Autochk dll

bonjour, j'ai un souci avec un virus: autochk.dll je n'arrive pas m'en défaire qui peux m'aider .

Gérard

Salut Dje,

Déjà, vire ton adresse Yahoo, si tu ne veux pas être envahi de spam en plus de ton "virus"
Effectivement, autochk.dll est un trojan. Comment l'as-tu repéré ? Quels ont été les "signes"

Télécharge Hijackthis (de Trend Micro) sur ton Bureau.

• Double clique sur HJTInstall.exe pour lancer l'installation.
• Clique sur Install.
• Double clique sur le raccourci d'HijackThis qui vient d'être créé pour le lancer. (Clique droit -> lancer en tant qu'admin si sous Vista)
• Accepte la licence en cliquant sur Yes.
• Clique sur Do a system scan and save a logfile.
• Poste ici le rapport généré.

Note : Le rapport se trouve également ici : C:\Program Files\Trend Micro\Hijackthis\Hijackthis.log

Aide : Comment utiliser HijackThis.

voici le rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:42:28, on 12/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\DSentry.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Christophe Riqueau\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Christophe Riqueau\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Christophe Riqueau\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dje.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.univ-tln.fr:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [bascstray] BascsTray.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\system32\DSentry.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [http://www.lienvandekelder.be] \Lien Vande Kelder.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,_IWMPEvents@16
O4 - HKLM\..\Run: [PC Antispyware 2010] "C:\Program Files\PC_Antispyware2010\PC_Antispyware2010.exe" /hide
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKLM\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\calc.dll,_IWMPEvents@0
O4 - HKLM\..\RunServices: [http://www.lienvandekelder.be] \Lien Vande Kelder.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOCUME~1\CHRIST~1\protect.dll,_IWMPEvents@16
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [calc] rundll32.exe C:\DOCUME~1\CHRIST~1\ntuser.dll,_IWMPEvents@0
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-488444937-3512558271-582709162-1005\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-488444937-3512558271-582709162-1005\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-21-488444937-3512558271-582709162-1005\..\Run: [Google Update] "C:\Documents and Settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c (User '?')
O4 - HKUS\S-1-5-21-488444937-3512558271-582709162-1005\..\Run: [calc] rundll32.exe C:\DOCUME~1\CHRIST~1\ntuser.dll,_IWMPEvents@0 (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-488444937-3512558271-582709162-1005 Startup: ChkDisk.lnk = ? (User '?')
O4 - S-1-5-21-488444937-3512558271-582709162-1005 Startup: Raccourci vers Maj_Nav.exe.lnk = C:\MajNav\Maj_Nav.exe (User '?')
O4 - S-1-5-21-488444937-3512558271-582709162-1005 Startup: scandisk.dll (User '?')
O4 - S-1-5-21-488444937-3512558271-582709162-1005 Startup: scandisk.lnk = ? (User '?')
O4 - S-1-5-18 Startup: ChkDisk.lnk = ? (User '?')
O4 - S-1-5-18 Startup: Raccourci vers Maj_Nav.exe.lnk = C:\MajNav\Maj_Nav.exe (User '?')
O4 - S-1-5-18 Startup: scandisk.dll (User '?')
O4 - S-1-5-18 Startup: scandisk.lnk = ? (User '?')
O4 - .DEFAULT Startup: ChkDisk.lnk = ? (User 'Default user')
O4 - .DEFAULT Startup: Raccourci vers Maj_Nav.exe.lnk = C:\MajNav\Maj_Nav.exe (User 'Default user')
O4 - .DEFAULT Startup: scandisk.dll (User 'Default user')
O4 - .DEFAULT Startup: scandisk.lnk = ? (User 'Default user')
O4 - Startup: ChkDisk.lnk = ?
O4 - Startup: Raccourci vers Maj_Nav.exe.lnk = C:\MajNav\Maj_Nav.exe
O4 - Startup: scandisk.dll
O4 - Startup: scandisk.lnk = ?
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://dida.univ-tln.fr/qp2.cab
O16 - DPF: {10ABC6DB-E091-4EAE-98DD-21B5A2460714} (DetInstaller Class) - http://www.pandasoftware.es/avchec [...] etInst.cab
O16 - DPF: {52A5CD24-64C6-4BAF-A4EC-4D13F451763F} (CU LiveUpdate Control) - http://visio.univ-tln.fr/ctmexpres [...] update.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - https://mysupport.nai.com/amiuptoda [...] Portal.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft. [...] 4419274926
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9FEFBE8-0D0B-4AAA-BE19-9E2AE67080E0}: Domain = univ-tln.fr
O20 - AppInit_DLLs: cru629.dat
O20 - Winlogon Notify: rgadtm - rgadtm.dll (file missing)
O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.3 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 9627 bytes

Merci pour les infos à bientôt j'attends la suite

Gérard

Ps, je ne navigue plus avec internet exporer j'ai désinstaller le truc maintenant j'utilise google chrome j'ai moins de problèmes

hello, je vais executer tout cela petit soucis ce matin, j'ai du ouvrir mon ordi en mode sans echec

Voici le rapport rootkit...je continue à tout à l'heure :

GMER 1.0.15.15125 - http://www.gmer.net
Rootkit scan 2009-10-13 15:34:32
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\kwtdapob.sys


