7.0.17.0 2008.12.16 -
eTrust-Vet 31.6.6265 2008.12.17 -
Ewido 4.0 2008.12.16 -
F-Prot 4.4.4.56 2008.12.17 -
F-Secure 8.0.14332.0 2008.12.17 -
Fortinet 3.117.0.0 2008.12.17 PossibleThreat
GData 19 2008.12.17 DeepScan:Generic.Malware.SYd!dld.3139AED9
Ikarus T3.1.1.45.0 2008.12.17 Trojan-Spy.Win32.Agent.DI
K7AntiVirus 7.10.555 2008.12.16 Trojan.Win32.Malware.1
Kaspersky 7.0.0.125 2008.12.17 Heur.Trojan.Generic
McAfee 5466 2008.12.16 Generic.dx
McAfee+Artemis 5466 2008.12.16 Generic.dx
Microsoft 1.4205 2008.12.17 -
NOD32 3698 2008.12.17 probably unknown NewHeur_PE
Norman 5.80.02 2008.12.16 W32/DLoader.LTZX
Panda 9.0.0.4 2008.12.17 Generic Trojan
PCTools 4.4.2.0 2008.12.16 -
Prevx1 V2 2008.12.17 Malicious Software
Rising 21.08.22.00 2008.12.17 Packer.RyCrypt
SecureWeb-Gateway 6.7.6 2008.12.17 Trojan.Downloader.Gen
Sophos 4.36.0 2008.12.17 -
Sunbelt 3.2.1801.2 2008.12.11 -
Symantec 10 2008.12.17 Trojan Horse
TheHacker 6.3.1.4.189 2008.12.16 -
TrendMicro 8.700.0.1004 2008.12.17 Possible_DLDER
VBA32 3.12.8.10 2008.12.16 suspected of MalwareScope.Trojan-PSW.Pinch.45 (paranoid heuristics)
ViRobot 2008.12.17.1523 2008.12.17 -
VirusBuster 4.5.11.0 2008.12.16 -

Information additionnelle
File size: 25600 bytes
MD5...: 58d73c2bf7fe1067f9bf3aef20c0882b
SHA1..: c8e8950883cb2722db94a524f4ff9c92ba507f8f
SHA256: df4fef1147e71d0fd9ae6c82a2aa355e7c64b5e6775a83e6ec0ca2d4c3934f8a
SHA512: 6dd7e5efc39bb91fd276f4c46fb7ea225b4a53a90728b9e905f0ad4fa626a415<BR>9574717016db0933cc07cc3a8186470dd425cd4d8f8165fb93ad39c6a7b55785<BR>
ssdeep: 192:zw9+dqVotTF6fOyf9LPl488NXdH0dHRdHwdHPH1SdHB18GtpbVu11Lre/8Pq<BR>nT3q:z2G2otjyfJl2NXqrmuJNmFvsRY<BR>
PEiD..: -
TrID..: File type identification<BR>Win32 Executable Generic (42.3%)<BR>Win32 Dynamic Link Library (generic) (37.6%)<BR>Generic Win/DOS Executable (9.9%)<BR>DOS Executable Generic (9.9%)<BR>VXD Driver (0.1%)
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x401000<BR>timedatestamp.....: 0x493649d7 (Wed Dec 03 08:56:55 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 2 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x17cc 0x1800 5.86 c56fb08ba43c4f11555d17decdf5ccf2<BR>.data 0x3000 0x4a50 0x4a00 3.81 5e0e2c83b805315187742e190302e872<BR><BR>( 4 imports ) <BR>&gt; kernel32.dll: Sleep, CreateMutexA, GetLastError, ExitProcess, GlobalAlloc, RtlZeroMemory, GlobalFree, CreateFileA, GetFileSize, ReadFile, CloseHandle, WriteFile, WinExec, GetSystemDirectoryA, GetWindowsDirectoryA, GetModuleFileNameA, OpenFile, FindFirstFileA, FindClose, FlushFileBuffers<BR>&gt; advapi32.dll: RegCreateKeyA, RegSetValueExA, RegCloseKey, RegOpenKeyExA, RegCreateKeyExA, RegQueryValueExA<BR>&gt; shell32.dll: ShellExecuteA, SHGetSpecialFolderPathA<BR>&gt; wininet.dll: InternetOpenA, InternetOpenUrlA, InternetReadFile, InternetCloseHandle<BR><BR>( 0 exports ) <BR>
Prevx info: &lt;a href='http://info.prevx.com/aboutprogramtext.asp?PX5=A8DF8D7300DF893564E500D9A29B6B00168AE4B3' target='_blank'&gt;http://info.prevx.com/aboutprogramtext.asp?PX5=A8DF8D7300DF893564E500D9A29B6B00168AE4B3&lt;/a&gt;
packers (F-Prot): embedded
CWSandbox info: &lt;a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=58d73c2bf7fe1067f9bf3aef20c0882b' target='_blank'&gt;http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=58d73c2bf7fe1067f9bf3aef20c0882b&lt;/a&gt;

