Virus: TR/crypt.xpack.gen =>rapport hijackthi

merci je me lance dans ces opérations.

je scan avec malware? c'est ça?

ah bah je croyais être tranquille, je n'avais plus de message d'antivir :( et j'ai pu activer les mises à jour du centre de sécurité (qui étaient bloquées) :-((

alors déjà quand j'allume l'ordi j'ai le message suivant: "RUNDLL : erreur de chargement de C:\WINDOWS\system32\njaiawuo.dll le module spécifié est introuvable

ensuite voici le rapport combofix

ComboFix 09-01-18.05 - SolennL 2009-01-19 10:44:30.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2046.1603 [GMT -5:00]
Lancé depuis: c:\program files\ComboFix2.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Exécution préalable -------
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\Downloaded Program Files\setup.inf
c:\windows\system32\ouwaiajn.ini
c:\windows\system32\rmjoajmj.ini
c:\windows\Tasks\wecjvdjf.job
c:\windows\Temp\tmp3.tmp
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_seneka

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-19 au 2009-01-19 ))))))))))))))))))))))))))))))))))))
.

2009-01-19 10:21 . 2009-01-19 10:19 3,043,099 -ra------ c:\program files\ComboFix2.exe
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\documents and settings\SolennL\Application Data\Malwarebytes
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-18 16:06 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-18 16:06 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-18 13:58 . 2009-01-18 13:58 401,720 --a------ c:\program files\HiJackThis.exe
2009-01-18 10:03 . 2009-01-18 10:03 <REP> d-------- c:\windows\system32\Kaspersky Lab
2009-01-17 13:23 . 2009-01-17 13:23 <REP> d--hs---- c:\documents and settings\LocalService\Temporary Internet Files
2009-01-17 13:23 . 2009-01-17 13:23 <REP> d--hs---- c:\documents and settings\LocalService\Historique
2009-01-17 13:21 . 2009-01-17 13:21 <REP> d-------- c:\program files\Avira
2009-01-17 13:21 . 2009-01-17 13:21 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-01-17 12:03 . 2009-01-17 12:03 399,360 --a------ c:\windows\system32\dllcache\rpcss.dll
2009-01-17 12:01 . 2009-01-17 12:01 <REP> d-------- c:\program files\Panda Security
2009-01-17 12:01 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-01-17 10:57 . 2009-01-18 13:31 <REP> d-------- c:\program files\CrossLoop
2009-01-17 10:55 . 2009-01-17 10:55 <REP> d-------- c:\program files\Spybot - Search & Destroy
2009-01-13 17:53 . 2009-01-13 17:53 <REP> d-------- c:\program files\LedPC Application
2009-01-10 18:58 . 2009-01-10 18:59 <REP> d-------- c:\documents and settings\SolennL\Application Data\Move Networks
2009-01-08 21:37 . 2003-12-12 16:06 1,693,696 --a------ c:\windows\system32\ltclr13n.dll
2009-01-08 21:37 . 2003-11-04 15:11 155,648 --a------ c:\windows\system32\lftif13n.dll
2009-01-08 21:37 . 2003-11-04 15:10 98,304 --a------ c:\windows\system32\lffax13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 462,848 --a------ c:\windows\system32\ltkrn13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 450,560 --a------ c:\windows\system32\ltimg13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 401,408 --a------ c:\windows\system32\lfcmp13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 299,008 --a------ c:\windows\system32\ltdis13n.dll
2009-01-08 21:36 . 2004-01-12 02:09 206,336 --a------ c:\windows\system32\ltefx13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 163,840 --a------ c:\windows\system32\ltfil13n.dll
2009-01-08 21:36 . 2003-11-04 15:10 69,632 --a------ c:\windows\system32\lfgif13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 57,344 --a------ c:\windows\system32\lfbmp13n.dll
2009-01-05 13:13 . 2009-01-05 13:13 <REP> d-------- c:\documents and settings\Administrator
2009-01-05 10:21 . 2009-01-05 10:21 <REP> d-------- c:\program files\Uniblue
2009-01-05 10:21 . 2009-01-05 10:21 <REP> d-------- c:\documents and settings\SolennL\Application Data\Uniblue
2009-01-05 10:21 . 2009-01-15 22:04 <REP> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-01-05 10:18 . 2009-01-05 10:21 <REP> d--h-c--- c:\documents and settings\All Users\Application Data\{148D8B8A-8F96-4822-81EC-D510B626B7D5}
2009-01-05 10:16 . 2008-07-04 01:34 860,160 --a------ c:\windows\system32\lameACM.acm
2009-01-05 10:16 . 2007-09-20 19:52 118,784 --a------ c:\windows\system32\ac3acm.acm
