[Résolu] Programme au démarage

Bonjour,

Télécharge UsbFix (de C_XX & Chiquitine29) sur ton Bureau.

Lance l'installation avec les paramètres par défaut.

Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

Double-clique sur le raccourci UsbFix sur ton Bureau.

Choisis l'option 1 (Recherche).

Laisse travailler l'outil.

Poste le rapport UsbFix.txt.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

"Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.

############################## [ UsbFix V3.031 ]

# User : Administrateur (Administrateurs) # URANIUMOFCOURSE
# Update on 13/06/09 by Chiquitine29
# Start at: 11:24:25 | 14/06/2009
# Website : http://pagesperso-orange.fr/NosTools/usbfix.html

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Disabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 74,52 Go (3,87 Go free) # NTFS
# D:\ # Disque CD-ROM # 529,4 Mo (0 Mo free) [ZT2ZCD1] # CDFS
# E:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\EXPERTool ATI\TBPanel.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\srksrv.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Registre Startup ]

HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iese..."
HKCU_Main: "Start Page"="http://www.google.com/"
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Administrateur"
HKLM_logon: "AltDefaultUserName"="Administrateur"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: SoundMAXPnP=C:\Program Files\Analog Devices\Core\smax4pnp.exe
HKLM_Run: WinampAgent="C:\Program Files\Winamp\winampa.exe"
HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM_Run: StartCCC="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
HKLM_Run: iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
HKLM_Run: ArcSoft Connection Service=C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
HKLM_Run: avgnt="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM_Run: LFAgent=
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
HKCU_Run: MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
HKCU_Run: Skype="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
HKCU_Run: RGSC=C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
HKCU_Run: Gainward=C:\Program Files\EXPERTool ATI\TBPanel.exe /A
HKCU_Run: AlcoholAutomount="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
HKCU_Run: Steam="C:\Program Files\Valve\Steam\Steam.exe" -silent
HKCU_Run: cdoosoft=C:\WINDOWS\system32\olhrwef.exe

################## [ Fichiers # Dossiers infectieux ]

Présent ! C:\WINDOWS\system32\nmdfgds0.dll
Présent ! C:\WINDOWS\system32\nmdfgds1.dll
C:\autorun.inf # -> fichier appelé : "C:\q9.cmd" ( Absent ! )
Présent ! C:\autorun.inf
Présent ! D:\install.exe
Présent ! D:\autorun.inf

################## [ Registre # Clés Run infectieuses ]

Présent ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"
Présent ! HKU\S-1-5-21-1454471165-287218729-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"
Présent ! HKLM\software\microsoft\security center "AntiVirusOverride" ( 0x1 )
Présent ! HKLM\software\microsoft\security center "FirewallOverride" ( 0x1 )
Présent ! HKLM\software\microsoft\security center "UpdatesDisableNotify" ( 0x1 )

################## [ Registre # Mountpoints2 ]

HKCU\...\Explorer\MountPoints2\{6f129482-d210-11dd-bb51-806d6172696f}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{75494675-dc14-11dd-bb5a-001bfc775f59}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{ae85bee5-9ecf-11dd-a0a8-001bfc775f59}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{ae85bee6-9ecf-11dd-a0a8-001bfc775f59}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{d8f0939e-995f-11dd-92b1-001bfc775f59}\Shell\AutoRun\Command

################## [ ! Fin du rapport # UsbFix V3.031 ! ]

voila

Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

Double-clique sur le raccourci UsbFix présent sur ton Bureau pour le lancer.

Choisis l'option 2 (Suppression).

Ton Bureau disparaîtra et le PC redémarrera.

Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.

Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

Voici le rapport




############################## [ UsbFix V3.031 ]

# User : Administrateur (Administrateurs) # URANIUMOFCOURSE
# Update on 13/06/09 by Chiquitine29
# Start at: 13:40:14 | 14/06/2009
# Website : http://pagesperso-orange.fr/NosTools/usbfix.html

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Disabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 74,52 Go (3,89 Go free) # NTFS
# D:\ # Disque CD-ROM # 529,4 Mo (0 Mo free) [ZT2ZCD1] # CDFS
# E:\ # Disque CD-ROM
# F:\ # Disque fixe local # 124 Mo (37,54 Mo free) [FLASHDISK] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\srksrv.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Fichiers # Dossiers infectieux ]

Supprimé ! C:\WINDOWS\system32\nmdfgds0.dll
Supprimé ! C:\WINDOWS\system32\nmdfgds1.dll
C:\autorun.inf # -> fichier appelé : "C:\q9.cmd" ( absent ! )
Supprimé ! C:\autorun.inf
(!) Non supprimé ! D:\install.exe
(!) Non supprimé ! D:\autorun.inf
Supprimé ! F:\Recycled\ctfmon.exe
Supprimé ! F:\autorun.inf

################## [ Registre # Clés Run infectieuses ]

Supprimé ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"
# HKLM\software\microsoft\security center "AntiVirusOverride" # -> Reset sucessfully !
# HKLM\software\microsoft\security center "FirewallOverride" # -> Reset sucessfully !
# HKLM\software\microsoft\security center "UpdatesDisableNotify" # -> Reset sucessfully !

################## [ Registre # Mountpoints2 ]

Supprimé ! HKCU\...\Explorer\MountPoints2\{6f129482-d210-11dd-bb51-806d6172696f}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{75494675-dc14-11dd-bb5a-001bfc775f59}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{ae85bee5-9ecf-11dd-a0a8-001bfc775f59}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{ae85bee6-9ecf-11dd-a0a8-001bfc775f59}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{d8f0939e-995f-11dd-92b1-001bfc775f59}\Shell\AutoRun\Command

################## [ Listing des fichiers présent ]

[30/09/2008 18:57|--a------|0] - C:\AUTOEXEC.BAT
[21/01/2009 07:38|-rahs----|282] - C:\boot.ini
[24/08/2001 19:00|-rahs----|4952] - C:\Bootfont.bin
[30/09/2008 18:57|--a------|0] - C:\CONFIG.SYS
[30/09/2008 18:57|-rahs----|0] - C:\IO.SYS
[24/05/2009 03:16|--a------|5996453] - C:\log_fs.log
[30/09/2008 18:57|-rahs----|0] - C:\MSDOS.SYS
[04/08/2004 03:38|-rahs----|47564] - C:\NTDETECT.COM
[26/12/2008 11:11|-rahs----|252240] - C:\ntldr
[?|?|?] - C:\pagefile.sys
[31/05/2009 10:48|--ah-----|268] - C:\sqmdata00.sqm
[02/06/2009 21:58|--ah-----|268] - C:\sqmdata01.sqm
[31/05/2009 10:48|--ah-----|244] - C:\sqmnoopt00.sqm
[02/06/2009 21:58|--ah-----|244] - C:\sqmnoopt01.sqm
[14/06/2009 13:42|--a------|4196] - C:\UsbFix.txt
[21/09/2006 06:10|-r-------|1945600] - D:\00001.tmp
[21/09/2006 06:10|-r-------|46291] - D:\00002.tmp
[21/09/2006 06:10|-r-------|6419] - D:\0x040c.ini
[21/09/2006 06:10|-r-------|156] - D:\Autorun.inf
[21/09/2006 06:10|-r-------|4553324] - D:\BF_Intro.bik
[21/09/2006 06:10|-r-------|75253166] - D:\D1_Com~1.cab
[21/09/2006 06:10|-r-------|80656] - D:\Eula.dll
[21/09/2006 06:10|-r-------|982016] - D:\ISScript11.Msi
[21/09/2006 06:10|-r-------|12806952] - D:\MSGSLogo.bik
[21/09/2006 06:10|-r-------|23304] - D:\PidGen.dll
[21/09/2006 06:10|-r-h-----|4000] - D:\SSIFSDAT.SYS
[21/09/2006 06:10|-r-------|2195] - D:\Setup.ini
[21/09/2006 06:10|-r-------|8375056] - D:\SetupENU.dll
[21/09/2006 06:10|-r-------|60176] - D:\SetupENU3.dll
[21/09/2006 06:10|-r-------|88888] - D:\Splash.EXE
[21/09/2006 06:10|-r-------|921656] - D:\SplashImage.bmp
[21/09/2006 06:10|-r-------|2584848] - D:\WindowsInstaller-KB893803-x86.exe
[21/09/2006 06:10|-r-------|113464] - D:\ZT2PID.dll
[21/09/2006 06:10|-r-------|1195520] - D:\Zoo Tycoon 2 - Zookeeper Collection.msi
[21/09/2006 06:10|-r-------|1026832] - D:\autorun.exe
[21/09/2006 06:10|-r-------|306758] - D:\cluf.rtf
[21/09/2006 06:10|-r-------|260880] - D:\install.exe
[21/09/2006 06:10|-r-------|1708856] - D:\instmsia.exe
[21/09/2006 06:10|-r-------|1822520] - D:\instmsiw.exe
[21/09/2006 06:10|-r-------|316887] - D:\lisezmoi.rtf
[21/09/2006 06:10|-r-------|387087] - D:\setup.isn
[21/09/2006 06:10|-r-------|28097] - D:\setupInc.idx
[21/09/2006 06:10|-r-------|2686232] - D:\vcredist_x86.exe
[21/09/2006 06:10|-r-------|645] - D:\zt2.mcl
[21/09/2006 06:10|-r-------|115495] - D:\zt2.png
[21/09/2006 06:10|-r-------|735] - D:\zt2.xml
[21/09/2006 06:10|-r-------|742] - D:\zt264.xml
[21/09/2006 06:10|-r-------|42384168] - D:\zt2intro.bik