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.12.17.3 2008.12.17 -
AntiVir 7.9.0.45 2008.12.17 TR/Downloader.Gen
Authentium 5.1.0.4 2008.12.17 -
Avast 4.8.1281.0 2008.12.16 -
AVG 8.0.0.199 2008.12.17 -
BitDefender 7.2 2008.12.17 DeepScan:Generic.Malware.SYd!dld.3139AED9
CAT-QuickHeal 10.00 2008.12.17 -
ClamAV 0.94.1 2008.12.17 -
Comodo 771 2008.12.17 -
DrWeb 4.44.0.09170 2008.12.17 DLOADER.Trojan
eSafe 7.0.17.0 2008.12.16 -
eTrust-Vet 31.6.6265 2008.12.17 -
Ewido 4.0 2008.12.16 -
F-Prot 4.4.4.56 2008.12.17 -
F-Secure 8.0.14332.0 2008.12.17 -
Fortinet 3.117.0.0 2008.12.17 PossibleThreat
GData 19 2008.12.17 DeepScan:Generic.Malware.SYd!dld.3139AED9
Ikarus T3.1.1.45.0 2008.12.17 Trojan-Spy.Win32.Agent.DI
K7AntiVirus 7.10.555 2008.12.16 Trojan.Win32.Malware.1
Kaspersky 7.0.0.125 2008.12.17 Heur.Trojan.Generic
McAfee 5466 2008.12.16 Generic.dx
McAfee+Artemis 5466 2008.12.16 Generic.dx
Microsoft 1.4205 2008.12.17 -
NOD32 3698 2008.12.17 probably unknown NewHeur_PE
Norman 5.80.02 2008.12.16 W32/DLoader.LTZX
Panda 9.0.0.4 2008.12.17 Generic Trojan
PCTools 4.4.2.0 2008.12.16 -
Prevx1 V2 2008.12.17 Malicious Software
Rising 21.08.22.00 2008.12.17 Packer.RyCrypt
SecureWeb-Gateway 6.7.6 2008.12.17 Trojan.Downloader.Gen
Sophos 4.36.0 2008.12.17 -
Sunbelt 3.2.1801.2 2008.12.11 -
Symantec 10 2008.12.17 Trojan Horse
TheHacker 6.3.1.4.189 2008.12.16 -
TrendMicro 8.700.0.1004 2008.12.17 Possible_DLDER
VBA32 3.12.8.10 2008.12.16 suspected of MalwareScope.Trojan-PSW.Pinch.45 (paranoid heuristics)
ViRobot 2008.12.17.1523 2008.12.17 -
VirusBuster 4.5.11.0 2008.12.16 -

