Comment supprimer "csrssc.exe" ?

Bonjour,

Depuis quelques temps, Kaspersky me lance souvent des alertes à propos d'un certain csrssc.exe, alors je demande à le supprimer, mais rien n'y fait, à chaque démarrage il revient, j'ai essayé de faire un scan total avec Kaspersky, il n'a rien détecté d'autre, un autre scan avec Spybot, ca n'a pas résolu le problème.

De plus, l'Option des Dossiers a disparue.

Je vous met mon rapport HijackThis v2.0.2

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:17:38, on 03/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winlogin.exe
C:\program files\steam\steam.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\csrssc.exe
C:\FRAPS\FRAPS.EXE
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\csrssc.exe
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} - http://messenger.zone.msn.com/FR-F [...] E_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/bina [...] b56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - http://messenger.zone.msn.com/bina [...] b56986.cab
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FAH@C:+DOCUME~1+UTILIS~1+LOCALS~1+Temp+Rar$EX06.891+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe - Unknown owner - C:\WINDOWS\
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 7626 bytes

Merci d'avance pour votre aide, et bonne année

Merci pour la rapide réponse

Voici le rapport :

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1602
Windows 5.1.2600 Service Pack 3

03/01/2009 23:00:50
mbam-log-2009-01-03 (23-00-50).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 203070
Temps écoulé: 2 hour(s), 55 minute(s), 8 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{2D23BE0A-4202-4A2F-B0EE-5707D21BE0B5}\RP420\A0117491.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\utilisateur\results.txt (Malware.Trace) -> Quarantined and deleted successfully.

L'option des dossiers est revenue, je peux accéder à RegEdit, alors que je ne pouvais pas avant.
Maintenant, je sais pas si je peux éteindre, et rallumer mon PC, parce que si le processus revient à chaque fois :s

Le voici :


ComboFix 09-01-02.01 - utilisateur 2009-01-04 19:10:38.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.2047.1273 [GMT 1:00]
Lancé depuis: c:\documents and settings\utilisateur\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Il y a peut-être des sites infectés -----

hxxp://youtouch.no-ip.biz
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-04 au 2009-01-04 ))))))))))))))))))))))))))))))))))))
.