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# F:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.

################## [ ! Fin du rapport # UsbFix V3.031 ! ]

Désinstalle UsbFix.

Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

Clique sur Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

Voici le premier Info.txt


info.txt logfile of random's system information tool 1.06 2009-06-14 20:21:48

======Uninstall list======

-->MsiExec /X{A7E07C2B-2220-4415-87E3-784D5814BC93}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
AIDA32 v3.93-->"C:\Program Files\AIDA32 - Personal System Information\unins000.exe"
Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI AVIVO Codecs-->MsiExec.exe /I{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x3854
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class ISPLAY -clean
ATI Parental Control & Encoder-->MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
AVS Update Manager 1.0-->"C:\Program Files\AVS4YOU\AVSUpdateManger\unins000.exe"
AVS Video Converter 6-->"C:\Program Files\AVS4YOU\AVSVideoConverter6\unins000.exe"
AVS4YOU Software Navigator 1.3-->"C:\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.exe"
AxCrypt (Désinstaller uniquement)-->"C:\Program Files\Axon Data\AxCrypt\AxCryptU.exe"
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Catalyst Control Center - Branding-->MsiExec.exe /I{D3B1C799-CB73-42DE-BA0F-2344793A095C}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Counter-Strike(TM)-->MsiExec.exe /I{DF5A03CC-D5AA-43D8-B948-D9903F2AF94A}
EXPERTool ATI 4.1-->"C:\Program Files\EXPERTool ATI\unins000.exe"
FreeUndelete-->C:\Program Files\FreeUndelete\GLF348.exe /handle:fru
Half-Life 2: Deathmatch-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/320
Half-Life 2: Episode One-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/380
Half-Life 2: Episode Two-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/420
Half-Life 2: Lost Coast-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/340
Half-Life 2-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/220
Half-Life: Blue Shift-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/130
Hamachi 1.0.2.5-->C:\Program Files\Hamachi\uninstall.exe
High Definition Audio Driver Package - KB888111-->C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe
HijackThis 2.0.2-->"C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe" /uninstall
iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
JkDefrag 3.36-->"C:\Program Files\JkDefrag\unins000.exe"
LimeWire 5.1.2-->"C:\Program Files\LimeWire\uninstall.exe"
Lock Folder XP 3.6-->"C:\Program Files\Everstrike Software\Lock Folder XP 3.6\Uninstall.exe" "C:\Program Files\Fichiers communs\Everstrike Software\Lock Folder XP 3.6\install.log"
Ma-Config.com-->MsiExec.exe /X{560BD6E0-0BA6-43AF-B423-E1DF4D2EB3C3}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MediaConverter 2.5 for Philips-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8D8B167A-ED0F-43F1-AC10-3F4379F7CBBB}\Setup.exe" -l0x40c
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{3F7924B9-D148-3141-87B1-68F36043A940}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{511DF669-2930-30C0-8EB6-552887E29EC8}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5 Language Pack - fra-->MsiExec.exe /I{5B76AEA2-D4E5-3B55-B965-ACC36AE0EAFC}
Microsoft .NET Framework 3.5-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Games for Windows - LIVE -->MsiExec.exe /X{4AA3D64E-9EC3-4B0F-AB91-5885AC55641F}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Module linguistique Microsoft .NET Framework 3.5 - fra-->c:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - fra\setup.exe
Mozilla Firefox (3.0.11)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 9 Trial-->C:\Program Files\Fichiers communs\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER="8M01-249K-1T0E-3A1A-C7AA-MUZ3-8EL4-2U9W"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
OpenOffice.org 3.0-->MsiExec.exe /I{F44DA61E-720D-4E79-871F-F6E628B33242}
Opposing Force-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/50
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Radio net FR-->C:\WINDOWS\iun6002.exe "C:\Program Files\Radio net FR\irunin.ini"
Rockstar Games Social Club-->"C:\Program Files\InstallShield Installation Information\{08B3869E-D282-424C-9AFC-870E04A4BA14}\setup.exe" -runfromtemp -l0x040c -removeonly
SA52xx Device Manager-->C:\Program Files\InstallShield Installation Information\{6294CE03-1A16-4610-891E-FDAF9A585A54}\setup.exe -runfromtemp -l0x040c -removeonly
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SLD Codec Pack-->C:\Program Files\SLD Codec Pack\uninstall.exe
Steam(TM)-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak2_RC2\unins000.exe"
UsbFix-->C:\UsbFix\Uninstal.exe
Videora iPod Converter 4.07-->C:\Program Files\Red Kawa\Video Converter App\uninstaller.exe
VLC media player 0.9.4-->C:\Program Files\VideoLAN\VLC\uninstall.exe
VNC Free Edition 4.1.3-->"C:\Program Files\RealVNC\VNC4\unins000.exe"
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Media Encoder 9 Series-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
World of Warcraft-->C:\Program Files\Fichiers communs\Blizzard Entertainment\World of Warcraft\Uninstall.exe
Wow Cartographe 1.09-->C:\Program Files\WowCartographe\uninst.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
YouTube Downloader App 1.02-->C:\Program Files\Regensoft\Downloader App\uninstaller.exe
Zoo Tycoon 2 - Zookeeper Collection-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{238DCFCD-70B3-46B2-B90B-2CDCC69A3D03}

======Security center information======

AV: AntiVir Desktop

======System event log======

Computer Name: EICHIZEN
Event Code: 2505
Message: Le serveur n'a pas pu se lier au transport \Device\NetBT_Tcpip_{8D8D7CD1-D326-4AE2-BC55-4B0F396A414C} car un autre ordinateur du réseau porte le même nom. Le serveur n'a pas pu démarrer.

Record Number: 5
Source Name: Server
Time Written: 20090606125644.000000+120
Event Type: erreur
User:

Computer Name: EICHIZEN
Event Code: 2505
Message: Le serveur n'a pas pu se lier au transport \Device\NetBT_Tcpip_{C5BE27E6-955C-486E-A229-CCBB02810ABA} car un autre ordinateur du réseau porte le même nom. Le serveur n'a pas pu démarrer.