Information additionnelle
File size: 25600 bytes
MD5...: 58d73c2bf7fe1067f9bf3aef20c0882b
SHA1..: c8e8950883cb2722db94a524f4ff9c92ba507f8f
SHA256: df4fef1147e71d0fd9ae6c82a2aa355e7c64b5e6775a83e6ec0ca2d4c3934f8a
SHA512: 6dd7e5efc39bb91fd276f4c46fb7ea225b4a53a90728b9e905f0ad4fa626a415<BR>9574717016db0933cc07cc3a8186470dd425cd4d8f8165fb93ad39c6a7b55785<BR>
ssdeep: 192:zw9+dqVotTF6fOyf9LPl488NXdH0dHRdHwdHPH1SdHB18GtpbVu11Lre/8Pq<BR>nT3q:z2G2otjyfJl2NXqrmuJNmFvsRY<BR>
PEiD..: -
TrID..: File type identification<BR>Win32 Executable Generic (42.3%)<BR>Win32 Dynamic Link Library (generic) (37.6%)<BR>Generic Win/DOS Executable (9.9%)<BR>DOS Executable Generic (9.9%)<BR>VXD Driver (0.1%)
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x401000<BR>timedatestamp.....: 0x493649d7 (Wed Dec 03 08:56:55 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 2 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x17cc 0x1800 5.86 c56fb08ba43c4f11555d17decdf5ccf2<BR>.data 0x3000 0x4a50 0x4a00 3.81 5e0e2c83b805315187742e190302e872<BR><BR>( 4 imports ) <BR>&gt; kernel32.dll: Sleep, CreateMutexA, GetLastError, ExitProcess, GlobalAlloc, RtlZeroMemory, GlobalFree, CreateFileA, GetFileSize, ReadFile, CloseHandle, WriteFile, WinExec, GetSystemDirectoryA, GetWindowsDirectoryA, GetModuleFileNameA, OpenFile, FindFirstFileA, FindClose, FlushFileBuffers<BR>&gt; advapi32.dll: RegCreateKeyA, RegSetValueExA, RegCloseKey, RegOpenKeyExA, RegCreateKeyExA, RegQueryValueExA<BR>&gt; shell32.dll: ShellExecuteA, SHGetSpecialFolderPathA<BR>&gt; wininet.dll: InternetOpenA, InternetOpenUrlA, InternetReadFile, InternetCloseHandle<BR><BR>( 0 exports ) <BR>
Prevx info: &lt;a href='http://info.prevx.com/aboutprogramtext.asp?PX5=A8DF8D7300DF893564E500D9A29B6B00168AE4B3' target='_blank'&gt;http://info.prevx.com/aboutprogramtext.asp?PX5=A8DF8D7300DF893564E500D9A29B6B00168AE4B3&lt;/a&gt;
packers (F-Prot): embedded
CWSandbox info: &lt;a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=58d73c2bf7fe1067f9bf3aef20c0882b' target='_blank'&gt;http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=58d73c2bf7fe1067f9bf3aef20c0882b&lt;/a&gt;


merci

voici le rapport pour upd42.exe (il me dit qu'il a déja été analyser)

Fichier upd42.exe reçu le 2008.11.27 18:18:41 (CET)Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 - - -
AntiVir - - TR/Crypt.XPACK.Gen
Authentium - - -
Avast - - -
AVG - - -
BitDefender - - DeepScan:Generic.Malware.SYd!dld.A34684A2
CAT-QuickHeal - - -
ClamAV - - -
DrWeb - - DLOADER.Trojan
eSafe - - -
eTrust-Vet - - -
Ewido - - -
F-Prot - - -
F-Secure - - Suspicious:W32/Malware!Gemini
Fortinet - - -
GData - - DeepScan:Generic.Malware.SYd!dld.A34684A2
Ikarus - - Trojan-Spy.Win32.Agent.DI
K7AntiVirus - - -
Kaspersky - - -
McAfee - - -
McAfee+Artemis - - -
Microsoft - - TrojanDownloader:Win32/Small.gen!D
NOD32 - - probably unknown NewHeur_PE
Norman - - -
Panda - - Suspicious file
PCTools - - -
Prevx1 - - -
Rising - - Packer.RyCrypt
SecureWeb-Gateway - - Trojan.Crypt.XPACK.Gen
Sophos - - -
Sunbelt - - -
Symantec - - Trojan Horse
TheHacker - - -
TrendMicro - - Possible_DLDER
VBA32 - - suspected of MalwareScope.Trojan-PSW.Pinch.45 (paranoid heuristics)
ViRobot - - -
VirusBuster - - -

Information additionnelle
MD5: f46512e00751c531d69370c7593001f4
SHA1: dce1a85e753f04ad8cc39d7cc41d19683bccf60c
SHA256: 57a6aa6f2cd02ece47acc4ba416a0e1cbfb35a01f643213c8af3d1e2c5b370c1
SHA512: d3131b72ba8d3012c20112d30838fdf3b15dfa988bcdc973a21d74d5d4d6eca66558a2430a6a0993ca2b66a720797ae546f6c6139d8f4e5293f233bcb82f3a33