---- Services - GMER 1.0.15 ----

Service C:\WINDOWS\system32\drivers\kbiwkmqpltpuix.sys (*** hidden *** ) [SYSTEM] kbiwkmimovrobr <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr@start 1
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr@imagepath \systemroot\system32\drivers\kbiwkmqpltpuix.sys
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\main (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\main@aid 10200
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\main@sid 0
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\main@cmddelay 14400
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\main\delete (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\main\injector (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\main\injector@* kbiwkmwsp8.dll
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\main\injector@svchost.exe kbiwkmcont.dll
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\main\tasks (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules@kbiwkmrk.sys \systemroot\system32\drivers\kbiwkmqpltpuix.sys
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules@kbiwkmcmd.dll \systemroot\system32\kbiwkmetehxdpx.dll
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules@kbiwkmlog.dat \systemroot\system32\kbiwkmmowujnfo.dat
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules@kbiwkmwsp.dll \systemroot\system32\kbiwkmdpmwksvi.dll
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules@kbiwkm.dat \systemroot\system32\kbiwkmjxdldyur.dat
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules@kbiwkmwsp8.dll \systemroot\system32\kbiwkmowylvnsv.dll
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules@kbiwkmconz.dll \systemroot\system32\kbiwkmklrlxewc.dll
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules@kbiwkmwsp8p.dll \systemroot\system32\kbiwkmiwwutpts.dll
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules@kbiwkmconw.dll \systemroot\system32\kbiwkmewnijxmv.dll
Reg HKLM\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\modules@kbiwkmcont.dll \systemroot\system32\kbiwkmrmphxlvr.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr@imagepath \systemroot\system32\drivers\kbiwkmqpltpuix.sys
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\main (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\main@aid 10200
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\main@sid 0
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\main@cmddelay 14400
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\main\delete (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\main\injector (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\main\injector@* kbiwkmwsp8.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\main\injector@svchost.exe kbiwkmcont.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\main\tasks (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules@kbiwkmrk.sys \systemroot\system32\drivers\kbiwkmqpltpuix.sys
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules@kbiwkmcmd.dll \systemroot\system32\kbiwkmetehxdpx.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules@kbiwkmlog.dat \systemroot\system32\kbiwkmmowujnfo.dat
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules@kbiwkmwsp.dll \systemroot\system32\kbiwkmdpmwksvi.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules@kbiwkm.dat \systemroot\system32\kbiwkmjxdldyur.dat
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules@kbiwkmwsp8.dll \systemroot\system32\kbiwkmowylvnsv.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules@kbiwkmconz.dll \systemroot\system32\kbiwkmklrlxewc.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules@kbiwkmwsp8p.dll \systemroot\system32\kbiwkmiwwutpts.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules@kbiwkmconw.dll \systemroot\system32\kbiwkmewnijxmv.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\modules@kbiwkmcont.dll \systemroot\system32\kbiwkmrmphxlvr.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr@imagepath \systemroot\system32\drivers\kbiwkmqpltpuix.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\main
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\main@aid 10200
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\main@sid 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\main@cmddelay 14400
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\main\delete
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\main\injector
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\main\injector@* kbiwkmwsp8.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\main\injector@svchost.exe kbiwkmcont.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\main\tasks
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules@kbiwkmrk.sys \systemroot\system32\drivers\kbiwkmqpltpuix.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules@kbiwkmcmd.dll \systemroot\system32\kbiwkmetehxdpx.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules@kbiwkmlog.dat \systemroot\system32\kbiwkmmowujnfo.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules@kbiwkmwsp.dll \systemroot\system32\kbiwkmdpmwksvi.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules@kbiwkm.dat \systemroot\system32\kbiwkmjxdldyur.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules@kbiwkmwsp8.dll \systemroot\system32\kbiwkmowylvnsv.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules@kbiwkmconz.dll \systemroot\system32\kbiwkmklrlxewc.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules@kbiwkmwsp8p.dll \systemroot\system32\kbiwkmiwwutpts.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules@kbiwkmconw.dll \systemroot\system32\kbiwkmewnijxmv.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmimovrobr\modules@kbiwkmcont.dll \systemroot\system32\kbiwkmrmphxlvr.dll
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr@start 1
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr@type 1
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr@group file system
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr@imagepath \systemroot\system32\drivers\kbiwkmqpltpuix.sys
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\main (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\main@aid 10200
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\main@sid 0
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\main@cmddelay 14400
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\main\delete (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\main\injector (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\main\injector@* kbiwkmwsp8.dll
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\main\injector@svchost.exe kbiwkmcont.dll
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\main\tasks (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules@kbiwkmrk.sys \systemroot\system32\drivers\kbiwkmqpltpuix.sys
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules@kbiwkmcmd.dll \systemroot\system32\kbiwkmetehxdpx.dll
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules@kbiwkmlog.dat \systemroot\system32\kbiwkmmowujnfo.dat
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules@kbiwkmwsp.dll \systemroot\system32\kbiwkmdpmwksvi.dll
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules@kbiwkm.dat \systemroot\system32\kbiwkmjxdldyur.dat
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules@kbiwkmwsp8.dll \systemroot\system32\kbiwkmowylvnsv.dll
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules@kbiwkmconz.dll \systemroot\system32\kbiwkmklrlxewc.dll
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules@kbiwkmwsp8p.dll \systemroot\system32\kbiwkmiwwutpts.dll
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules@kbiwkmconw.dll \systemroot\system32\kbiwkmewnijxmv.dll
Reg HKLM\SYSTEM\ControlSet005\Services\kbiwkmimovrobr\modules@kbiwkmcont.dll \systemroot\system32\kbiwkmrmphxlvr.dll

---- Files - GMER 1.0.15 ----

File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\ACE.dll 446464 bytes
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\agm.dll 1138688 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\bib.dll 147456 bytes
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\capserve.db 1542336 bytes
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\capserve.exe 1568882 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\capture3.ggx 2912 bytes
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Codecvt.dll 28160 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Configs 0 bytes
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\cooltype.dll 1441792 bytes
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Dbase 0 bytes
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\DbgHelp.Dll 163088 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Dictionaries 0 bytes
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Fioall.dll 270848 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\HA312W32.DLL 365568 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\ippocr32.dll 1856000 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Lnseg32.dll 261120 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Memio.dll 41984 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\nnxprt32.dll 115712 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Ocrutil.dll 29696 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\opp.dll 86016 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\pccrsdk.dll 98304 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\PDFL50.dll 2310144 bytes
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Post.dll 96256 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Recogn.dll 163840 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Recore32.dll 119808 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\rr_scr.dll 983040 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Segment.dll 329216 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\SHW32.DLL 112688 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\tuhand32.dll 81408 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\tuMach32.dll 81408 bytes executable
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\Wtim32.cfg 5034 bytes
File C:\Program Files\Fichiers communs\Apple\Mobile Device Support\SyncServices\Schemas\Notes.syncschema\Contents\Resources\Dutch.lproj\wtim32.dll 137216 bytes executable
File C:\Program Files\Symantec\ACADP10.AW 449973 bytes
File C:\Program Files\Symantec\ACJET10.AW 552795 bytes
File C:\Program Files\Symantec\ACMAIN10.AW 1199572 bytes
File C:\Program Files\Symantec\ACMAIN10.CHM 3645162 bytes
File C:\Program Files\Symantec\ACOW10.AW 208900 bytes
File C:\Program Files\Symantec\ACREAD10.HTM 42218 bytes
File C:\Program Files\Symantec\ACTIP10.HLP 230909 bytes
File C:\Program Files\Symantec\ACTOC10.CHM 209075 bytes
File C:\Program Files\Symantec\ACWIZRC.DLL 420576 bytes executable
File C:\Program Files\Symantec\ADO210.AW 553288 bytes
File C:\Program Files\Symantec\AV41206.FMT 1452 bytes
File C:\Program Files\Symantec\AV41256.FMT 1543 bytes
File C:\Program Files\Symantec\AV41307.FMT 1367 bytes
File C:\Program Files\Symantec\AV41357.FMT 1470 bytes
File C:\Program Files\Symantec\AVL7901.FMT 1560 bytes
File C:\Program Files\Symantec\AVL7902.FMT 1489 bytes
File C:\Program Files\Symantec\botstyle 0 bytes
File C:\Program Files\Symantec\CSDEBUG.CHM 130353 bytes
File C:\Program Files\Symantec\CSENVIR.CHM 385580 bytes
File C:\Program Files\Symantec\CUSTOMER.DBF 1107 bytes

---- EOF - GMER 1.0.15 ----

Une petite chose encore, j'ai été obligé de démarrer en mode sans échec parce que à l'ouverture de mon pc, un écran bleu avec un texte en blanc est apparu et, m'a bloqué le pc voici le début du contenu :
Suite à un problème technique,.....
driver_irql_not_less_or_equal

c'est quoi ce truc ?