2009-01-05 10:16 . 2007-10-03 10:03 414 --a------ c:\windows\system32\lame_acm.xml
2009-01-05 10:07 . 2009-01-05 10:08 <REP> d-------- C:\b5e2808e51682d5a7841c69aa526
2009-01-05 09:36 . 2009-01-05 09:36 <REP> d-------- c:\windows\Downloaded Installations
2009-01-05 09:07 . 2009-01-05 10:16 <REP> d-------- c:\program files\K-Lite Codec Pack
2009-01-05 09:06 . 2009-01-05 09:06 <REP> d-------- c:\program files\CCleaner
2009-01-05 09:06 . 2009-01-05 09:06 <REP> d-------- c:\documents and settings\SolennL\Application Data\Yahoo!
2009-01-05 07:01 . 2009-01-05 07:01 <REP> d-------- c:\program files\Citrix
2009-01-04 16:13 . 2009-01-17 11:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-04 16:07 . 2009-01-05 09:07 <REP> d-------- c:\program files\K-Lite Codec Pack(2)
2009-01-04 15:28 . 2009-01-05 10:07 <REP> d-------- c:\windows\system32\drivers\UMDF
2009-01-04 15:19 . 2009-01-04 15:19 <REP> d-------- c:\documents and settings\SolennL\Application Data\Media Player Classic
2009-01-04 15:16 . 2008-05-22 17:22 3,596,288 --a------ c:\windows\system32\qt-dx331.dll
2009-01-04 15:16 . 2008-01-10 07:15 755,027 --a------ c:\windows\system32\xvidcore.dll
2009-01-04 15:16 . 2008-05-30 18:22 683,520 --a------ c:\windows\system32\divx.dll
2009-01-04 15:16 . 2004-01-25 11:18 217,088 --a------ c:\windows\system32\yv12vfw.dll
2009-01-04 15:16 . 2008-09-16 14:23 168,448 --a------ c:\windows\system32\unrar.dll
2009-01-04 15:16 . 2008-01-10 07:16 159,839 --a------ c:\windows\system32\xvidvfw.dll
2009-01-04 15:16 . 2008-05-22 17:19 81,920 --a------ c:\windows\system32\dpl100.dll
2009-01-04 15:16 . 2008-06-12 13:36 7,680 --a------ c:\windows\system32\ff_vfw.dll
2009-01-04 15:16 . 2007-07-10 11:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-01-04 15:09 . 2009-01-05 09:32 <REP> d-------- c:\program files\Yahoo!
2008-12-29 10:36 . 2008-12-29 10:36 <REP> d--hs---- c:\documents and settings\NetworkService\Temporary Internet Files
2008-12-29 10:36 . 2008-12-29 10:36 <REP> d--hs---- c:\documents and settings\NetworkService\Historique
2008-12-27 10:10 . 2008-12-27 10:10 <REP> d-------- c:\documents and settings\SolennL\Application Data\AdobeUM
2008-12-26 13:21 . 2008-12-26 13:21 <REP> d-------- c:\windows\Sun
2008-12-26 13:18 . 2008-12-26 13:18 <REP> d-------- c:\program files\iPod
2008-12-26 13:18 . 2008-12-26 13:18 <REP> d-------- c:\documents and settings\SolennL\Application Data\Apple Computer
2008-12-26 13:18 . 2008-04-17 07:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-12-26 13:18 . 2008-04-17 07:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-12-26 13:17 . 2008-12-26 13:17 <REP> d-------- c:\program files\QuickTime
2008-12-26 13:17 . 2008-12-26 13:18 <REP> d-------- c:\program files\iTunes
2008-12-26 13:17 . 2008-12-26 13:17 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-26 13:17 . 2008-12-26 13:18 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-26 13:16 . 2008-12-26 13:18 <REP> d-------- c:\program files\Fichiers communs\Apple
2008-12-26 13:16 . 2008-12-26 13:16 <REP> d-------- c:\program files\Apple Software Update
2008-12-26 13:16 . 2008-12-26 13:16 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-12-26 13:16 . 2008-11-07 08:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys
2008-12-25 10:24 . 2009-01-14 11:17 <REP> d-------- c:\program files\eMule
2008-12-22 09:16 . 2009-01-05 10:07 <REP> d-------- c:\windows\system32\LogFiles
2008-12-20 12:13 . 2008-12-20 12:13 <REP> d-------- c:\documents and settings\All Users\Application Data\Zylom
2008-12-20 11:54 . 2008-12-20 12:08 <REP> d-------- c:\documents and settings\SolennL\Contacts
2008-12-20 11:47 . 2008-12-20 11:47 <REP> d-------- c:\program files\Windows Live
2008-12-20 11:46 . 2008-04-13 13:45 26,368 --a------ c:\windows\system32\dllcache\usbstor.sys
2008-12-20 11:14 . 2008-12-20 11:14 <REP> d-------- c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-20 10:34 . 2008-12-20 10:46 <REP> d-------- c:\documents and settings\SolennL\Application Data\MSNInstaller
2008-12-20 10:04 . 2008-12-20 10:04 <REP> d-------- c:\program files\Microsoft Sync Framework
2008-12-20 09:27 . 2008-12-20 09:27 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition
2008-12-19 16:32 . 2008-12-19 16:32 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-19 16:32 . 2008-12-19 16:32 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-19 16:12 . 2008-12-19 16:12 <REP> d-------- c:\windows\system32\fr