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 - - -
AntiVir - - TR/Crypt.XPACK.Gen
Authentium - - -
Avast - - -
AVG - - -
BitDefender - - DeepScan:Generic.Malware.SYd!dld.A34684A2
CAT-QuickHeal - - -
ClamAV - - -
DrWeb - - DLOADER.Trojan
eSafe - - -
eTrust-Vet - - -
Ewido - - -
F-Prot - - -
F-Secure - - Suspicious:W32/Malware!Gemini
Fortinet - - -
GData - - DeepScan:Generic.Malware.SYd!dld.A34684A2
Ikarus - - Trojan-Spy.Win32.Agent.DI
K7AntiVirus - - -
Kaspersky - - -
McAfee - - -
McAfee+Artemis - - -
Microsoft - - TrojanDownloader:Win32/Small.gen!D
NOD32 - - probably unknown NewHeur_PE
Norman - - -
Panda - - Suspicious file
PCTools - - -
Prevx1 - - -
Rising - - Packer.RyCrypt
SecureWeb-Gateway - - Trojan.Crypt.XPACK.Gen
Sophos - - -
Sunbelt - - -
Symantec - - Trojan Horse
TheHacker - - -
TrendMicro - - Possible_DLDER
VBA32 - - suspected of MalwareScope.Trojan-PSW.Pinch.45 (paranoid heuristics)
ViRobot - - -
VirusBuster - - -

Information additionnelle
MD5: f46512e00751c531d69370c7593001f4
SHA1: dce1a85e753f04ad8cc39d7cc41d19683bccf60c
SHA256: 57a6aa6f2cd02ece47acc4ba416a0e1cbfb35a01f643213c8af3d1e2c5b370c1
SHA512: d3131b72ba8d3012c20112d30838fdf3b15dfa988bcdc973a21d74d5d4d6eca66558a2430a6a0993ca2b66a720797ae546f6c6139d8f4e5293f233bcb82f3a33

et voilà le rapport de LSGPRN.exe que j'ai fait ré analyser aussi :

Fichier LSGPRN.EXE reçu le 2008.12.19 13:34:30 (CET)Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.12.19.3 2008.12.19 -
AntiVir 7.9.0.45 2008.12.19 TR/Crypt.XPACK.Gen
Authentium 5.1.0.4 2008.12.18 -
Avast 4.8.1281.0 2008.12.18 -
AVG 8.0.0.199 2008.12.19 Generic12.RMR
BitDefender 7.2 2008.12.19 DeepScan:Generic.Malware.SYd!dld.4BCEE042
CAT-QuickHeal 10.00 2008.12.19 -
ClamAV 0.94.1 2008.12.19 -
Comodo 781 2008.12.19 -
DrWeb 4.44.0.09170 2008.12.19 DLOADER.Trojan
eSafe 7.0.17.0 2008.12.18 -
eTrust-Vet 31.6.6268 2008.12.18 -
Ewido 4.0 2008.12.19 -
F-Prot 4.4.4.56 2008.12.18 -
F-Secure 8.0.14332.0 2008.12.19 Suspicious:W32/Malware!Gemini
Fortinet 3.117.0.0 2008.12.19 W32/Heuri.E
GData 19 2008.12.19 DeepScan:Generic.Malware.SYd!dld.4BCEE042
Ikarus T3.1.1.45.0 2008.12.19 Trojan-Spy.Win32.Agent.DI
K7AntiVirus 7.10.557 2008.12.18 -
Kaspersky 7.0.0.125 2008.12.19 Heur.Trojan.Generic
McAfee 5468 2008.12.18 Generic Downloader.x
McAfee+Artemis 5468 2008.12.18 Generic Downloader.x
Microsoft 1.4205 2008.12.19 TrojanDownloader:Win32/Small.gen!D
NOD32 3705 2008.12.19 probably unknown NewHeur_PE
Norman 5.80.02 2008.12.18 W32/Smalltroj.IWCM
Panda 9.0.0.4 2008.12.19 Generic Trojan
PCTools 4.4.2.0 2008.12.19 -
Prevx1 V2 2008.12.19 Malware Dropper
Rising 21.08.42.00 2008.12.19 -
SecureWeb-Gateway 6.7.6 2008.12.19 Trojan.Crypt.XPACK.Gen
Sophos 4.37.0 2008.12.19 Mal/Generic-A
Sunbelt 3.2.1801.2 2008.12.11 -
Symantec 10 2008.12.19 Trojan Horse
TheHacker 6.3.1.4.191 2008.12.17 -
TrendMicro 8.700.0.1004 2008.12.19 Possible_DLDER
ViRobot 2008.12.19.1527 2008.12.19 -
VirusBuster 4.5.11.0 2008.12.18 -