Tu peux te connecter avec un autre ordi ? Je te conseille de déconnecter celui-ci d'internet.

Je continue sur tes rapports mais comme indiqué, il faut que mes réponses passent par un helper

A plus tard

Bonjour, je viens d'effectuer l'operation que tu m'as demandée voici le rapport : (je suis à nouveau en mode normal).

ComboFix 09-10-13.01 - Christophe Riqueau 14/10/2009 11:10.1.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.510.267 [GMT 2:00]
Lancé depuis: c:\documents and settings\Christophe Riqueau\Bureau\TCMIDN.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\documents and settings\All Users\Application Data\ezepocal.vbs
c:\documents and settings\All Users\Application Data\uzadoxasy.lib
c:\documents and settings\All Users\Application Data\webero._dl
c:\documents and settings\All Users\Documents\mojozacyda.pif
c:\documents and settings\All Users\Documents\nytomyka.vbs
c:\documents and settings\All Users\Documents\seqimav.com
c:\documents and settings\Christophe Riqueau\Application Data\junyjycyxo.vbs
c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\roqa.bat
c:\documents and settings\Christophe Riqueau\Local Settings\Temporary Internet Files\dicututy.lib
c:\documents and settings\Christophe Riqueau\Local Settings\Temporary Internet Files\eged.inf
c:\documents and settings\Christophe Riqueau\Local Settings\Temporary Internet Files\ipilusocu.dl
c:\documents and settings\Christophe Riqueau\ntuser.dll
c:\documents and settings\LocalService\ntuser.dll
c:\documents and settings\NetworkService\protect.dll
c:\program files\Fichiers communs\jukino.dl
c:\program files\Fichiers communs\jymytyda._sy
c:\program files\Fichiers communs\lanyxivym._sy
c:\program files\Fichiers communs\luxoromeg.ban
c:\windows\byviziwu.exe
c:\windows\elyxal.vbs
c:\windows\gilik.dll
c:\windows\Installer\WinRMSrv.msi
c:\windows\kylavofyso.reg
c:\windows\ocoza.exe
c:\windows\omuxi.reg
c:\windows\system32\a99k.bin
c:\windows\system32\api.dat
c:\windows\system32\calc.dll
c:\windows\system32\config\systemprofile\Bureau\AntivirusPro_2010.lnk
c:\windows\system32\config\systemprofile\ntuser.dll
c:\windows\system32\drivers\fad.sys
c:\windows\system32\drivers\kbiwkmqpltpuix.sys
c:\windows\system32\drivers\mrxdavv.sys
c:\windows\system32\emynovazos.reg
c:\windows\system32\kbiwkmdpmwksvi.dll
c:\windows\system32\kbiwkmetehxdpx.dll
c:\windows\system32\kbiwkmewnijxmv.dll
c:\windows\system32\kbiwkmiwwutpts.dll
c:\windows\system32\kbiwkmjxdldyur.dat
c:\windows\system32\kbiwkmklrlxewc.dll
c:\windows\system32\kbiwkmmowujnfo.dat
c:\windows\system32\kbiwkmowylvnsv.dll
c:\windows\system32\kbiwkmrmphxlvr.dll
c:\windows\system32\kwave.sys
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\lowsec\user.ds.lll
c:\windows\system32\open.ico
c:\windows\system32\zykuxelyty.vbs
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_kbiwkmimovrobr


((((((((((((((((((((((((((((( Fichiers créés du 2009-09-14 au 2009-10-14 ))))))))))))))))))))))))))))))))))))
.

2009-10-13 14:32 . 2009-10-13 14:32 155648 -c--a-w- C:\Diskrun.exe
2009-10-13 12:36 . 2009-10-13 12:36 -------- d-----w- c:\documents and settings\Christophe Riqueau\Application Data\Malwarebytes
2009-10-13 12:36 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-13 12:36 . 2009-10-13 12:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-13 12:36 . 2009-10-13 12:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-13 12:36 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-12 16:41 . 2009-10-12 16:41 -------- d-----w- c:\program files\Trend Micro
2009-10-12 14:04 . 2009-10-12 14:04 19927 ----a-w- c:\windows\system32\lyxyloca.com
2009-10-12 14:04 . 2009-10-12 14:04 18247 ----a-w- c:\windows\system32\uxudapyfa.dat
2009-10-12 14:04 . 2009-10-12 14:04 15514 ----a-w- c:\program files\Fichiers communs\uzune.dat
2009-09-30 14:15 . 2009-09-30 14:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-30 08:49 . 2008-10-16 12:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-09-30 08:49 . 2008-10-16 12:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-09-29 14:31 . 2009-09-29 15:47 -------- d-----w- c:\documents and settings\Christophe Riqueau\Tracing
2009-09-29 14:29 . 2009-09-29 14:29 -------- d-----w- c:\program files\Microsoft
2009-09-29 14:29 . 2009-09-29 14:29 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-29 14:28 . 2009-09-29 14:29 -------- d-----w- c:\program files\Windows Live
2009-09-29 10:15 . 2009-09-29 10:15 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-24 14:28 . 2009-09-24 14:28 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-09-23 10:36 . 2009-09-23 10:36 -------- d-----w- c:\windows\ServicePackFiles