2009-01-04 08:54 . 2009-01-04 08:57 <REP> d-------- c:\windows\LastGood
2009-01-04 08:54 . 2009-01-04 08:56 <REP> d-------- C:\2641d98a8aa3fb071b60f95d0f0506
2009-01-03 19:51 . 2009-01-03 19:51 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Malwarebytes
2009-01-03 19:51 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-03 19:50 . 2009-01-03 19:51 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-03 19:50 . 2009-01-03 19:50 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-03 19:50 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-03 15:38 . 2009-01-03 15:38 <REP> d-------- c:\program files\ESET
2009-01-03 15:38 . 2009-01-03 15:38 <REP> d-------- c:\documents and settings\All Users\Application Data\ESET
2009-01-03 09:56 . 2009-01-04 14:41 <REP> d-------- c:\documents and settings\utilisateur\.gimp-2.6
2009-01-03 09:56 . 2009-01-03 09:56 <REP> d-------- c:\documents and settings\utilisateur\.gegl-0.0
2009-01-03 07:57 . 2009-01-03 07:57 <REP> d-------- c:\program files\Trend Micro
2009-01-03 07:52 . 2009-01-03 07:52 <REP> d-------- C:\_OTMoveIt
2009-01-02 22:06 . 2009-01-02 22:06 <REP> d-------- c:\program files\Enigma Software Group
2009-01-02 19:38 . 2009-01-02 19:38 116 --a------ c:\windows\wininit.ini
2009-01-02 17:51 . 2009-01-02 17:51 <REP> d-------- c:\program files\CodeStuff
2009-01-01 23:42 . 2009-01-01 23:42 <REP> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-01-01 23:12 . 2009-01-01 23:12 511,154 --a------ c:\windows\system32\perfh040.dat
2009-01-01 23:12 . 2009-01-01 23:12 85,058 --a------ c:\windows\system32\perfc040.dat
2009-01-01 23:11 . 2009-01-01 23:11 <REP> d-------- c:\program files\Uniblue
2009-01-01 23:11 . 2009-01-01 23:45 <REP> d--h-c--- c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-01-01 17:49 . 2009-01-02 21:36 <REP> d-------- c:\program files\Spybot - Search & Destroy
2009-01-01 17:49 . 2009-01-04 09:42 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-30 23:50 . 2008-12-30 23:50 22,017 --a------ c:\documents and settings\utilisateur\4154736256.exe
2008-12-30 22:10 . 2008-12-30 22:12 22,017 --a------ c:\documents and settings\utilisateur\4290684650.exe
2008-12-29 13:49 . 2008-12-30 09:24 <REP> d-------- c:\windows\SxsCaPendDel
2008-12-29 13:49 . 2008-12-29 13:50 <REP> d-------- C:\3a3c4695df465a9f110634
2008-12-29 13:41 . 2008-12-29 13:41 <REP> d----c--- c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2008-12-29 13:35 . 2008-12-29 13:35 <REP> dr-h----- C:\AHCache
2008-12-29 09:52 . 2008-12-29 14:31 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Uniblue
2008-12-29 09:29 . 2008-12-29 09:29 <REP> d-------- c:\documents and settings\utilisateur\Application Data\InstallShield
2008-12-28 18:39 . 2009-01-03 14:48 <REP> d-------- c:\documents and settings\utilisateur\Application Data\New Technology Studio