Information additionnelle
File size: 24576 bytes
MD5...: 3c61aa786400574e17b61e4576f8de4f
SHA1..: c45860b683c421b4cdc1c43989c5dc59cd7b1257
SHA256: 29f15c1c54a280d8255b2ed3aa155c1ebf0370b3958e0d9fd28542d5670cf738
SHA512: fc20a5af06823588e9915853035898c72ffb89328a8a2bb7380565e07e388e44<BR>2bbaef61116d0893dbbdc071eb9b24ee6216557b125e9b48d760e80b45e2b30b<BR>
ssdeep: 192:rL10X2v6cVZS+v643+dH0dHRdHwdHPH1SdHB18Givpu111e/WnT3fvBR:rFv<BR>Dv6G+qrmuJy0vBR<BR>
PEiD..: -
TrID..: File type identification<BR>Win32 Executable Generic (42.3%)<BR>Win32 Dynamic Link Library (generic) (37.6%)<BR>Generic Win/DOS Executable (9.9%)<BR>DOS Executable Generic (9.9%)<BR>VXD Driver (0.1%)
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x401000<BR>timedatestamp.....: 0x492e684c (Thu Nov 27 09:28:44 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 2 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x167a 0x1800 5.69 d4449c38c9b76a60a4297886a57cca3e<BR>.data 0x3000 0x47d8 0x4600 3.83 ce7a0754c93e7fc24c6457c0972f8072<BR><BR>( 4 imports ) <BR>&gt; kernel32.dll: Sleep, CreateMutexA, GetLastError, ExitProcess, CreateFileA, GetFileSize, GlobalAlloc, ReadFile, CloseHandle, GlobalFree, WriteFile, WinExec, GetSystemDirectoryA, GetWindowsDirectoryA, GetModuleFileNameA, OpenFile, FindFirstFileA, FindClose, FlushFileBuffers<BR>&gt; advapi32.dll: RegCreateKeyA, RegSetValueExA, RegCloseKey, RegOpenKeyExA, RegCreateKeyExA, RegQueryValueExA<BR>&gt; shell32.dll: ShellExecuteA, SHGetSpecialFolderPathA<BR>&gt; urlmon.dll: URLDownloadToFileA<BR><BR>( 0 exports ) <BR>
CWSandbox info: &lt;a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=3c61aa786400574e17b61e4576f8de4f' target='_blank'&gt;http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=3c61aa786400574e17b61e4576f8de4f&lt;/a&gt;
Prevx info: &lt;a href='http://info.prevx.com/aboutprogramtext.asp?PX5=96D4E45C0022D4A260F700AE7BC9AD002BEEA085' target='_blank'&gt;http://info.prevx.com/aboutprogramtext.asp?PX5=96D4E45C0022D4A260F700AE7BC9AD002BEEA085&lt;/a&gt;
packers (F-Prot): embedded

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.12.19.3 2008.12.19 -
AntiVir 7.9.0.45 2008.12.19 TR/Crypt.XPACK.Gen
Authentium 5.1.0.4 2008.12.18 -
Avast 4.8.1281.0 2008.12.18 -
AVG 8.0.0.199 2008.12.19 Generic12.RMR
BitDefender 7.2 2008.12.19 DeepScan:Generic.Malware.SYd!dld.4BCEE042
CAT-QuickHeal 10.00 2008.12.19 -
ClamAV 0.94.1 2008.12.19 -
Comodo 781 2008.12.19 -
DrWeb 4.44.0.09170 2008.12.19 DLOADER.Trojan
eSafe 7.0.17.0 2008.12.18 -
eTrust-Vet 31.6.6268 2008.12.18 -
Ewido 4.0 2008.12.19 -
F-Prot 4.4.4.56 2008.12.18 -
F-Secure 8.0.14332.0 2008.12.19 Suspicious:W32/Malware!Gemini
Fortinet 3.117.0.0 2008.12.19 W32/Heuri.E
GData 19 2008.12.19 DeepScan:Generic.Malware.SYd!dld.4BCEE042
Ikarus T3.1.1.45.0 2008.12.19 Trojan-Spy.Win32.Agent.DI
K7AntiVirus 7.10.557 2008.12.18 -
Kaspersky 7.0.0.125 2008.12.19 Heur.Trojan.Generic
McAfee 5468 2008.12.18 Generic Downloader.x
McAfee+Artemis 5468 2008.12.18 Generic Downloader.x
Microsoft 1.4205 2008.12.19 TrojanDownloader:Win32/Small.gen!D
NOD32 3705 2008.12.19 probably unknown NewHeur_PE
Norman 5.80.02 2008.12.18 W32/Smalltroj.IWCM
Panda 9.0.0.4 2008.12.19 Generic Trojan
PCTools 4.4.2.0 2008.12.19 -
Prevx1 V2 2008.12.19 Malware Dropper
Rising 21.08.42.00 2008.12.19 -
SecureWeb-Gateway 6.7.6 2008.12.19 Trojan.Crypt.XPACK.Gen
Sophos 4.37.0 2008.12.19 Mal/Generic-A
Sunbelt 3.2.1801.2 2008.12.11 -
Symantec 10 2008.12.19 Trojan Horse
TheHacker 6.3.1.4.191 2008.12.17 -
TrendMicro 8.700.0.1004 2008.12.19 Possible_DLDER
ViRobot 2008.12.19.1527 2008.12.19 -
VirusBuster 4.5.11.0 2008.12.18 -