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-13 12:32 . 2009-09-10 14:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-12 14:43 . 2005-04-26 14:01 -------- d-----w- c:\program files\Google
2009-09-29 14:31 . 2005-04-22 14:38 24664 ----a-w- c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-29 10:14 . 2005-04-08 18:10 -------- d-----w- c:\program files\Java
2009-09-23 15:49 . 2005-04-25 12:28 -------- d-----w- c:\documents and settings\Christophe Riqueau\Application Data\AdobeUM
2009-09-23 10:49 . 2004-08-19 12:03 447222 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-23 10:49 . 2004-08-19 12:03 64922 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-23 10:44 . 2009-09-07 17:17 16 ----a-w- c:\windows\pxydb.dat
2009-09-10 16:38 . 2005-04-27 08:27 -------- d-----w- c:\program files\Symantec
2009-09-10 16:32 . 2005-04-08 18:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-10 16:27 . 2005-04-27 08:47 -------- d-----w- c:\program files\Fichiers communs\First Virtual Communications
2009-09-10 14:42 . 2009-09-10 14:42 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-10 14:37 . 2009-09-10 14:37 19378 ----a-w- c:\windows\system32\iwavacuwa.scr
2009-09-10 14:37 . 2009-09-10 14:37 17874 ----a-w- c:\documents and settings\All Users\Application Data\umuvavigo.sys
2009-09-10 14:37 . 2009-09-10 14:37 17789 ----a-w- c:\windows\nolizub.dat
2009-09-10 14:37 . 2009-09-10 14:37 17683 ----a-w- c:\documents and settings\Christophe Riqueau\Application Data\forulyb.scr
2009-09-10 14:37 . 2009-09-10 14:37 16968 ----a-w- c:\documents and settings\All Users\Application Data\xohumeg.dat
2009-09-10 14:37 . 2009-09-10 14:37 15934 ----a-w- c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\azup.pif
2009-09-10 14:37 . 2009-09-10 14:37 13972 ----a-w- c:\program files\Fichiers communs\adaxyper.scr
2009-09-10 14:37 . 2009-09-10 14:37 10698 ----a-w- c:\documents and settings\All Users\Application Data\owujyvaba.exe
2009-09-10 14:37 . 2009-09-10 14:37 10665 ----a-w- c:\program files\Fichiers communs\abobug.sys
2009-09-10 14:17 . 2005-04-25 12:23 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-10 13:44 . 2009-09-10 13:44 19050 ----a-w- c:\program files\Fichiers communs\kuzytum.lib
2009-09-10 13:44 . 2009-09-10 13:44 16737 ----a-w- c:\program files\Fichiers communs\yzaripipew.dl
2009-09-10 13:44 . 2009-09-10 13:44 12110 ----a-w- c:\windows\juge.bin
2009-09-10 13:44 . 2009-09-10 13:44 16611 ----a-w- c:\program files\Fichiers communs\loja.dl
2009-09-10 13:44 . 2009-09-10 13:44 15854 ----a-w- c:\windows\anusu.bin
2009-09-10 13:44 . 2009-09-10 13:44 14879 ----a-w- c:\windows\wefom.dat
2009-09-10 13:44 . 2009-09-10 13:44 10101 ----a-w- c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\yqul.scr
2009-09-07 17:17 . 2009-09-07 17:17 8432 ----a-w- c:\windows\system32\rgadta.sys
2009-09-04 10:35 . 2009-08-30 15:35 -------- d-----w- c:\program files\eMule
2009-08-30 12:13 . 2009-08-30 11:55 -------- d-----w- c:\documents and settings\Christophe Riqueau\Application Data\Apple Computer
2009-08-30 11:54 . 2009-08-30 11:53 -------- d-----w- c:\program files\iTunes
2009-08-30 11:54 . 2009-08-30 11:53 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-30 11:54 . 2009-08-30 11:54 -------- d-----w- c:\program files\iPod
2009-08-30 11:54 . 2009-08-30 11:45 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-08-30 11:53 . 2005-12-02 16:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-08-30 11:49 . 2009-08-30 11:48 -------- d-----w- c:\program files\QuickTime
2009-08-30 11:46 . 2009-08-30 11:46 -------- d-----w- c:\program files\Apple Software Update
2009-08-30 11:45 . 2009-08-30 11:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-08-25 15:49 . 2009-08-25 15:49 -------- d-----w- c:\documents and settings\All Users\Application Data\espionServerData
2009-08-25 15:42 . 2009-08-25 15:42 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-08-25 13:05 . 2009-08-25 13:05 43528 ------w- c:\windows\system32\drivers\PxHelp20.sys
2009-08-05 09:06 . 2004-08-19 12:03 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:53 . 2004-08-19 12:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:53 . 2004-08-19 12:03 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-17 18:56 . 2004-08-19 12:03 58880 ----a-w- c:\windows\system32\atl.dll
2008-09-29 08:53 . 2005-04-26 14:01 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"Google Update"="c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-11 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"DVDSentry"="c:\windows\system32\DSentry.exe" [2002-07-17 28672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"vptray"="c:\program files\NavNT\vptray.exe" [2001-09-26 73728]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-29 29744]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\Christophe Riqueau\Menu D‚marrer\Programmes\D‚marrage\
ChkDisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]
Raccourci vers Maj_Nav.exe.lnk - c:\majnav\Maj_Nav.exe [2005-4-27 37376]
scandisk.dll [2009-10-12 25088]
scandisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]

c:\documents and settings\Christophe Riqueau\Menu D‚marrer\Programmes\D‚marrage\
ChkDisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]
Raccourci vers Maj_Nav.exe.lnk - c:\majnav\Maj_Nav.exe [2005-4-27 37376]
scandisk.dll [2009-10-12 25088]
scandisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]

c:\documents and settings\Christophe Riqueau\Menu D‚marrer\Programmes\D‚marrage\
ChkDisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]
Raccourci vers Maj_Nav.exe.lnk - c:\majnav\Maj_Nav.exe [2005-4-27 37376]
scandisk.dll [2009-10-12 25088]
scandisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Assistant d'Acrobat.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-24 217194]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-4-8 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

c:\documents and settings\Christophe Riqueau\Menu D‚marrer\Programmes\D‚marrage\
ChkDisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]
Raccourci vers Maj_Nav.exe.lnk - c:\majnav\Maj_Nav.exe [2005-4-27 37376]
scandisk.dll [2009-10-12 25088]
scandisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\MajNav\\Maj_Nav.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Maïdo Production\\IziSpot 4\\IziSpot.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 rgadta;RAM-DAC XGPU Controller;c:\windows\system32\rgadta.sys [07/09/2009 19:17 8432]
R3 GTICARD;GTICARD;c:\windows\system32\drivers\gticard.sys [08/04/2005 19:52 59328]
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe --> c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [?]
S2 fklsfuclfdxfpdk;fklsfuclfdxfpdk;\??\c:\windows\system32\drivers\ifnzglnsxesfn.sys --> c:\windows\system32\drivers\ifnzglnsxesfn.sys [?]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [26/04/2005 16:01 29744]
.
Contenu du dossier 'Tâches planifiées'

2009-09-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-10-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-488444937-3512558271-582709162-1005Core.job
- c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-11 09:56]