2008-12-19 16:12 . 2008-12-19 16:12 <REP> d-------- c:\windows\system32\bits
2008-12-19 16:12 . 2008-12-19 16:12 <REP> d-------- c:\windows\l2schemas
2008-12-19 16:11 . 2008-12-19 16:12 <REP> d-------- c:\windows\ServicePackFiles
2008-12-19 15:59 . 2008-12-19 15:59 <REP> d-------- c:\documents and settings\SolennL\Mes documents
2008-12-19 15:51 . 2008-12-19 15:51 <REP> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-19 15:47 . 2006-10-26 13:58 30,512 --a------ c:\windows\system32\mdimon.dll
2008-12-19 15:45 . 2008-12-19 15:45 <REP> d-------- c:\program files\Microsoft.NET
2008-12-19 15:43 . 2008-12-19 15:43 <REP> dr-h----- C:\MSOCache
2008-12-19 15:06 . 2008-12-19 15:06 <REP> d-------- c:\documents and settings\SolennL\Application Data\Otto
2008-12-19 15:06 . 2008-12-19 15:06 <REP> d-------- c:\documents and settings\All Users\Application Data\Otto
2008-12-19 14:56 . 2008-12-19 15:44 <REP> d-------- c:\documents and settings\SolennL\Application Data\HP
2008-12-19 05:00 . 2008-10-16 08:06 268,648 --a------ c:\windows\system32\mucltui.dll
2008-12-19 05:00 . 2008-10-16 08:06 208,744 --a------ c:\windows\system32\muweb.dll
2008-12-19 05:00 . 2008-10-16 08:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-19 15:41 --------- d-----w c:\documents and settings\SolennL\Application Data\Skype
2009-01-19 14:53 --------- d-----w c:\documents and settings\SolennL\Application Data\skypePM
2009-01-18 23:02 11,742 ----a-w c:\program files\hijackthis.log
2009-01-16 03:00 --------- d-----w c:\program files\GemMasterFrench
2009-01-15 15:17 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-05 15:31 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-01-05 15:08 --------- d-----w c:\program files\Windows Media Connect 2
2008-12-20 15:05 --------- d-----w c:\program files\Microsoft
2008-12-19 21:31 --------- d-----w c:\program files\Java
2008-12-19 21:03 --------- d-----w c:\program files\Microsoft Works
2008-12-18 19:26 --------- d-----w c:\program files\Skype
2008-12-18 19:26 --------- d-----w c:\program files\Fichiers communs\Skype
2008-12-18 19:26 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-18 18:48 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-18 17:56 --------- d-----w c:\program files\MSXML 4.0
2008-12-18 12:24 --------- d-----w c:\program files\Alwil Software
2008-12-18 12:14 --------- d-----w c:\documents and settings\SolennL\Application Data\Sonic
2008-12-18 12:13 --------- d-----w c:\documents and settings\SolennL\Application Data\Leadertech
2008-12-18 12:10 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-12-18 12:10 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-18 05:52 1,741 --sha-r c:\windows\system32\drivers\103C_HP_NTBK_HP Pavilion dv6000 (RR371EA#ABF)_YN_0Pavi_QCNF64527ZH_E419857053_46_I30BC_SQuanta_V66.21_BF.08_T061106_WXP2_L40C_M2047_J120_7Intel_8Core2 T5500_91.66_#061029_N8086109A_(RR371EA#ABF)_XMOBILE_CN10_Z.MRK
2008-12-18 05:46 --------- d-----w c:\program files\HPQ
2008-12-18 04:24 --------- d-----w c:\program files\Windows Plus
2008-12-18 04:24 --------- d-----w c:\program files\Synaptics
2008-12-18 04:24 --------- d-----w c:\program files\Sonic
2008-12-18 04:23 --------- d-----w c:\program files\Services en ligne
2008-12-18 04:23 --------- d-----w c:\program files\NetWaiting
2008-12-18 04:22 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-18 04:22 --------- d-----w c:\program files\microsoft frontpage
2008-12-18 04:22 --------- d-----w c:\program files\HP
2008-12-18 04:21 --------- d-----w c:\program files\Hewlett-Packard
2008-12-18 04:21 --------- d-----w c:\program files\Google
2008-12-18 04:21 --------- d-----w c:\program files\FrenchOtto
2008-12-18 04:21 --------- d-----w c:\program files\Fichiers communs\TiVo Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\SureThing Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Sonic Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\LightScribe
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Java
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\HP
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-12-18 04:20 --------- d-----w c:\program files\CONEXANT
2008-12-18 04:17 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\Symantec
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\Sonic
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\SBSI
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
.