Information additionnelle
File size: 24576 bytes
MD5...: 3c61aa786400574e17b61e4576f8de4f
SHA1..: c45860b683c421b4cdc1c43989c5dc59cd7b1257
SHA256: 29f15c1c54a280d8255b2ed3aa155c1ebf0370b3958e0d9fd28542d5670cf738
SHA512: fc20a5af06823588e9915853035898c72ffb89328a8a2bb7380565e07e388e44<BR>2bbaef61116d0893dbbdc071eb9b24ee6216557b125e9b48d760e80b45e2b30b<BR>
ssdeep: 192:rL10X2v6cVZS+v643+dH0dHRdHwdHPH1SdHB18Givpu111e/WnT3fvBR:rFv<BR>Dv6G+qrmuJy0vBR<BR>
PEiD..: -
TrID..: File type identification<BR>Win32 Executable Generic (42.3%)<BR>Win32 Dynamic Link Library (generic) (37.6%)<BR>Generic Win/DOS Executable (9.9%)<BR>DOS Executable Generic (9.9%)<BR>VXD Driver (0.1%)
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x401000<BR>timedatestamp.....: 0x492e684c (Thu Nov 27 09:28:44 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 2 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x167a 0x1800 5.69 d4449c38c9b76a60a4297886a57cca3e<BR>.data 0x3000 0x47d8 0x4600 3.83 ce7a0754c93e7fc24c6457c0972f8072<BR><BR>( 4 imports ) <BR>&gt; kernel32.dll: Sleep, CreateMutexA, GetLastError, ExitProcess, CreateFileA, GetFileSize, GlobalAlloc, ReadFile, CloseHandle, GlobalFree, WriteFile, WinExec, GetSystemDirectoryA, GetWindowsDirectoryA, GetModuleFileNameA, OpenFile, FindFirstFileA, FindClose, FlushFileBuffers<BR>&gt; advapi32.dll: RegCreateKeyA, RegSetValueExA, RegCloseKey, RegOpenKeyExA, RegCreateKeyExA, RegQueryValueExA<BR>&gt; shell32.dll: ShellExecuteA, SHGetSpecialFolderPathA<BR>&gt; urlmon.dll: URLDownloadToFileA<BR><BR>( 0 exports ) <BR>
CWSandbox info: &lt;a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=3c61aa786400574e17b61e4576f8de4f' target='_blank'&gt;http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=3c61aa786400574e17b61e4576f8de4f&lt;/a&gt;
Prevx info: &lt;a href='http://info.prevx.com/aboutprogramtext.asp?PX5=96D4E45C0022D4A260F700AE7BC9AD002BEEA085' target='_blank'&gt;http://info.prevx.com/aboutprogramtext.asp?PX5=96D4E45C0022D4A260F700AE7BC9AD002BEEA085&lt;/a&gt;
packers (F-Prot): embedded

voici le rapport combo fix

ComboFix 08-12-13.03 - niko 2008-12-21 21:41:39.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2559.2128 [GMT 1:00]
Lancé depuis: c:\documents and settings\niko\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\niko\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé

FILE ::
c:\windows\NV17002656.TMP
c:\windows\system32\LSGPRN.EXE
c:\windows\system32\LSHPRN.EXE
c:\windows\system32\upd42.exe
c:\windows\system32\upd46.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\sc32.dll
c:\windows\system32\43upd.dll
c:\windows\system32\44upd.dll
c:\windows\system32\45upd.dll
c:\windows\system32\46upd.dll
c:\windows\system32\LSGPRN.EXE
c:\windows\system32\LSHPRN.EXE
c:\windows\system32\upd42.exe
c:\windows\system32\upd46.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-21 au 2008-12-21 ))))))))))))))))))))))))))))))))))))
.