2009-10-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-488444937-3512558271-582709162-1005UA.job
- c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-11 09:56]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.dje.fr/
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = proxy.univ-tln.fr:3128
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
Trusted Zone: localhost
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {10ABC6DB-E091-4EAE-98DD-21B5A2460714} - hxxp://www.pandasoftware.es/avchecker/controles/AvDetInst.cab
DPF: {52A5CD24-64C6-4BAF-A4EC-4D13F451763F} - hxxp://visio.univ-tln.fr/ctmexpress/runtime/pic/inner_pic/packages/liveupdate.cab
FF - ProfilePath - c:\documents and settings\Christophe Riqueau\Application Data\Mozilla\Firefox\Profiles\qigal1xa.default\
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-http://www.lienvandekelder.be - \Lien Vande Kelder.exe
HKLM-Run-bascstray - BascsTray.exe
HKU-Default-Run-autochk - c:\docume~1\LOCALS~1\protect.dll
HKU-Default-Run-calc - c:\docume~1\LOCALS~1\ntuser.dll
Notify-rgadtm - rgadtm.dll
Notify-WgaLogon - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-14 11:20
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\kbiwkmimovrobr]
"imagepath"="\systemroot\system32\drivers\kbiwkmqpltpuix.sys"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\kbiwkmimovrobr]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\kbiwkmqpltpuix.sys"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\System32\BCMLogon.dll
c:\windows\system32\NavLogon.dll

- - - - - - - > 'explorer.exe'(3084)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\browselc.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\scardsvr.exe
c:\windows\system32\WLTRAY.EXE
c:\program files\Apoint\ApntEx.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\BAsfIpM.exe
c:\program files\NavNT\defwatch.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\NavNT\rtvscan.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\MSGSYS.EXE
c:\windows\system32\WLTRYSVC.EXE
.
**************************************************************************
.
Heure de fin: 2009-10-14 11:26 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-10-14 09:25

Avant-CF: 11 946 938 368 octets libres
Après-CF: 11 848 638 464 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,3,4,5
308 --- E O F --- 2009-10-02 13:46



Quel est la suite de programme merci pour le temps que tu m'accorde

bonjour, voici le second rapport de combofix :

ComboFix 09-10-14.09 - Christophe Riqueau 15/10/2009 12:35.2.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.510.193 [GMT 2:00]
Lancé depuis: c:\documents and settings\Christophe Riqueau\Bureau\TCMIDN.exe
Commutateurs utilisés :: c:\documents and settings\Christophe Riqueau\Bureau\CFScript.txt

FILE ::
"C:\Diskrun.exe"
"c:\documents and settings\All Users\Application Data\owujyvaba.exe"
"c:\documents and settings\All Users\Application Data\umuvavigo.sys"
"c:\documents and settings\All Users\Application Data\xohumeg.dat"
"c:\documents and settings\Christophe Riqueau\Application Data\forulyb.scr"
"c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\azup.pif"
"c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\yqul.scr"
"c:\documents and settings\Christophe Riqueau\Menu Démarrer\Programmes\Démarrage\ChkDisk.lnk"
"c:\documents and settings\Christophe Riqueau\Menu Démarrer\Programmes\Démarrage\scandisk.dll"
"c:\documents and settings\Christophe Riqueau\Menu Démarrer\Programmes\Démarrage\scandisk.ln"
"c:\program files\Fichiers communs\abobug.sys"
"c:\program files\Fichiers communs\adaxyper.scr"
"c:\program files\Fichiers communs\kuzytum.lib"
"c:\program files\Fichiers communs\loja.dl"
"c:\program files\Fichiers communs\uzune.dat"
"c:\program files\Fichiers communs\yzaripipew.dl"
"c:\system32\\drivers\\kbiwkmqpltpuix.sys"
"c:\windows\anusu.bin"
"c:\windows\juge.bin"
"c:\windows\nolizub.dat"
"c:\windows\pxydb.dat"
"c:\windows\system32\drivers\ifnzglnsxesfn.sys"
"c:\windows\system32\iwavacuwa.scr"
"c:\windows\system32\lyxyloca.com"
"c:\windows\system32\rgadta.sys"
"c:\windows\system32\uxudapyfa.dat"
"c:\windows\wefom.dat"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Diskrun.exe
c:\documents and settings\All Users\Application Data\espionServerData
c:\documents and settings\All Users\Application Data\espionServerData\globData.mk4
c:\documents and settings\All Users\Application Data\owujyvaba.exe
c:\documents and settings\All Users\Application Data\umuvavigo.sys
c:\documents and settings\All Users\Application Data\xohumeg.dat
c:\documents and settings\Christophe Riqueau\Application Data\forulyb.scr
c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\azup.pif
c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\yqul.scr
c:\documents and settings\Christophe Riqueau\Menu Démarrer\Programmes\Démarrage\ChkDisk.lnk
c:\documents and settings\Christophe Riqueau\Menu Démarrer\Programmes\Démarrage\scandisk.dll
c:\program files\Fichiers communs\abobug.sys
c:\program files\Fichiers communs\adaxyper.scr
c:\program files\Fichiers communs\kuzytum.lib
c:\program files\Fichiers communs\loja.dl
c:\program files\Fichiers communs\uzune.dat
c:\program files\Fichiers communs\yzaripipew.dl
c:\windows\anusu.bin
c:\windows\juge.bin
c:\windows\nolizub.dat
c:\windows\pxydb.dat
c:\windows\system32\drivers\mrxdavv.sys
c:\windows\system32\iwavacuwa.scr
c:\windows\system32\kwave.sys
c:\windows\system32\lyxyloca.com
c:\windows\system32\rgadta.sys
c:\windows\system32\uxudapyfa.dat
c:\windows\wefom.dat

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FKLSFUCLFDXFPDK
-------\Legacy_kbiwkmimovrobr
-------\Legacy_RGADTA
-------\Service_fklsfuclfdxfpdk
-------\Service_rgadta


((((((((((((((((((((((((((((( Fichiers créés du 2009-09-15 au 2009-10-15 ))))))))))))))))))))))))))))))))))))
.