Record Number: 4
Source Name: Server
Time Written: 20090606125644.000000+120
Event Type: erreur
User:

Computer Name: EICHIZEN
Event Code: 26
Message: Application popup : Windows - Erreur système : Il existe un nom en double sur le réseau.

Record Number: 3
Source Name: Application Popup
Time Written: 20090606125637.000000+120
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20090606125634.000000+120
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090606125634.000000+120
Event Type: Informations
User:

=====Application event log=====

Computer Name: EICHIZEN
Event Code: 101
Message: MsnMsgr (468) Le moteur de base de données est arrêté.

Record Number: 170
Source Name: ESENT
Time Written: 20090209184705.000000+060
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 103
Message: MsnMsgr (468) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\erick_kustom95@msn.com\SharingMetadata\Working\database_7214_4D65_144D_2E03\dfsr.db: Le moteur de base de données a arrêté une instance (0).

Record Number: 169
Source Name: ESENT
Time Written: 20090209184705.000000+060
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 302
Message: MsnMsgr (468) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\erick_kustom95@msn.com\SharingMetadata\Working\database_7214_4D65_144D_2E03\dfsr.db: Le moteur de base de données a exécuté la procédure de récupération avec succès.

Record Number: 168
Source Name: ESENT
Time Written: 20090209180044.000000+060
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 301
Message: MsnMsgr (468) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\erick_kustom95@msn.com\SharingMetadata\Working\database_7214_4D65_144D_2E03\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\erick_kustom95@msn.com\SharingMetadata\Working\database_7214_4D65_144D_2E03\fsr.log.

Record Number: 167
Source Name: ESENT
Time Written: 20090209180043.000000+060
Event Type: Informations
User:

Computer Name: EICHIZEN
Event Code: 300
Message: MsnMsgr (468) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\erick_kustom95@msn.com\SharingMetadata\Working\database_7214_4D65_144D_2E03\dfsr.db: Le moteur de base de données initialise la procédure de récupération.

Record Number: 166
Source Name: ESENT
Time Written: 20090209180042.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Program Files\Fichiers communs\ArcSoft\Bin;%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 6 Stepping 5, GenuineIntel
"PROCESSOR_REVISION"=0605
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"RGSCLauncher"=C:\Program Files\Rockstar Games\Rockstar Games Social Club
"RGSC"=C:\Program Files\Rockstar Games\Rockstar Games Social Club\1_0_0_0
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip




Et le Deuxieme Log.txt



Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-06-14 20:21:36
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 4 GB (5%) free of 76 GB
Total RAM: 2047 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:21, on 14/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\srksrv.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\Documents and Settings\Administrateur\Bureau\Administrateur.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Gainward] C:\Program Files\EXPERTool ATI\TBPanel.exe /A
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8\Ghost (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: kohmtg.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: SarkoService (SarkophageService) - Unknown owner - C:\WINDOWS\system32\srksrv.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 7204 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11222041-111B-46E3-BD29-EFB2449479B1}]
IEPlugin Class - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL [2008-05-26 170496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2006-12-18 868352]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-04-01 36352]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-03-04 61440]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]
"ArcSoft Connection Service"=C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe [2008-04-17 98616]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"LFAgent"= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2008-11-18 21633320]
"RGSC"=C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe [2009-03-28 306088]
"Gainward"=C:\Program Files\EXPERTool ATI\TBPanel.exe [2008-09-05 2300456]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2008-02-22 217544]
"Steam"=C:\Program Files\Valve\Steam\Steam.exe [2009-06-11 1217784]

C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe
OpenOffice.org 3.0.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="kohmtg.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-03-04 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoSMHelp"=1
"MemCheckBoxInRunDlg"=1
"NoSMBalloonTip"=1
"NoDesktopCleanupWizard"=1
"NoWelcomeScreen"=1
"NoAutoUpdate"=1
"ClearDocsOnExit"=64
"NoDrives"=0
"NoDriveTypeAutoRun"=145
"NoDriveAutoRun"=FFFFFFFF
"NoFind"=0
"NoFolderOptions"=0
"NoRun"=0
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======List of files/folders created in the last 1 months======

2009-06-14 20:21:36 ----D---- C:\rsit
2009-06-14 13:42:35 ----RASHD---- C:\autorun.inf
2009-06-14 13:39:44 ----A---- C:\UsbFix.txt
2009-06-14 11:23:33 ----D---- C:\UsbFix
2009-06-13 20:49:00 ----D---- C:\Documents and Settings\Administrateur\Application Data\Microsoft Games
2009-06-13 20:48:34 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Games
2009-06-13 20:42:43 ----D---- C:\Program Files\Microsoft Games
2009-06-06 07:42:36 ----D---- C:\Program Files\Fichiers communs\Everstrike Software
2009-06-06 07:42:36 ----D---- C:\Program Files\Everstrike Software
2009-06-06 07:35:15 ----D---- C:\Program Files\Sarkophage
2009-06-06 07:35:15 ----A---- C:\WINDOWS\system32\srksrv.exe
2009-06-06 07:23:36 ----D---- C:\Program Files\Axon Data
2009-06-02 21:25:40 ----D---- C:\Program Files\Avira
2009-06-02 21:25:40 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-05-24 03:15:25 ----D---- C:\Program Files\FreeUndelete
2009-05-24 03:15:25 ----D---- C:\Documents and Settings\All Users\Application Data\OfficeRecovery
2009-05-21 21:24:04 ----D---- C:\Documents and Settings\Administrateur\Application Data\ArcSoft
2009-05-21 21:24:01 ----D---- C:\Documents and Settings\Administrateur\Application Data\AVS4YOU
2009-05-21 21:23:54 ----D---- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2009-05-21 21:23:24 ----D---- C:\Documents and Settings\All Users\Application Data\ArcSoft
2009-05-21 21:23:21 ----RA---- C:\WINDOWS\system32\msvcp71.dll
2009-05-21 21:23:21 ----D---- C:\Program Files\ArcSoft
2009-05-21 21:23:21 ----A---- C:\WINDOWS\system32\unicows.dll
2009-05-21 21:23:20 ----D---- C:\Program Files\Fichiers communs\ArcSoft
2009-05-21 21:22:55 ----D---- C:\Program Files\Fichiers communs\AVSMedia
2009-05-21 21:22:51 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-05-21 21:22:49 ----D---- C:\Program Files\AVS4YOU
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msxml3a.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msvcr70.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msvcp70.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\mfc70.dll
2009-05-21 21:22:12 ----D---- C:\Program Files\Philips
2009-05-21 21:21:04 ----D---- C:\Documents and Settings\Administrateur\Application Data\InstallShield
2009-05-21 18:28:33 ----D---- C:\Documents and Settings\Administrateur\Application Data\Red Kawa
2009-05-21 18:28:19 ----D---- C:\Program Files\Regensoft
2009-05-21 18:28:13 ----D---- C:\Program Files\Red Kawa