2008-12-15 23:04 . 2008-12-15 23:04 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-15 13:08 . 2008-12-21 21:40 364 --a------ c:\windows\iexplore.htm
2008-12-10 23:48 . 2008-12-10 23:48 <REP> d-------- C:\rsit
2008-12-10 23:39 . 2008-12-10 23:39 <REP> d-------- C:\_OTMoveIt
2008-12-09 23:22 . 2008-12-09 23:25 250 --a------ c:\windows\gmer.ini
2008-12-09 23:15 . 2008-12-09 23:17 <REP> d-------- C:\ToolBar SD
2008-12-09 22:07 . 2008-12-10 23:35 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-09 20:23 . 2008-12-10 23:35 <REP> d-------- c:\program files\a-squared Free
2008-12-09 20:03 . 2008-12-09 20:03 <REP> d-------- c:\program files\Trend Micro
2008-12-09 18:46 . 2008-12-09 18:46 <REP> d-------- c:\program files\Lavasoft
2008-11-27 21:53 . 2008-11-27 21:58 <REP> d-------- c:\windows\NV17002656.TMP
2008-11-26 20:42 . 2008-11-26 20:42 <REP> dr-h----- c:\documents and settings\niko\Application Data\SecuROM
2008-11-26 20:16 . 2008-11-26 20:16 <REP> d-------- c:\windows\Logs
2008-11-26 20:16 . 2008-11-26 20:16 22,328 --a------ c:\documents and settings\niko\Application Data\PnkBstrK.sys
2008-11-26 20:12 . 2008-11-26 20:12 <REP> d-------- c:\program files\Ubisoft
2008-11-25 10:23 . 2008-12-15 13:03 <REP> d-------- c:\program files\Pense-bete
2008-11-25 10:23 . 2008-12-15 13:03 <REP> d-------- c:\documents and settings\niko\Application Data\Pense-bete
2008-11-23 22:12 . 2008-11-23 22:12 319 --a------ c:\windows\game.ini
2008-11-23 22:07 . 2008-11-23 22:07 <REP> d-------- c:\program files\Activision
2008-11-23 21:53 . 2008-11-23 21:53 <REP> d--hs---- c:\windows\ftpcache

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-21 20:25 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-12-15 22:04 --------- d-----w c:\program files\Java
2008-12-15 12:04 --------- d-----w c:\program files\Steinberg
2008-12-12 22:28 --------- d-----w c:\program files\eMule
2008-12-12 22:27 --------- d-----w c:\documents and settings\niko\Application Data\Azureus
2008-12-10 10:13 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-09 17:46 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-09 17:45 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-12-09 10:58 --------- d-----w c:\program files\Windows Live Safety Center
2008-11-27 23:06 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-11-27 20:47 355,584 ----a-w c:\windows\system32\TuneUpDefragService.exe
2008-11-27 20:47 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-11-27 06:49 109,249 ----a-w c:\program files\MSWINSCK.OCX
2008-11-26 19:17 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-11-26 19:12 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-26 12:27 --------- d-----w c:\program files\Azureus
2008-11-11 15:55 --------- d-----w c:\program files\VOB
2008-11-06 19:59 --------- d-----w c:\documents and settings\niko\Application Data\TuneUp Software
2008-11-06 19:59 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-11-06 15:06 --------- d-----w c:\documents and settings\All Users\Application Data\Azureus
2008-10-24 11:21 455,296 ------w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 10:32 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:18 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
.