2009-10-13 12:36 . 2009-10-13 12:36 -------- d-----w- c:\documents and settings\Christophe Riqueau\Application Data\Malwarebytes
2009-10-13 12:36 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-13 12:36 . 2009-10-13 12:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-13 12:36 . 2009-10-13 12:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-13 12:36 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-12 16:41 . 2009-10-12 16:41 -------- d-----w- c:\program files\Trend Micro
2009-09-30 14:15 . 2009-09-30 14:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-30 08:49 . 2008-10-16 12:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-09-30 08:49 . 2008-10-16 12:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-09-29 14:31 . 2009-09-29 15:47 -------- d-----w- c:\documents and settings\Christophe Riqueau\Tracing
2009-09-29 14:29 . 2009-09-29 14:29 -------- d-----w- c:\program files\Microsoft
2009-09-29 14:29 . 2009-09-29 14:29 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-29 14:28 . 2009-09-29 14:29 -------- d-----w- c:\program files\Windows Live
2009-09-29 10:15 . 2009-09-29 10:15 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-24 14:28 . 2009-09-24 14:28 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-09-23 10:36 . 2009-09-23 10:36 -------- d-----w- c:\windows\ServicePackFiles

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-13 12:32 . 2009-09-10 14:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-12 14:43 . 2005-04-26 14:01 -------- d-----w- c:\program files\Google
2009-09-29 14:31 . 2005-04-22 14:38 24664 ----a-w- c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-29 10:14 . 2005-04-08 18:10 -------- d-----w- c:\program files\Java
2009-09-23 15:49 . 2005-04-25 12:28 -------- d-----w- c:\documents and settings\Christophe Riqueau\Application Data\AdobeUM
2009-09-23 10:49 . 2004-08-19 12:03 447222 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-23 10:49 . 2004-08-19 12:03 64922 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-10 16:38 . 2005-04-27 08:27 -------- d-----w- c:\program files\Symantec
2009-09-10 16:32 . 2005-04-08 18:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-10 16:27 . 2005-04-27 08:47 -------- d-----w- c:\program files\Fichiers communs\First Virtual Communications
2009-09-10 14:42 . 2009-09-10 14:42 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-10 14:17 . 2005-04-25 12:23 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-04 10:35 . 2009-08-30 15:35 -------- d-----w- c:\program files\eMule
2009-08-30 12:13 . 2009-08-30 11:55 -------- d-----w- c:\documents and settings\Christophe Riqueau\Application Data\Apple Computer
2009-08-30 11:54 . 2009-08-30 11:53 -------- d-----w- c:\program files\iTunes
2009-08-30 11:54 . 2009-08-30 11:53 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-30 11:54 . 2009-08-30 11:54 -------- d-----w- c:\program files\iPod
2009-08-30 11:54 . 2009-08-30 11:45 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-08-30 11:53 . 2005-12-02 16:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-08-30 11:49 . 2009-08-30 11:48 -------- d-----w- c:\program files\QuickTime
2009-08-30 11:46 . 2009-08-30 11:46 -------- d-----w- c:\program files\Apple Software Update
2009-08-30 11:45 . 2009-08-30 11:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-08-25 15:42 . 2009-08-25 15:42 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-08-25 13:05 . 2009-08-25 13:05 43528 ------w- c:\windows\system32\drivers\PxHelp20.sys
2009-08-05 09:06 . 2004-08-19 12:03 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:53 . 2004-08-19 12:03 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:53 . 2004-08-19 12:03 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-17 18:56 . 2004-08-19 12:03 58880 ----a-w- c:\windows\system32\atl.dll
2008-09-29 08:53 . 2005-04-26 14:01 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\MajNav ----

2005-04-27 08:29 . 1998-06-18 01:00 252408 ----a-w- c:\majnav\vclx40.bpl
2005-04-27 08:29 . 1999-01-07 03:02 1888232 ----a-w- c:\majnav\vcl40.bpl
2005-04-27 08:29 . 1998-10-22 01:01 237056 ----a-w- c:\majnav\nmfast40.bpl
2005-04-27 08:29 . 2003-03-13 13:17 37376 ----a-w- c:\majnav\Maj_Nav.exe
2005-04-27 08:29 . 2009-10-15 10:23 69 ----a-w- c:\majnav\data.ini
2005-04-27 08:29 . 1999-03-03 03:00 908800 ----a-w- c:\majnav\cp3245mt.dll
2005-04-27 08:29 . 1999-03-03 03:00 24064 ----a-w- c:\majnav\borlndmm.dll


((((((((((((((((((((((((((((( SnapShot@2009-10-14_09.20.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-15 10:43 . 2009-10-15 10:43 16384 c:\windows\temp\Perflib_Perfdata_2c0.dat
+ 2009-03-10 20:18 . 2009-03-10 20:18 970120 c:\windows\system32\WgaTray.exe
+ 2009-03-10 20:18 . 2009-03-10 20:18 265088 c:\windows\system32\WgaLogon.dll
+ 2009-03-10 20:18 . 2009-03-10 20:18 970120 c:\windows\system32\dllcache\WgaTray.exe
+ 2009-03-10 20:18 . 2009-03-10 20:18 265088 c:\windows\system32\dllcache\wgaLogon.dll
+ 2009-03-10 20:18 . 2009-03-10 20:18 1482112 c:\windows\system32\LegitCheckControl.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"Google Update"="c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-11 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"DVDSentry"="c:\windows\system32\DSentry.exe" [2002-07-17 28672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"vptray"="c:\program files\NavNT\vptray.exe" [2001-09-26 73728]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-29 29744]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\Christophe Riqueau\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers Maj_Nav.exe.lnk - c:\majnav\Maj_Nav.exe [2005-4-27 37376]
scandisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]

c:\documents and settings\Christophe Riqueau\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers Maj_Nav.exe.lnk - c:\majnav\Maj_Nav.exe [2005-4-27 37376]
scandisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]

c:\documents and settings\Christophe Riqueau\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers Maj_Nav.exe.lnk - c:\majnav\Maj_Nav.exe [2005-4-27 37376]
scandisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Assistant d'Acrobat.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-24 217194]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-4-8 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

c:\documents and settings\Christophe Riqueau\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers Maj_Nav.exe.lnk - c:\majnav\Maj_Nav.exe [2005-4-27 37376]
scandisk.lnk - c:\windows\system32\rundll32.exe [2004-8-19 33792]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\MajNav\\Maj_Nav.exe"=
"c:\\Program Files\\Maïdo Production\\IziSpot 4\\IziSpot.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 GTICARD;GTICARD;c:\windows\system32\drivers\gticard.sys [08/04/2005 19:52 59328]
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe --> c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [?]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [26/04/2005 16:01 29744]
.
Contenu du dossier 'Tâches planifiées'

2009-09-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-10-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-488444937-3512558271-582709162-1005Core.job
- c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-11 09:56]