======List of files/folders modified in the last 1 months======

2009-06-14 16:06:35 ----D---- C:\Program Files\Mozilla Firefox
2009-06-14 13:43:22 ----SHD---- C:\RECYCLER
2009-06-14 13:43:22 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-06-14 13:42:42 ----D---- C:\WINDOWS
2009-06-14 13:42:36 ----D---- C:\WINDOWS\temp
2009-06-14 13:42:36 ----D---- C:\WINDOWS\Prefetch
2009-06-14 13:41:08 ----D---- C:\WINDOWS\system32
2009-06-14 13:40:15 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-14 13:38:42 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-14 13:31:21 ----D---- C:\Documents and Settings\Administrateur\Application Data\Skype
2009-06-14 10:56:35 ----D---- C:\Documents and Settings\Administrateur\Application Data\Hamachi
2009-06-14 10:31:40 ----D---- C:\Documents and Settings\Administrateur\Application Data\skypePM
2009-06-13 20:48:34 ----D---- C:\WINDOWS\system32\DirectX
2009-06-13 20:47:52 ----SHD---- C:\WINDOWS\Installer
2009-06-13 20:42:43 ----D---- C:\Program Files
2009-06-13 20:41:45 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-06-12 23:35:38 ----D---- C:\WINDOWS\system32\config
2009-06-06 07:42:36 ----D---- C:\Program Files\Fichiers communs
2009-06-06 07:33:16 ----SHD---- C:\System Volume Information
2009-06-05 14:35:00 ----HD---- C:\WINDOWS\inf
2009-06-04 19:34:20 ----D---- C:\Program Files\World of Warcraft
2009-06-02 21:55:37 ----RSHD---- C:\Recycled
2009-06-02 21:25:51 ----D---- C:\WINDOWS\system32\drivers
2009-06-02 21:25:16 ----D---- C:\WINDOWS\WinSxS
2009-06-02 17:46:33 ----D---- C:\WINDOWS\system32\DllCache
2009-05-31 22:02:32 ----D---- C:\Program Files\JkDefrag
2009-05-29 22:16:49 ----D---- C:\Documents and Settings\Administrateur\Application Data\teamspeak2
2009-05-21 21:23:19 ----HD---- C:\Program Files\InstallShield Installation Information
2009-05-21 18:28:18 ----D---- C:\Program Files\AviSynth 2.5

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-02-13 28376]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
R2 LF30FS;LF30FS; \??\C:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys []
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2007-01-16 293888]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2006-08-07 93952]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-03-04 3565568]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-10-31 93184]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-10-04 25280]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-24 12288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2006-07-27 83712]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
R3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 a5ptatse;a5ptatse; C:\WINDOWS\system32\drivers\a5ptatse.sys []
S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\cdaudio.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-03-26 36864]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe [2008-04-17 102712]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-04-01 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-03-02 185089]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-03-04 602112]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe [2008-11-25 935208]
R2 SarkophageService;SarkoService; C:\WINDOWS\system32\srksrv.exe [2006-05-07 453632]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2008-10-15 439632]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-03-03 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-03-15 216232]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------



Voila les deux log  

Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.

Double-clique sur le fichier téléchargé pour lancer le processus d'installation.

Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.

Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.

Sélectionne Exécuter un examen rapide.

Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

Citation :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.

Ferme tes navigateurs.

Si des malwares ont été détectés, clique sur Afficher les résultats.

Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.

MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

Voici le rapport d'analyse



Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2283
Windows 5.1.2600 Service Pack 3

15/06/2009 18:08:00
mbam-log-2009-06-15 (18-08-00).txt

Type de recherche: Examen rapide
Eléments examinés: 79723
Temps écoulé: 3 minute(s), 24 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d97fc677-694d-4a75-ac89-a5b85c2bcfed} (Adware.BullseyeToolbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6226ba26-c017-4007-928c-de9715c6fa67} (Adware.BullseyeToolbar) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\windows\system32\zmtag.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ovfsthbenbntdkosdoblwxirkxohnhgfemxced.dat (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ovfsthnlrnavrvgwkxpruwsstnfagskyfqcvsb.dat (Trojan.Agent) -> Quarantined and deleted successfully.

Relance MBAM, va dans Quarantaine et supprime tout.

[#ff0000]/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\[/#f]

Télécharge ComboFix ([#ff0000]sUBs[/#f]) sur ton Bureau.

Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.

Il va te demander d'installer la console de récupération : accepte.

Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

voila  


ComboFix 09-06-14.02 - Administrateur 15/06/2009 20:18.8 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.1407 [GMT 2:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycled\Recycled
c:\windows\system32\Drivers\jcyyetf.sys
c:\windows\system32\add7_g.dll
c:\windows\system32\drivers\jcyyetf.sys

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_AVPsys
-------\Service_drgsn


((((((((((((((((((((((((((((( Fichiers créés du 2009-05-15 au 2009-06-15 ))))))))))))))))))))))))))))))))))))
.

2009-06-15 16:10 . 2009-06-15 16:13 -------- d-----w- c:\documents and settings\Administrateur\Application Data\vlc
2009-06-15 16:03 . 2009-06-15 16:03 3371383 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-14 18:21 . 2009-06-14 18:21 -------- d-----w- C:\rsit
2009-06-14 09:23 . 2009-06-14 11:43 -------- d-----w- C:\UsbFix
2009-06-13 18:49 . 2009-06-13 18:49 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Microsoft Games
2009-06-13 18:48 . 2009-06-13 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Games
2009-06-13 18:42 . 2009-06-13 18:42 -------- d-----w- c:\program files\Microsoft Games
2009-06-06 05:42 . 2009-06-06 05:42 -------- d-----w- c:\program files\Fichiers communs\Everstrike Software
2009-06-06 05:42 . 2009-06-06 05:42 -------- d-----w- c:\program files\Everstrike Software
2009-06-06 05:35 . 2009-06-06 05:38 -------- d-----w- c:\program files\Sarkophage
2009-06-06 05:35 . 2006-05-07 18:18 453632 ----a-w- c:\windows\system32\srksrv.exe
2009-06-06 05:23 . 2009-06-06 05:23 -------- d-----w- c:\program files\Axon Data
2009-06-02 19:25 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-06-02 19:25 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-06-02 19:25 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-06-02 19:25 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-06-02 19:25 . 2009-06-02 19:25 -------- d-----w- c:\program files\Avira
2009-06-02 19:25 . 2009-06-02 19:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-05-27 19:38 . 2009-05-27 19:38 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-05-24 01:15 . 2009-05-24 01:15 -------- d-----w- c:\program files\FreeUndelete
2009-05-24 01:15 . 2009-05-24 01:15 -------- d-----w- c:\documents and settings\All Users\Application Data\OfficeRecovery
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ArcSoft
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\ArcSoft
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\AVS4YOU
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\ArcSoft
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\program files\ArcSoft
2009-05-21 19:23 . 2005-04-27 14:36 245408 ----a-w- c:\windows\system32\unicows.dll
2009-05-21 19:23 . 2003-03-18 20:14 499712 ----a-r- c:\windows\system32\msvcp71.dll
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\program files\Fichiers communs\ArcSoft
2009-05-21 19:22 . 2009-05-21 19:23 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
2009-05-21 19:22 . 2009-05-21 19:23 -------- d-----w- c:\program files\AVS4YOU
2009-05-21 19:22 . 2009-01-28 18:49 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-05-21 19:22 . 2009-01-28 18:49 487424 ----a-w- c:\windows\system32\msvcp70.dll
2009-05-21 19:22 . 2009-01-28 18:49 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-05-21 19:22 . 2009-01-28 18:49 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-05-21 19:22 . 2009-05-21 19:22 -------- d-----w- c:\program files\Philips
2009-05-21 19:21 . 2009-05-21 19:21 -------- d-----w- c:\documents and settings\Administrateur\Application Data\InstallShield
2009-05-21 16:28 . 2009-05-21 16:28 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Red Kawa
2009-05-21 16:28 . 2009-05-21 16:28 -------- d-----w- c:\program files\Regensoft
2009-05-21 16:28 . 2009-05-21 16:28 -------- d-----w- c:\program files\Red Kawa