2008-12-28 16:54 . 2008-12-28 16:54 <REP> d--h-c--- c:\documents and settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2008-12-28 16:45 . 2008-12-28 16:45 <REP> d-------- C:\ProgramData
2008-12-28 16:45 . 2008-12-28 16:45 4,738 --a------ c:\windows\system32\ealregsnapshot1.reg
2008-12-26 22:04 . 2008-12-26 22:10 2,715,848 --a------ c:\windows\system32\idman514.exe
2008-12-26 18:27 . 2007-11-14 15:18 553 --a------ c:\windows\USetup.iss
2008-12-26 18:26 . 2007-11-20 18:15 1,826,816 --a------ c:\windows\SkyTel.exe
2008-12-26 18:26 . 2008-08-05 20:10 1,684,736 --a------ c:\windows\system32\drivers\Ambfilt.sys
2008-12-26 18:26 . 2006-01-04 15:41 1,389,056 --a------ c:\windows\system32\drivers\Monfilt.sys
2008-12-26 18:26 . 2008-10-01 14:29 290,816 --a------ c:\windows\vncutil.exe
2008-12-26 18:26 . 2008-06-24 14:46 104,992 --a------ c:\windows\RtkAudioService.exe
2008-12-26 18:26 . 2008-11-20 16:51 34,816 --a------ c:\windows\system32\RtkCoInstXP.dll
2008-12-25 19:13 . 2009-01-02 23:12 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Samsung
2008-12-25 19:05 . 2008-12-25 19:05 <REP> d-------- c:\windows\system32\Samsung_USB_Drivers
2008-12-25 19:05 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll
2008-12-25 19:05 . 2005-08-30 01:49 94,000 --a------ c:\windows\system32\drivers\ssm_mdm.sys
2008-12-25 19:05 . 2005-08-30 01:47 58,320 --a------ c:\windows\system32\drivers\ssm_bus.sys
2008-12-25 19:05 . 2005-08-30 01:49 8,336 --a------ c:\windows\system32\drivers\ssm_mdfl.sys
2008-12-25 19:05 . 2005-08-30 01:49 6,176 --a------ c:\windows\system32\drivers\ssm_cmnt.sys
2008-12-25 19:05 . 2005-08-30 01:49 6,176 --a------ c:\windows\system32\drivers\ssm_cm.sys
2008-12-25 19:05 . 2005-08-30 01:47 5,840 --a------ c:\windows\system32\drivers\ssm_whnt.sys
2008-12-25 19:05 . 2005-08-30 01:47 5,840 --a------ c:\windows\system32\drivers\ssm_wh.sys
2008-12-25 19:05 . 2006-07-24 16:05 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys
2008-12-25 19:05 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico
2008-12-24 10:28 . 2008-12-24 10:28 <REP> d--h----- c:\windows\PIF
2008-12-18 14:49 . 2008-12-18 15:08 23 --a------ c:\windows\popcinfot.dat
2008-12-13 12:24 . 2008-12-13 12:24 <REP> d-------- c:\program files\Lavalys
2008-12-13 12:21 . 2008-12-13 12:21 <REP> d-------- c:\program files\SiSoftware
2008-12-11 21:37 . 2008-12-11 21:37 42,320 --a------ c:\windows\system32\xfcodec.dll
2008-12-11 21:22 . 2008-12-11 21:22 <REP> d-------- c:\program files\Microsoft Silverlight
2008-12-07 14:34 . 2008-12-29 09:46 <REP> d-------- c:\program files\MagicTune Premium
2008-12-07 08:59 . 2009-01-03 23:02 205,986 --a------ c:\windows\system32\nvapps.xml
2008-12-07 08:58 . 2008-12-07 08:58 <REP> d-------- c:\windows\nview
2008-12-07 08:58 . 2008-12-02 10:13 453,152 --a------ c:\windows\system32\NVUNINST.EXE
2008-12-07 08:58 . 2008-12-02 23:11 453,152 --a------ c:\windows\system32\nvudisp.exe
2008-12-07 08:58 . 2008-12-02 23:11 18,696 --a------ c:\windows\system32\nvdisp.nvu