2009-10-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-488444937-3512558271-582709162-1005UA.job
- c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-11 09:56]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.dje.fr/
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = proxy.univ-tln.fr:3128
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
Trusted Zone: localhost
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {10ABC6DB-E091-4EAE-98DD-21B5A2460714} - hxxp://www.pandasoftware.es/avchecker/controles/AvDetInst.cab
DPF: {52A5CD24-64C6-4BAF-A4EC-4D13F451763F} - hxxp://visio.univ-tln.fr/ctmexpress/runtime/pic/inner_pic/packages/liveupdate.cab
FF - ProfilePath - c:\documents and settings\Christophe Riqueau\Application Data\Mozilla\Firefox\Profiles\qigal1xa.default\
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\documents and settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-15 12:43
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\System32\BCMLogon.dll
c:\windows\system32\NavLogon.dll

- - - - - - - > 'explorer.exe'(3852)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\scardsvr.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\BAsfIpM.exe
c:\program files\NavNT\defwatch.exe
c:\windows\system32\WLTRAY.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Apoint\ApntEx.exe
c:\program files\NavNT\rtvscan.exe
c:\windows\system32\wscntfy.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\MSGSYS.EXE
.
**************************************************************************
.
Heure de fin: 2009-10-15 12:50 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-10-15 10:49
ComboFix2.txt 2009-10-14 09:26

Avant-CF: 11 664 011 264 octets libres
Après-CF: 11 630 858 240 octets libres

Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,3,4,5
264 --- E O F --- 2009-10-14 15:33

voici le rapport de la troisième étape :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2967
Windows 5.1.2600 Service Pack 2

15/10/2009 14:46:34
mbam-log-2009-10-15 (14-46-34).txt

Type de recherche: Examen rapide
Eléments examinés: 102700
Temps écoulé: 9 minute(s), 22 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\config\SystemProfile\Application Data\seres.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Christophe Riqueau\Menu Démarrer\Programmes\Démarrage\scandisk.lnk (Trojan.Downloader) -> Quarantined and deleted successfully.

HELLO, snif je n'ai pas eu de reponse aujourd'hui...

hello voici le rapport demandé....à bientôt .... dis moi, c'est si grave docteur ? il va guerir mon ordi ? merci bon WE...

All processes killed
========== SERVICES/DRIVERS ==========
Service\Driver kbiwkmimovrobr not found.
Service\Driver kbiwkmimovrobr not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kbiwkmimovrobr\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\kbiwkmimovrobr\ deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Christophe Riqueau
->Temp folder emptied: 234533 bytes
->Temporary Internet Files folder emptied: 42266562 bytes
->Java cache emptied: 31408570 bytes
->FireFox cache emptied: 38333121 bytes
->Google Chrome cache emptied: 97089953 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
Windows Temp folder emptied: 2496526 bytes
RecycleBin emptied: 331264 bytes

Total Files Cleaned = 202,43 mb


OTM by OldTimer - Version 3.0.0.6 log created on 10172009_125040

Files moved on Reboot...

Registry entries deleted on Reboot...

Moi aussi

Re Dje,


1 - Nettoyage
Télécharge Ccleaner sur ton Bureau.

• Clique sur "download the latest version"
• Installe-le en laissant seulement les options suivantes cochées :

- Ajouter un raccourci sur le Bureau
- Contrôler automatiquement les mises à jour de CCleaner

• Lance le Nettoyage
• Clique sur Chercher des erreurs et sauvegarde.

Aide : Comment utiliser CCleaner.



2 - Mises à jour
A - Adobe
Attention ! Adobe peut présenter des failles de sécurité critiques s'il n'est pas à jour (Lis au moins la conclusion de cet article )
Tu as la version 6.0, la dernière est la... 9.2 !!
Télécharge la à cette adresse et installe la.

B - Antivirus & Anti-Spyware
Je vois que tu as opté pour Norton... Est-ce la version 2009 au moins ? Et les mises à jour automatiques se font bien ?

Je m'interrogeais aussi sur des updates Mac Affee que j'avais cru voir dans un des premiers rapports ; tu as eu Mac Affee et l'as désinstallé pour Norton ? Ou... ?

Spybot... Mouais... On en reparlera à la fin si tu veux ; si tu souhaites changer par exemple ...
Et on évoquera aussi la question du parefeu à ce moment, mais c'est prématuré.



3 - Contrôle

A - Malwarebyte's Anti-Mawares

• Relance MBAM et met le de nouveau à jour
• Exécute un examen rapide cette fois
• S'il a -encore- trouvé quelques restes, clique sur "Afficher les résultats" puis sur "Supprimer la sélection"
• Si non, clique sur Ok
• Enregistre le rapport et poste le dans ta prochaine réponse

B - Sécurity Check
Télécharge Security Check de screen317 et sauvegarde-le sur ton Bureau.

• Double-clic sur Security Check.exe (l'extension peut ne pas apparaitre)
• Suis les instructions données à l'écran.
• Le rapport sera ouvert dans notepad : checkup.txt : poste le dans ta prochaine réponse.[/list]

Après tout cela : comment se comporte ton PC ?

J'y suis...

Un doute sur quoi ?

coucou, et voila je viens de redémarrer mon ordi, allumage normal, tout à l'air bien serait -il complètement guéri?

Oui ! Patiente un peu stp, il reste quelques manips à faire

hello, voici le rapport de kaspersky et hijackthis.
Je serai absent à partir de jeudi après midi pour 2 semaines je peux encore faire la dernière étape aujourd'hui ou demain matin. Je te confirme la bonne conduite de mon ordi.

KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, October 21, 2009
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, October 20, 2009 16:24:49
Records in database: 3038365
Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes
Scan area My Computer
C:\
D:\
Scan statistics
Objects scanned 54966
Threats found 18
Infected objects found 114
Suspicious objects found 0
Scan duration 02:33:35