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-15 18:23 . 2008-11-25 17:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Skype
2009-06-15 18:23 . 2008-10-04 13:54 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Hamachi
2009-06-15 18:20 . 2009-03-27 05:43 480776 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-15 16:03 . 2008-10-09 16:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-15 15:59 . 2008-11-25 17:37 -------- d-----w- c:\documents and settings\Administrateur\Application Data\skypePM
2009-06-13 18:41 . 2008-10-03 21:35 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-06-04 17:34 . 2008-10-04 13:58 -------- d-----w- c:\program files\World of Warcraft
2009-05-31 20:02 . 2008-12-18 23:23 -------- d-----w- c:\program files\JkDefrag
2009-05-29 20:16 . 2008-10-18 11:26 -------- d-----w- c:\documents and settings\Administrateur\Application Data\teamspeak2
2009-05-26 11:20 . 2008-10-09 16:30 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 11:19 . 2008-10-09 16:30 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-21 19:23 . 2008-10-03 21:35 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-21 16:28 . 2008-11-17 17:11 -------- d-----w- c:\program files\AviSynth 2.5
2009-05-12 18:06 . 2009-05-12 17:31 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Apple Computer
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\iTunes
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\iPod
2009-05-12 17:31 . 2009-05-12 17:30 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\Bonjour
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\Apple Software Update
2009-05-12 17:30 . 2009-05-12 17:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-05-03 03:15 . 2008-10-04 17:34 71392 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-02 08:05 . 2008-10-06 04:39 -------- d-----w- c:\program files\MSBuild
2009-05-02 08:04 . 2008-10-05 13:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-01 13:17 . 2009-03-28 16:17 -------- d-----w- c:\program files\Rockstar Games
2009-04-26 15:53 . 2009-04-26 15:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Nero
2009-04-26 15:16 . 2009-04-26 15:16 -------- d-----w- c:\program files\AskTBar
2009-04-26 15:16 . 2009-04-26 14:59 -------- d-----w- c:\program files\Nero
2009-04-26 15:14 . 2009-04-26 15:14 -------- d-----w- c:\program files\Windows Sidebar
2009-04-26 15:08 . 2009-04-26 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-04-26 15:04 . 2009-04-26 14:58 -------- d-----w- c:\program files\Fichiers communs\Nero
2009-04-26 14:58 . 2008-10-25 22:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\dvdcss
2009-04-26 14:51 . 2008-10-05 12:01 -------- d-----w- c:\documents and settings\Administrateur\Application Data\LimeWire
2009-04-21 13:39 . 2009-05-02 07:42 2449344 ----a-w- c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\maconfsetup.exe
2009-04-21 13:38 . 2009-05-02 07:42 429224 ----a-w- c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
2009-04-18 19:02 . 2009-04-18 19:02 -------- d-----w- c:\program files\CCleaner
2009-04-17 14:37 . 2008-10-05 12:00 -------- d-----w- c:\program files\Java
2009-04-17 14:37 . 2009-04-17 14:37 152576 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-17 06:30 . 2009-04-17 06:29 -------- d-----w- c:\program files\QuickTime
2009-04-17 06:29 . 2009-04-17 06:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-11 11:17 . 2001-08-24 17:00 81884 ----a-w- c:\windows\system32\perfc00C.dat
2009-04-11 11:17 . 2001-08-24 17:00 504216 ----a-w- c:\windows\system32\perfh00C.dat
2009-04-02 14:29 . 2009-04-02 14:29 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-28 17:59 . 2009-03-28 17:59 15872 ----a-r- c:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2009-03-28 17:57 . 2009-03-28 17:57 9158 ----a-r- c:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-03-28 13:55 . 2008-10-05 10:09 716272 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-03-28 13:23 . 2009-03-28 13:23 0 ----a-w- c:\windows\ativpsrm.bin
2009-03-28 13:22 . 2009-03-28 13:01 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-03-26 13:23 . 2009-05-12 17:30 36864 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-03-26 13:23 . 2009-05-12 17:30 1900544 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-03-19 14:32 . 2009-05-12 17:31 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-19 14:32 . 2009-03-19 14:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"RGSC"="c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe" [2009-03-28 306088]
"Gainward"="c:\program files\EXPERTool ATI\TBPanel.exe" [2008-09-05 2300456]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 217544]
"Steam"="c:\program files\Valve\Steam\Steam.exe" [2009-06-11 1217784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-03 61440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-04-17 98616]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2008-10-4 624416]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)
"ClearDocsOnExit"= 64 (0x40)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)
"ClearDocsOnExit"= 64 (0x40)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4661:TCP"= 4661:TCP:emule
"4672:UDP"= 4672:UDP:emule
"4242:TCP"= 4242:TCP:emule
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [02/06/2009 21:25 108289]
R2 LF30FS;LF30FS;c:\program files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys [19/11/2004 18:07 101488]
R2 SarkophageService;SarkoService;c:\windows\system32\srksrv.exe [06/06/2009 07:35 453632]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [28/03/2009 15:25 93184]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [15/03/2009 10:34 216232]
.
Contenu du dossier 'Tâches planifiées'

2009-05-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-LFAgent - (no file)


.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - c:\program files\Ghost Navigator2_8\Ghost
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\
FF - plugin: c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-15 20:23
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1454471165-287218729-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:02,85,c7,6e,99,00,4f,c6,00,db,59,71,2a,de,7b,23,8e,55,63,3b,3d,
e9,c6,57,81,5f,c6,4a,b0,99,d3,4f,c3,5e,f1,63,1d,ca,9e,4d,a7,48,ce,65,07,f6,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3308)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\CF20513.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\RealVNC\VNC4\winvnc4.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
.
**************************************************************************
.
Heure de fin: 2009-06-15 20:27 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-15 18:27
ComboFix2.txt 2009-03-28 23:20
ComboFix3.txt 2009-02-27 19:28
ComboFix4.txt 2009-01-21 05:41

Avant-CF: 4 072 566 784 octets libres
Après-CF: 4 063 174 656 octets libres

257

Fais analyser ce fichier : c:\windows\system32\srksrv.exe

Sur VirusTotal et poste le lien de l'analyse.

Je ne sais pas si c'est bon , mais le seul message que je reçoit est :



0 bytes size received / Se ha recibido un archivo vacio

Télécharge Ad-Remover (de Cyrildu17 / C_XX) sur ton Bureau.

/!\ Déconnecte-toi et ferme toutes applications en cours /!\

Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program files).

Double-clique sur le raccourci d'Ad-Remover situé sur ton Bureau pour le lancer.
(Sous Vista, il faut cliquer droit sur le raccourci d'Ad-Remover et choisir Exécuter en tant qu'administrateur)

Choisis la langue F pour français.

Au menu principal, choisis l'option S.

/!\ Laisse travailler l'outil /!\

Poste le rapport qui apparaît à la fin (C:\Ad-Report-SCAN.log).

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_J | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 14/06/2009 à 10:30 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 19:11:36, 16/06/2009 | Mode Normal | Option: SCAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: URANIUMOFCOURSE | Utilisateur actuel: Administrateur
.
Administrateur: Administrateur
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.
.
.
C:\Program Files\AskTBar
.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 3.0.11 *

Nom du profil: pfpqg1uj.default (Administrateur)
.
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.11");
.
.

* Internet Explorer Version 6.0.2900.5512 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnh...

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]


============== Suspect (Cracks, Serials ... ) ==============



+---------------------------------------------------------------------------+

2796 Octet(s) - C:\Ad-Report-SCAN.log

1 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE

Fin à: 19:25:51 | 16/06/2009
.
============== E.O.F ==============
.


voila

/!\ Déconnecte-toi et ferme toutes applications en cours /!\

Double-clique sur le raccourci d'Ad-Remover pour le lancer.
(Sous Vista, il faut cliquer droit sur le raccourci d'Ad-Remover et choisir Exécuter en tant qu'administrateur)

Choisis la langue F pour français.

Au menu principal, choisis l'option L et tape sur [Entrée] pour valider.

/!\ Laisse travailler l'outil et ne touche à rien /!\

Poste le rapport qui apparaît à la fin (C:\Ad-Report-CLEAN.log)

(CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_J | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 14/06/2009 à 10:30 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 20:32:44, 16/06/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: URANIUMOFCOURSE | Utilisateur actuel: Administrateur
.
Administrateur: Administrateur
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
.
C:\Program Files\AskTBar\bar
C:\Program Files\AskTBar\bar\Nouveau Archive WinRAR.rar
C:\Program Files\AskTBar

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 3.0.11 *

Nom du profil: pfpqg1uj.default (Administrateur)
.
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.11");
.
.