((((((((((((((((((((((((((((( snapshot@2008-12-14_14.49.42.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-17 00:48:40 3,593,216 -c----w c:\windows\ie7updates\KB960714-IE7\mshtml.dll
+ 2007-03-06 01:34:38 216,800 -c----w c:\windows\ie7updates\KB960714-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:35:47 394,976 -c----w c:\windows\ie7updates\KB960714-IE7\spuninst\updspapi.dll
+ 2008-04-14 02:33:26 81,920 -c--a-w c:\windows\system32\dllcache\ils.dll
- 2008-10-17 00:48:40 3,593,216 -c----w c:\windows\system32\dllcache\mshtml.dll
+ 2008-12-13 06:37:56 3,593,216 -c----w c:\windows\system32\dllcache\mshtml.dll
- 2008-06-09 23:21:01 135,168 ----a-w c:\windows\system32\java.exe
+ 2008-12-15 22:04:12 144,792 ----a-w c:\windows\system32\java.exe
- 2008-06-09 23:21:04 135,168 ----a-w c:\windows\system32\javaw.exe
+ 2008-12-15 22:04:12 144,792 ----a-w c:\windows\system32\javaw.exe
- 2008-06-10 00:32:34 139,264 ----a-w c:\windows\system32\javaws.exe
+ 2008-12-15 22:04:12 148,888 ----a-w c:\windows\system32\javaws.exe
- 2008-10-17 00:48:40 3,593,216 ----a-w c:\windows\system32\mshtml.dll
+ 2008-12-13 06:37:56 3,593,216 ----a-w c:\windows\system32\mshtml.dll
+ 2008-12-21 20:12:12 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_584.dat
- 2008-12-14 13:48:10 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5cc.dat
+ 2008-12-21 20:12:00 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5cc.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-22 68856]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-02-23 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-15 136600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=c:\windows\pss\Outil de mise à jour Google.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^niko^Menu Démarrer^Programmes^Démarrage^GIGABYTE VGA Utility.lnk]
path=c:\documents and settings\niko\Menu Démarrer\Programmes\Démarrage\GIGABYTE VGA Utility.lnk
backup=c:\windows\pss\GIGABYTE VGA Utility.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-10-15 01:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-09-03 19:12 111936 c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AsusStartupHelp]
-ra--c--- 2006-11-14 07:25 363008 c:\program files\ASUS\AASP\1.00.16\AsRunHelp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a--c--- 2004-09-02 22:57 57344 c:\program files\SlySoft\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
--a--c--- 2003-06-18 01:00 45056 c:\program files\Creative\SBAudigy2\DVDAudio\CTDVDDET.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
--a--c--- 2003-09-17 10:43 57344 c:\program files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a--c--- 2004-08-22 16:05 81920 c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a--c--- 2005-08-11 09:30 249856 c:\program files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a--c--- 2005-08-11 09:30 81920 c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
c:\program files\Messenger\msmsgs.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBDrvDet]
--a--c--- 2002-12-03 18:06 45056 c:\program files\Creative\SB Drive Det\SBDrvDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
-----c--- 2006-07-13 07:12 729088 c:\program files\Analog Devices\SoundMAX\SMax4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
-ra--c--- 2006-12-18 14:34 868352 c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-01-22 10:41 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-23 13:45 185896 c:\program files\Fichiers communs\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
-----c--- 2000-05-11 01:00 90112 c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a--c--- 2008-08-04 00:02 36352 c:\program files\Winamp\winampa.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
"PrinterSecurityLayer"=c:\windows\system32\LSHPRN.EXE
"nwiz"=nwiz.exe /install
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"CTHelper"=CTHELPER.EXE
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Fichiers communs\\NewTech Infosystems\\LiveUpdate\\LiveUpdate.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=

R1 Asapi;Asapi;c:\windows\system32\drivers\Asapi.sys [2008-11-11 11264]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-06-26 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-06-26 20560]
S2 FAH@C:+DOCUME~1+niko+LOCALS~1+Temp+IXP000.TMP+s.exe;FAH@C:+DOCUME~1+niko+LOCALS~1+Temp+IXP000.TMP+s.exe;c:\docume~1\niko\LOCALS~1\Temp\IXP000.TMP\s.exe -svcstart []
S3 NikeDrv;Pilote nike psa[play;c:\windows\system32\Drivers\NikeDrv.sys [2001-08-17 22:24:44 12032]
S3 SaiHFF0D;SaiHFF0D;c:\windows\system32\DRIVERS\SaiHFF0D.sys [2008-08-24 176000]
S3 SaiUFF0D;SaiUFF0D;c:\windows\system32\DRIVERS\SaiUFF0D.sys [2008-08-24 27136]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2008-12-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-05 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-06-20 09:23]
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
HKLM-Run-PrinterSecurityLayer - c:\windows\system32\LSHPRN.EXE


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

c:\windows\Downloaded Program Files\InstallerControl.dll - O16 -: CabBuilder
hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
c:\windows\Downloaded Program Files\OSDED4D.OSD
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-21 21:42:38
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
"ServiceDll"="c:\windows\system32\es.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\FAH@C:+DOCUME~1+niko+LOCALS~1+Temp+IXP000.TMP+s.exe]
.
Heure de fin: 2008-12-21 21:43:17
ComboFix-quarantined-files.txt 2008-12-21 20:42:59
ComboFix2.txt 2008-12-14 13:50:04

Avant-CF: 443 100 106 752 octets libres
Après-CF: 443,104,935,936 octets libres

249 --- E O F --- 2008-12-19 12:38:40

depuis la dernière manip , plus de soucis semble t il !!!
serait ce la victoire ?
si c'est le cas, un grand grand merci !!!!