File name Threat Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\00AC0000.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\00AC0001.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\00AC0002.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\00D40000.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\00D40001.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\00D40002.VBN Infected: Trojan.Win32.Agent.cpta 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\00D40003.VBN Infected: Trojan.Win32.Agent.cpta 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\00D40004.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\00D40009.VBN Infected: Trojan-Spy.Win32.Blaxblax.cb 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\00D4000A.VBN Infected: Trojan-Spy.Win32.Blaxblax.cb 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01E40000.VBN Infected: Trojan-Dropper.Win32.FrauDrop.ahe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01E40001.VBN Infected: Trojan-Dropper.Win32.FrauDrop.ahe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\02680000.VBN Infected: Trojan-Downloader.Win32.FraudLoad.fkv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\02680001.VBN Infected: Trojan-Downloader.Win32.FraudLoad.fkv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05840000.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05840001.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05840002.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06700000.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06700001.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06700002.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06700003.VBN Infected: Trojan.Win32.Vilsel.fat 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06700004.VBN Infected: Trojan.Win32.Vilsel.fat 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A40000.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A40001.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A40002.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A40003.VBN Infected: Trojan-Spy.Win32.Goldun.ctu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\09EC0000.VBN Infected: P2P-Worm.Win32.Kapucen.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0A6C0000.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0A6C0001.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0A6C0002.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0A6C0003.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0BAC0000.VBN Infected: Worm.VBS.Solow.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0BCC0000.VBN Infected: Worm.VBS.Solow.b 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CB40000.VBN Infected: Trojan.Win32.Vilsel.py 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CB40001.VBN Infected: Trojan.Win32.Vilsel.py 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CB40002.VBN Infected: Backdoor.Win32.Small.ejx 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CB40003.VBN Infected: Backdoor.Win32.Small.ejx 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CB40004.VBN Infected: Trojan.Win32.Vilsel.py 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CB40005.VBN Infected: Trojan.Win32.Vilsel.py 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CB40006.VBN Infected: Backdoor.Win32.Small.ejx 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CB40007.VBN Infected: Backdoor.Win32.Small.ejx 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E100000.VBN Infected: Trojan-Downloader.Win32.FraudLoad.fkv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E100001.VBN Infected: Trojan-Downloader.Win32.FraudLoad.fkv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E100002.VBN Infected: Trojan.Win32.Vilsel.py 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E100003.VBN Infected: Trojan.Win32.Vilsel.py 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E100004.VBN Infected: Backdoor.Win32.Small.ejx 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E100005.VBN Infected: Backdoor.Win32.Small.ejx 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E100006.VBN Infected: Trojan-Downloader.Win32.FraudLoad.fkv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E100007.VBN Infected: Trojan-Downloader.Win32.FraudLoad.fkv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E100008.VBN Infected: Backdoor.Win32.Small.ejx 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E100009.VBN Infected: Backdoor.Win32.Small.ejx 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E10000A.VBN Infected: Backdoor.Win32.UltimateDefender.igv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E10000B.VBN Infected: Backdoor.Win32.UltimateDefender.igv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E10000C.VBN Infected: Trojan-Downloader.Win32.FraudLoad.fkv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E10000D.VBN Infected: Trojan-Downloader.Win32.FraudLoad.fkv 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E10000E.VBN Infected: Trojan.Win32.Scar.uxo 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E10000F.VBN Infected: Trojan.Win32.Scar.uxo 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E340000.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E340001.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E340002.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0E340003.VBN Infected: Trojan-Spy.Win32.Goldun.ctu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EA00000.VBN Infected: Packed.Win32.TDSS.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EA00001.VBN Infected: Packed.Win32.TDSS.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EA80000.VBN Infected: Packed.Win32.TDSS.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EAC0000.VBN Infected: Packed.Win32.TDSS.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EB80000.VBN Infected: Trojan-Dropper.Win32.FrauDrop.ahe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EBC0000.VBN Infected: Packed.Win32.TDSS.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EBC0001.VBN Infected: Packed.Win32.TDSS.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EC00000.VBN Infected: Packed.Win32.TDSS.z 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0FE80000.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0FE80001.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0FE80002.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0FE80003.VBN Infected: Trojan-Spy.Win32.Goldun.ctu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000000.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000001.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000002.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000003.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000004.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000005.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000006.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000007.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000008.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000009.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\1300000A.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\1300000B.VBN Infected: Rootkit.Win32.Agent.rsp 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\1300000C.VBN Infected: Rootkit.Win32.Agent.rsp 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\1300000D.VBN Infected: Trojan-Spy.Win32.Goldun.ctu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\1300000E.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\1300000F.VBN Infected: Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000010.VBN Error Resource :getAppletResource('kosp.report.infected')Trojan-Downloader.Win32.Genome.lkz 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\13000011.VBN Error Resource :getAppletResource('kosp.report.infected')Trojan-Downloader.Win32.Genome.lkz 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\15CC0000.VBN Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\15CC0001.VBN Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.heh 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\15CC0002.VBN Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.heh 1
C:\Program Files\eMule\Incoming\pr.exe Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.VB.wyp 1
C:\Qoobox\Quarantine\C\Diskrun.exe.vir Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.VB.wyp 1
C:\Qoobox\Quarantine\C\Documents and Settings\Christophe Riqueau\Menu Démarrer\Programmes\Démarrage\scandisk.dll.vir Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
C:\Qoobox\Quarantine\C\Documents and Settings\Christophe Riqueau\ntuser.dll.vir Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
C:\Qoobox\Quarantine\C\Documents and Settings\LocalService\ntuser.dll.vir Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\calc.dll.vir Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\config\systemprofile\ntuser.dll.vir Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\kbiwkmqpltpuix.sys.vir Error Resource :getAppletResource('kosp.report.infected')Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmrmphxlvr.dll.vir Error Resource :getAppletResource('kosp.report.infected')Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\[4]-Submit_2009-10-15_12.35.17.zip Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.VB.wyp 1
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP600\A0077356.sys Error Resource :getAppletResource('kosp.report.infected')Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP600\A0077386.dll Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP600\A0077387.dll Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP600\A0077396.dll Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP600\A0077398.dll Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP600\A0077407.dll Error Resource :getAppletResource('kosp.report.infected')Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP602\A0077657.exe Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.VB.wyp 1
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP602\A0077664.dll Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\scandisk.dll Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.Scar.acbo 1
D:\Diskrun.exe Error Resource :getAppletResource('kosp.report.infected')Trojan.Win32.VB.wyp 1
Error Resource :getAppletResource('kosp.report.scan_complete')


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:07:02, on 21/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\DSentry.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Christophe Riqueau\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Christophe Riqueau\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Christophe Riqueau\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Christophe Riqueau\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dje.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.univ-tln.fr:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\system32\DSentry.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Christophe Riqueau\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Raccourci vers Maj_Nav.exe.lnk = C:\MajNav\Maj_Nav.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Raccourci vers Maj_Nav.exe.lnk = C:\MajNav\Maj_Nav.exe (User 'Default user')
O4 - Startup: Raccourci vers Maj_Nav.exe.lnk = C:\MajNav\Maj_Nav.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://dida.univ-tln.fr/qp2.cab
O16 - DPF: {10ABC6DB-E091-4EAE-98DD-21B5A2460714} (DetInstaller Class) - http://www.pandasoftware.es/avchec [...] etInst.cab
O16 - DPF: {52A5CD24-64C6-4BAF-A4EC-4D13F451763F} (CU LiveUpdate Control) - http://visio.univ-tln.fr/ctmexpres [...] update.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - https://mysupport.nai.com/amiuptoda [...] Portal.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft. [...] 4419274926
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9FEFBE8-0D0B-4AAA-BE19-9E2AE67080E0}: Domain = univ-tln.fr
O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.3 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 7724 bytes



à bientôt djé

Hello Dje,

Tout va bien avec ton pc ?