* Internet Explorer Version 6.0.2900.5512 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnh...
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnh...

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnh...
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============



+---------------------------------------------------------------------------+

2749 Octet(s) - C:\Ad-Report-CLEAN.log
3018 Octet(s) - C:\Ad-Report-SCAN.log

20 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
1 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE

Fin à: 20:47:57 | 16/06/2009
.
============== E.O.F ==============
.

Désinstalle Ad-Remover.

Citation :

c:\program files\Sarkophage

--> Ce dossier te dit quelque chose ?

euh... non vraiment pas désole


je vient de voir a quoi sert ce ''dossier'' et je n'ai vraiment pas installer ce genre de logiciel sur mon pc , du moins je n'en ai pas le souvenir ...

et je suis seul a utiliser ce pc :s

/!\ Seul juliano95100 peut suivre cette procédure /!\

Désactive toute protection résidente (Antivirus...) !

---> Copie (CTRL+C) le texte se situant dans le cadre ci-dessous :


---> Ouvre le Bloc-notes : Démarrer > Tous les programmes > Accessoires > Bloc-notes.

- Colle (CTRL+V) le texte dans le Bloc-notes.
- Enregistre ce fichier dans : Bureau
- Nom du fichier : CFScript
- Type du fichier : tous les fichiers !!
- Clique sur Enregistrer.
- Quitte le Bloc-notes.

---> Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :

Cela va relancer Combofix : au message qui apparaît, accepte.

Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher, copie/colle son contenu sur le forum.

Si le fichier ne s'ouvre pas, il se trouve ici : C:\ComboFix.txt

 

ComboFix 09-06-16.05 - Administrateur 17/06/2009 20:13.9 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.1538 [GMT 2:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Administrateur\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\system32\srksrv.exe"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Sarkophage
c:\windows\system32\ATIODCLI.exe
c:\windows\system32\ATIODE.exe
c:\program files\Sarkophage\sarkomenu.dll
c:\windows\system32\srksrv.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SARKOPHAGESERVICE
-------\Service_SarkophageService


((((((((((((((((((((((((((((( Fichiers créés du 2009-05-17 au 2009-06-17 ))))))))))))))))))))))))))))))))))))
.

2009-06-16 18:06 . 2009-06-16 18:06 -------- d-----w- c:\program files\Micro Application
2009-06-16 17:11 . 2009-06-17 02:15 -------- d-----w- c:\program files\Ad-remover
2009-06-15 16:10 . 2009-06-15 16:13 -------- d-----w- c:\documents and settings\Administrateur\Application Data\vlc
2009-06-15 16:03 . 2009-06-15 16:03 3371383 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-14 18:21 . 2009-06-14 18:21 -------- d-----w- C:\rsit
2009-06-13 18:49 . 2009-06-13 18:49 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Microsoft Games
2009-06-13 18:48 . 2009-06-13 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Games
2009-06-13 18:42 . 2009-06-13 18:42 -------- d-----w- c:\program files\Microsoft Games
2009-06-06 05:42 . 2009-06-17 02:19 -------- d-----w- c:\program files\Everstrike Software
2009-06-06 05:42 . 2009-06-06 05:42 -------- d-----w- c:\program files\Fichiers communs\Everstrike Software
2009-06-02 19:25 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-06-02 19:25 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-06-02 19:25 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-06-02 19:25 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-06-02 19:25 . 2009-06-02 19:25 -------- d-----w- c:\program files\Avira
2009-06-02 19:25 . 2009-06-02 19:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-05-27 19:38 . 2009-05-27 19:38 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-05-24 01:15 . 2009-06-17 02:22 -------- d-----w- c:\program files\FreeUndelete
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\ArcSoft
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\ArcSoft
2009-05-21 19:24 . 2009-05-21 19:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\AVS4YOU
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\ArcSoft
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\program files\ArcSoft
2009-05-21 19:23 . 2005-04-27 14:36 245408 ----a-w- c:\windows\system32\unicows.dll
2009-05-21 19:23 . 2003-03-18 20:14 499712 ----a-r- c:\windows\system32\msvcp71.dll
2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w- c:\program files\Fichiers communs\ArcSoft
2009-05-21 19:22 . 2009-05-21 19:23 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
2009-05-21 19:22 . 2009-05-21 19:23 -------- d-----w- c:\program files\AVS4YOU
2009-05-21 19:22 . 2009-01-28 18:49 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-05-21 19:22 . 2009-01-28 18:49 487424 ----a-w- c:\windows\system32\msvcp70.dll
2009-05-21 19:22 . 2009-01-28 18:49 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-05-21 19:22 . 2009-01-28 18:49 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-05-21 16:28 . 2009-05-21 16:28 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Red Kawa
2009-05-21 16:28 . 2009-05-21 16:28 -------- d-----w- c:\program files\Red Kawa

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-17 18:17 . 2008-10-04 13:54 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Hamachi
2009-06-17 18:16 . 2009-03-27 05:43 480776 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-17 18:08 . 2008-11-25 17:37 -------- d-----w- c:\documents and settings\Administrateur\Application Data\skypePM
2009-06-17 18:07 . 2008-11-25 17:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Skype
2009-06-17 02:22 . 2008-11-17 17:11 -------- d-----w- c:\program files\AviSynth 2.5
2009-06-15 16:03 . 2008-10-09 16:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-13 18:41 . 2008-10-03 21:35 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-06-04 17:34 . 2008-10-04 13:58 -------- d-----w- c:\program files\World of Warcraft
2009-05-31 20:02 . 2008-12-18 23:23 -------- d-----w- c:\program files\JkDefrag
2009-05-29 20:16 . 2008-10-18 11:26 -------- d-----w- c:\documents and settings\Administrateur\Application Data\teamspeak2
2009-05-26 11:20 . 2008-10-09 16:30 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 11:19 . 2008-10-09 16:30 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-21 19:23 . 2008-10-03 21:35 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-12 18:06 . 2009-05-12 17:31 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Apple Computer
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\iTunes
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\iPod
2009-05-12 17:31 . 2009-05-12 17:30 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-05-12 17:31 . 2009-05-12 17:31 -------- d-----w- c:\program files\Apple Software Update
2009-05-12 17:30 . 2009-05-12 17:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-05-03 03:15 . 2008-10-04 17:34 71392 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-02 08:05 . 2008-10-06 04:39 -------- d-----w- c:\program files\MSBuild
2009-05-02 08:04 . 2008-10-05 13:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-01 13:17 . 2009-03-28 16:17 -------- d-----w- c:\program files\Rockstar Games
2009-04-26 15:53 . 2009-04-26 15:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Nero
2009-04-26 15:16 . 2009-04-26 14:59 -------- d-----w- c:\program files\Nero
2009-04-26 15:14 . 2009-04-26 15:14 -------- d-----w- c:\program files\Windows Sidebar
2009-04-26 15:08 . 2009-04-26 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-04-26 15:04 . 2009-04-26 14:58 -------- d-----w- c:\program files\Fichiers communs\Nero
2009-04-26 14:58 . 2008-10-25 22:36 -------- d-----w- c:\documents and settings\Administrateur\Application Data\dvdcss
2009-04-26 14:51 . 2008-10-05 12:01 -------- d-----w- c:\documents and settings\Administrateur\Application Data\LimeWire
2009-04-21 13:39 . 2009-05-02 07:42 2449344 ----a-w- c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\maconfsetup.exe
2009-04-21 13:38 . 2009-05-02 07:42 429224 ----a-w- c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
2009-04-18 19:02 . 2009-04-18 19:02 -------- d-----w- c:\program files\CCleaner
2009-04-17 14:37 . 2009-04-17 14:37 152576 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-11 11:17 . 2001-08-24 17:00 81884 ----a-w- c:\windows\system32\perfc00C.dat
2009-04-11 11:17 . 2001-08-24 17:00 504216 ----a-w- c:\windows\system32\perfh00C.dat
2009-04-02 14:29 . 2009-04-02 14:29 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-28 17:59 . 2009-03-28 17:59 15872 ----a-r- c:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2009-03-28 17:57 . 2009-03-28 17:57 9158 ----a-r- c:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-03-28 13:55 . 2008-10-05 10:09 716272 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-03-28 13:23 . 2009-03-28 13:23 0 ----a-w- c:\windows\ativpsrm.bin
2009-03-28 13:22 . 2009-03-28 13:01 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-03-26 13:23 . 2009-05-12 17:30 36864 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-03-26 13:23 . 2009-05-12 17:30 1900544 ----a-w- c:\windows\system32\usbaaplrc.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"RGSC"="c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe" [2009-03-28 306088]
"Gainward"="c:\program files\EXPERTool ATI\TBPanel.exe" [2008-09-05 2300456]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 217544]
"Steam"="c:\program files\Valve\Steam\Steam.exe" [2009-06-11 1217784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-03 61440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-04-17 98616]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2008-10-4 624416]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)
"ClearDocsOnExit"= 64 (0x40)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)
"ClearDocsOnExit"= 64 (0x40)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4661:TCP"= 4661:TCP:emule
"4672:UDP"= 4672:UDP:emule
"4242:TCP"= 4242:TCP:emule
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [02/06/2009 21:25 108289]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [28/03/2009 15:25 93184]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [15/03/2009 10:34 216232]
.
Contenu du dossier 'Tâches planifiées'