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-04 18:06 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-04 14:46 --------- d-----w c:\documents and settings\utilisateur\Application Data\mIRC
2009-01-04 10:05 --------- d-----w c:\program files\mIRC
2009-01-03 22:46 --------- d-----w c:\documents and settings\utilisateur\Application Data\Xfire
2009-01-03 22:03 --------- d-----w c:\program files\Steam
2009-01-03 18:30 --------- d-----w c:\documents and settings\utilisateur\Application Data\gtk-2.0
2009-01-03 14:33 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-01-03 08:56 --------- d-----w c:\program files\GIMP-2.0
2009-01-03 08:29 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-03 08:22 --------- d-----w c:\program files\Fichiers communs\BioWare
2009-01-02 22:29 --------- d-----w c:\program files\OpenOffice.org 2.3
2009-01-02 22:18 --------- d-----w c:\program files\EA GAMES
2009-01-02 22:07 --------- d-----w c:\program files\Microsoft Games
2009-01-02 22:06 --------- d-----w c:\program files\MTA San Andreas
2009-01-02 17:43 --------- d-----w c:\documents and settings\utilisateur\Application Data\uTorrent
2008-12-30 22:50 --------- d-----w c:\documents and settings\utilisateur\Application Data\DMCache
2008-12-28 15:46 --------- d-----w c:\program files\Electronic Arts
2008-12-26 17:26 --------- d-----w c:\program files\Realtek
2008-12-23 22:10 --------- d-----w c:\program files\Postal2STP
2008-12-17 13:56 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-12-17 11:20 --------- d-----w c:\program files\Xfire
2008-12-11 16:24 4,959,232 ----a-w c:\windows\system32\drivers\RtkHDAud.sys
2008-12-09 13:23 18,063,872 ----a-w c:\windows\RTHDCPL.EXE
2008-12-06 18:12 --------- d-----w c:\program files\Rockstar Games
2008-12-06 08:15 --------- d-----w c:\program files\Java
2008-12-05 23:02 --------- d-----w c:\program files\SystemRequirementsLab
2008-12-05 23:02 --------- d-----w c:\documents and settings\utilisateur\Application Data\SystemRequirementsLab
2008-12-03 17:16 --------- d-----w c:\program files\Microsoft Games for Windows - LIVE
2008-11-28 20:59 --------- d-----w c:\documents and settings\utilisateur\Application Data\FileZilla
2008-11-22 07:21 --------- d-----w c:\program files\AlienGUIse
2008-11-22 07:19 2,560 ----a-w c:\windows\_MSRSTRT.EXE
2008-11-16 14:28 --------- d-----w c:\documents and settings\utilisateur\Application Data\Apple Computer
2008-11-11 08:38 --------- d-----w c:\program files\Bethesda Softworks
2008-11-10 04:43 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-11-07 22:19 --------- d-----w c:\program files\Fichiers communs\Futuremark Shared
2008-10-29 06:14 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-10-29 06:14 22,328 ----a-w c:\documents and settings\utilisateur\Application Data\PnkBstrK.sys
2008-10-29 06:14 2,250,024 ----a-w c:\windows\system32\pbsvc.exe
2008-10-29 06:14 107,832 ----a-w c:\windows\system32\PnkBstrB.exe
2008-10-28 16:41 14,303,392 ----a-w c:\windows\system32\xlive.dll
2008-10-28 16:41 13,643,936 ----a-w c:\windows\system32\xlivefnt.dll
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:18 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-05-07 20:25 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008050720080508\index.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Fraps"="c:\fraps\FRAPS.EXE" [2008-01-14 3182248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-06-29 352256]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2004-12-10 139264]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-02 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-02 86016]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 c:\windows\KHALMNPR.Exe]
"nwiz"="nwiz.exe" [2008-12-02 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
Xfire.lnk - c:\program files\Xfire\xfire.exe [2008-12-11 2990416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
"VIDC.ACDV"= ACDV.dll
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^ASUS WiFi-AP Solo.lnk]
backup=c:\windows\pss\ASUS WiFi-AP Solo.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^GammaTray.lnk]
backup=c:\windows\pss\GammaTray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech SetPoint.lnk]
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^NCProTray.lnk]
backup=c:\windows\pss\NCProTray.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CacheBoost
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 03:06 40048 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ai Quicker Help]
--a------ 2006-07-19 08:52 3167744 c:\program files\ASUS\ASUS DH Remote\AsRc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
--a------ 2008-07-22 12:34 2772992 c:\program files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2004-05-12 15:18 241664 c:\program files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-06-25 11:24 49152 c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2003-10-31 18:42 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-10-08 11:31 1410296 c:\program files\Steam\steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Xfire\\xfire.exe"=
"c:\\Program Files\\Steam\\SteamApps\\gunzenr\\counter-strike source\\hl2.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Steam\\SteamApps\\gunzenr\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\Steam\\SteamApps\\gunzenr\\day of defeat source\\hl2.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\gunzenr\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\Steam\\SteamApps\\gunzenr\\insurgency\\hl2.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield Vietnam\\bfvietnam.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Unreal Tournament 3 Demo\\Binaries\\UT3Demo.exe"=
"c:\\Documents and Settings\\utilisateur\\Local Settings\\Application Data\\Dyyno Receiver\\DPPM.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Program Files\\Steam\\SteamApps\\gunzenr\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-07-01 34312]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [2007-10-18 176128]
R4 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-07-01 468224]
S3 Asushwio;Asushwio;c:\windows\system32\drivers\ASUSHWIO.SYS [2007-10-18 5824]
S3 o1394bul;o1394bul;\??\c:\docume~1\UTILIS~1\LOCALS~1\Temp\o1394bul.sys --> c:\docume~1\UTILIS~1\LOCALS~1\Temp\o1394bul.sys [?]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2007-10-18 13532]
S4 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2007-10-18 26488]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1440fd95-6e94-11dd-a7f7-0015af09fb08}]
\Shell\AutoRun\command - J:\ReadMe.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4c4ff199-18f5-11dd-8e2d-0015af09fb08}]
\Shell\AutoRun\command - I:\setupSNK.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-NWEReboot - (no file)
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\qttask.exe


.
------- Examen supplémentaire -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\1gbcs897.default\
FF - prefs.js: browser.startup.homepage - hxxp://orange.fr
FF - plugin: c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\1gbcs897.default\extensions\NPDyyno@dyyno.com\plugins\npDyyno.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-04 19:11:34
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
"ServiceDll"="c:\windows\system32\es.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\FAH@C:+DOCUME~1+UTILIS~1+LOCALS~1+Temp+Rar$EX06.891+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe]
"ImagePath"="c:\docume~1\UTILIS~1\LOCALS~1\Temp\Rar$EX06.891\
[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING\FAH.exe -svcstart"


[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\FAH@C:+DOCUME~1+UTILIS~1+LOCALS~1+Temp+Rar$EX06.891+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe]
"ImagePath"="c:\docume~1\UTILIS~1\LOCALS~1\Temp\Rar$EX06.891\
.
Heure de fin: 2009-01-04 19:12:15
ComboFix-quarantined-files.txt 2009-01-04 18:12:01

Avant-CF: 133 188 308 992 octets libres
Après-CF: 133,183,012,864 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

281 --- E O F --- 2008-12-18 19:19:19


Merci encore pour l'aide