2009-05-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Examen supplémentaire -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - c:\program files\Ghost Navigator2_8\Ghost
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\
FF - plugin: c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\pfpqg1uj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-17 20:18
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1454471165-287218729-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:02,85,c7,6e,99,00,4f,c6,00,db,59,71,2a,de,7b,23,8e,55,63,3b,3d,
e9,c6,57,81,5f,c6,4a,b0,99,d3,4f,c3,5e,f1,63,1d,ca,9e,4d,a7,48,ce,65,07,f6,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2452)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\RealVNC\VNC4\winvnc4.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Heure de fin: 2009-06-17 20:22 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-17 18:22
ComboFix2.txt 2009-06-15 18:27
ComboFix3.txt 2009-03-28 23:20
ComboFix4.txt 2009-02-27 19:28
ComboFix5.txt 2009-06-17 18:13

Avant-CF: 5 333 876 736 octets libres
Après-CF: 5 326 454 784 octets libres

240



voila  

Menu Démarrer > Exécuter > Tape combofix /u et valide.

Désinstalle Java 6 Update 13 et Java 6 Update 7.

Mets à jour Java.

Mets à jour Adobe Reader.

Mets à jour Internet Explorer.

Refais un scan RSIT et poste le rapport log.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-06-19 22:23:30
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 10 GB (13%) free of 76 GB
Total RAM: 2047 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:23, on 19/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\EXPERTool ATI\TBPanel.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrateur\Bureau\Repare\RSIT.exe
C:\Documents and Settings\Administrateur\Bureau\Administrateur.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1noarp
O4 - HKLM\..\RunOnce: [NoIE4StubProcessing] C:\WINDOWS\system32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Gainward] C:\Program Files\EXPERTool ATI\TBPanel.exe /A
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\Ghost Navigator2_8\Ghost (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 8200 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11222041-111B-46E3-BD29-EFB2449479B1}]
IEPlugin Class - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL [2008-05-26 170496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-06-19 41368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-06-19 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2006-12-18 868352]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-04-01 36352]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-03-04 61440]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]
"ArcSoft Connection Service"=C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe [2008-04-17 98616]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-06-19 148888]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Uninstall Adobe Download Manager"=C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2009-06-04 66048]
"NoIE4StubProcessing"=C:\WINDOWS\system32\reg.exe [2008-04-13 53248]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2008-11-18 21633320]
"RGSC"=C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe [2009-03-28 306088]
"Gainward"=C:\Program Files\EXPERTool ATI\TBPanel.exe [2008-09-05 2300456]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2008-02-22 217544]
"Steam"=C:\Program Files\Valve\Steam\Steam.exe [2009-06-11 1217784]

C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe
OpenOffice.org 3.0.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-03-04 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"MemCheckBoxInRunDlg"=1
"NoSMBalloonTip"=1
"NoDesktopCleanupWizard"=1
"NoWelcomeScreen"=1
"NoAutoUpdate"=1
"ClearDocsOnExit"=64
"NoDrives"=0
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======List of files/folders created in the last 1 months======

2009-06-19 22:22:23 ----HD---- C:\WINDOWS\$hf_mig$
2009-06-19 22:22:23 ----D---- C:\WINDOWS\ie8updates
2009-06-19 22:22:15 ----A---- C:\WINDOWS\imsins.BAK
2009-06-19 22:22:05 ----D---- C:\WINDOWS\WBEM
2009-06-19 22:21:52 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-06-19 22:21:06 ----HDC---- C:\WINDOWS\ie8
2009-06-19 22:21:02 ----D---- C:\WINDOWS\LastGood
2009-06-19 22:18:09 ----A---- C:\WINDOWS\system32\MRT.exe
2009-06-19 22:17:43 ----N---- C:\WINDOWS\system32\SET15A.tmp
2009-06-19 22:17:43 ----N---- C:\WINDOWS\system32\SET155.tmp
2009-06-19 22:17:42 ----N---- C:\WINDOWS\system32\SET157.tmp
2009-06-19 22:17:42 ----N---- C:\WINDOWS\system32\SET156.tmp
2009-06-19 22:17:41 ----N---- C:\WINDOWS\system32\SET15B.tmp
2009-06-19 22:15:15 ----D---- C:\Program Files\Fichiers communs\Adobe
2009-06-19 22:15:15 ----D---- C:\Program Files\Adobe
2009-06-19 22:15:02 ----SHD---- C:\Config.Msi
2009-06-19 22:11:37 ----A---- C:\WINDOWS\system32\javaws.exe
2009-06-19 22:11:37 ----A---- C:\WINDOWS\system32\javaw.exe
2009-06-19 22:11:37 ----A---- C:\WINDOWS\system32\java.exe
2009-06-19 22:07:52 ----SD---- C:\ComboFix
2009-06-17 20:22:36 ----A---- C:\ComboFix.txt
2009-06-17 20:20:40 ----SHD---- C:\RECYCLER
2009-06-17 20:15:56 ----D---- C:\WINDOWS\temp
2009-06-16 20:06:42 ----D---- C:\Program Files\Micro Application
2009-06-16 19:11:14 ----D---- C:\Program Files\Ad-remover
2009-06-15 18:10:17 ----D---- C:\Documents and Settings\Administrateur\Application Data\vlc
2009-06-15 18:08:58 ----A---- C:\WINDOWS\ippln.txt
2009-06-14 20:21:36 ----D---- C:\rsit
2009-06-14 13:42:35 ----RASHD---- C:\autorun.inf
2009-06-14 13:39:44 ----A---- C:\UsbFix.txt
2009-06-13 20:49:00 ----D---- C:\Documents and Settings\Administrateur\Application Data\Microsoft Games
2009-06-13 20:48:34 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Games
2009-06-13 20:42:43 ----D---- C:\Program Files\Microsoft Games
2009-06-06 07:42:36 ----D---- C:\Program Files\Fichiers communs\Everstrike Software
2009-06-06 07:42:36 ----D---- C:\Program Files\Everstrike Software
2009-06-02 21:25:40 ----D---- C:\Program Files\Avira
2009-06-02 21:25:40 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-05-24 03:15:25 ----D---- C:\Program Files\FreeUndelete
2009-05-21 21:24:04 ----D---- C:\Documents and Settings\Administrateur\Application Data\ArcSoft
2009-05-21 21:24:01 ----D---- C:\Documents and Settings\Administrateur\Application Data\AVS4YOU
2009-05-21 21:23:54 ----D---- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2009-05-21 21:23:24 ----D---- C:\Documents and Settings\All Users\Application Data\ArcSoft
2009-05-21 21:23:21 ----RA---- C:\WINDOWS\system32\msvcp71.dll
2009-05-21 21:23:21 ----D---- C:\Program Files\ArcSoft
2009-05-21 21:23:21 ----A---- C:\WINDOWS\system32\unicows.dll
2009-05-21 21:23:20 ----D---- C:\Program Files\Fichiers communs\ArcSoft
2009-05-21 21:22:55 ----D---- C:\Program Files\Fichiers communs\AVSMedia
2009-05-21 21:22:51 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-05-21 21:22:49 ----D---- C:\Program Files\AVS4YOU
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msxml3a.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msvcr70.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\msvcp70.dll
2009-05-21 21:22:49 ----A---- C:\WINDOWS\system32\mfc70.dll
2009-05-21 18:28:33 ----D---- C:\Documents and Settings\Administrateur\Application Data\Red Kawa
2009-05-21 18:28:13 ----D---- C:\Program Files\Red Kawa

======List of files/folders modified in the last 1 months======

2009-06-19 22:23:01 ----D---- C:\Program Files\Mozilla Firefox
2009-06-19 22:22:45 ----HD---- C:\WINDOWS\inf
2009-06-19 22:22:45 ----D---- C:\WINDOWS
2009-06-19 22:22:44 ----D---- C:\WINDOWS\system32\DllCache
2009-06-19 22:22:44 ----D---- C:\WINDOWS\system32
2009-06-19 22:22:41 ----D---- C:\Program Files\Internet Explorer
2009-06-19 22:22:11 ----D---- C:\WINDOWS\system32\config
2009-06-19 22:22:05 ----D---- C:\WINDOWS\system32\fr-FR
2009-06-19 22:21:59 ----D---- C:\WINDOWS\Media
2009-06-19 22:21:56 ----D---- C:\WINDOWS\Help
2009-06-19 22:21:02 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-19 22:18:10 ----D---- C:\WINDOWS\Debug
2009-06-19 22:16:30 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2009-06-19 22:16:02 ----SHD---- C:\WINDOWS\Installer
2009-06-19 22:15:18 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-06-19 22:15:15 ----D---- C:\Program Files\Fichiers communs
2009-06-19 22:15:15 ----D---- C:\Program Files
2009-06-19 22:13:49 ----D---- C:\Program Files\NOS
2009-06-19 22:11:26 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-06-19 22:09:43 ----D---- C:\Program Files\Java
2009-06-19 22:08:36 ----D---- C:\WINDOWS\system32\Restore
2009-06-19 22:07:55 ----D---- C:\WINDOWS\erdnt
2009-06-19 22:02:42 ----D---- C:\Documents and Settings\Administrateur\Application Data\skypePM
2009-06-19 22:02:35 ----D---- C:\Documents and Settings\Administrateur\Application Data\Hamachi
2009-06-19 22:02:28 ----D---- C:\Documents and Settings\Administrateur\Application Data\Skype
2009-06-17 20:22:39 ----D---- C:\WINDOWS\system32\drivers
2009-06-17 20:19:14 ----A---- C:\WINDOWS\system.ini
2009-06-17 20:15:19 ----D---- C:\WINDOWS\AppPatch
2009-06-17 20:13:07 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-17 04:22:11 ----D---- C:\Program Files\AviSynth 2.5
2009-06-15 18:03:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-06-15 17:59:37 ----D---- C:\WINDOWS\Prefetch
2009-06-14 13:43:22 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-06-13 20:48:34 ----D---- C:\WINDOWS\system32\DirectX
2009-06-13 20:41:45 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-06-06 07:33:16 ----SHD---- C:\System Volume Information
2009-06-04 19:34:20 ----D---- C:\Program Files\World of Warcraft
2009-06-02 21:25:16 ----D---- C:\WINDOWS\WinSxS
2009-05-31 22:02:32 ----D---- C:\Program Files\JkDefrag
2009-05-29 22:16:49 ----D---- C:\Documents and Settings\Administrateur\Application Data\teamspeak2
2009-05-21 21:23:19 ----HD---- C:\Program Files\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-02-13 28376]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2007-01-16 293888]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2006-08-07 93952]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-03-04 3565568]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-10-31 93184]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-10-04 25280]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-24 12288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2006-07-27 83712]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 a8mkpsrl;a8mkpsrl; C:\WINDOWS\system32\drivers\a8mkpsrl.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-03-26 36864]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe [2008-04-17 102712]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-04-01 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-03-02 185089]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-03-04 602112]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-06-19 152984]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe [2008-11-25 935208]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2008-10-15 439632]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-03-03 593920]
S2 spupdsvc;Windows Service Pack Installer update service; C:\WINDOWS\system32\spupdsvc.exe [2009-01-07 26144]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2009-06-04 66048]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-03-15 216232]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------


Voila , j'ai quand meme mis a jour Internet explorer meme si j'utilise Firefox ( mis a jour )



( dsl pour le retard petit pb de net :-( )

Plus de souci ?

a priori , non pour le moment  


Merci bcp  

1/

Désinstalle HijackThis.

Télécharge ToolsCleaner2 sur ton Bureau.

Double-clique sur ToolsCleaner2.exe pour le lancer.

Clique sur Recherche et laisse le scan agir.

Clique sur Suppression pour finaliser.

Tu peux, si tu le souhaites, te servir des Options Facultatives.

Clique sur Quitter pour obtenir le rapport.

Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).


2/

Télécharge et installe CCleaner Slim.

Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....

Va dans Nettoyeur, choisis Analyser. Une fois terminé, lance le nettoyage.


3/

Il est nécessaire de désactiver puis réactiver la restauration système pour la purger.


==Prévention==

Supprimer les popups d'Antivir : Lien

Conserve MBAM. Il te servira à scanner les fichiers douteux en complément de l'antivirus et scanne le disque dur régulièrement.

Par rapport au P2P : Lien

Voici un dossier complet (A lire avec Adobe Reader ou Foxit Reader) : Lien


==Problème résolu ?==

Si tu estimes que ton problème est résolu :

---> Ajoute maintenant [Résolu] au titre. Pour cela :

Clique, dans ton premier message, sur le bouton Editer .

Rajoute la mention [Résolu] devant le titre.

Clique ensuite sur Valider votre message.


Sois plus vigilant(e) sur Internet  

[ Rapport ToolsCleaner version 2.3.6 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\Combofix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Administrateur\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\Administrateur\Bureau\Repare\Rsit.exe: trouvé !
C:\Documents and Settings\Administrateur\Bureau\Repare\Nouveau dossier\UsbFix.exe: trouvé !
C:\Program Files\Ad-remover: trouvé !
C:\Program Files\Ad-remover\BACKUP\Ad-R.exe: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe: supprimé !
C:\Program Files\Ad-remover\BACKUP\Ad-R.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\Administrateur\Bureau\hijackthis.log: supprimé !
C:\Documents and Settings\Administrateur\Bureau\Repare\Rsit.exe: supprimé !
C:\Documents and Settings\Administrateur\Bureau\Repare\Nouveau dossier\UsbFix.exe: supprimé !
C:\Combofix: supprimé !
C:\Rsit: supprimé !
C:\Program Files\Ad-remover: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !



Merci bcp   je change l'intitulé du message  

Tu peux supprimer ToolsCleaner.

Ok c'est fait   Merci bcp encore une fois