((((((((((((((((((((((((((((( snapshot@2009-01-19_10.29.26.98 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-19 15:40:13 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_29c.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 458752]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-19 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-20 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 794713]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-19 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"f4c320d3"="c:\windows\system32\njaiawuo.dll" [BU]
"nwiz"="nwiz.exe" [2006-07-20 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-13 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-26 c:\windows\system32\CHDAudPropShortcut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\SolennL\Menu D‚marrer\Programmes\D‚marrage\
MSN.lnk - c:\program files\Windows Live\Messenger\msnmsgr.exe [2008-12-20 5724184]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=ywluji.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\CrossLoop\\CrossLoopConnect.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-17 28544]
R3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [2006-06-06 61952]
S0 gezuxnon;gezuxnon;c:\windows\system32\drivers\qghkzene.sys --> c:\windows\system32\drivers\qghkzene.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{181874ca-d68f-11dd-8f5b-001636b108c3}]
\Shell\AutoRun\command - g:\wd_windows_tools\Setup.exe
.
Contenu du dossier 'Tâches planifiées'

2009-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 06:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{2C24852C-1005-4B13-B4CE-0FA4DEEEFC03} - (no file)
BHO-{5EA3B6D0-0912-424D-B995-A503974C102F} - (no file)

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=64&bd=pavilion&pf=laptop
IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game11.zylom.com/activex/zylomgamesplayer.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-19 10:45:37
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????Z??????`?@?????L?@

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-01-19 10:46:45
ComboFix-quarantined-files.txt 2009-01-19 15:46:43

Avant-CF: 70,301,777,920 octets libres
Après-CF: 70,286,364,672 octets libres

280 --- E O F --- 2009-01-15 15:17:21

Je ne suis pas sûre d'avoir tout compris... j'ai des gros doutes...

voici mes rapports en mode sans échec:

ComboFix 09-01-18.05 - SolennL 2009-01-20 17:41:28.3 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2046.1801 [GMT -5:00]
Lancé depuis: c:\program files\ComboFix2.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-20 au 2009-01-20 ))))))))))))))))))))))))))))))))))))
.

2009-01-19 10:21 . 2009-01-19 10:19 3,043,099 -ra------ c:\program files\ComboFix2.exe
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\documents and settings\SolennL\Application Data\Malwarebytes
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-18 16:06 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-18 16:06 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-18 13:58 . 2009-01-18 13:58 401,720 --a------ c:\program files\HiJackThis.exe
2009-01-18 10:03 . 2009-01-18 10:03 <REP> d-------- c:\windows\system32\Kaspersky Lab
2009-01-17 13:23 . 2009-01-17 13:23 <REP> d--hs---- c:\documents and settings\LocalService\Temporary Internet Files
2009-01-17 13:23 . 2009-01-17 13:23 <REP> d--hs---- c:\documents and settings\LocalService\Historique
2009-01-17 13:21 . 2009-01-17 13:21 <REP> d-------- c:\program files\Avira
2009-01-17 13:21 . 2009-01-17 13:21 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-01-17 12:03 . 2009-01-17 12:03 399,360 --a------ c:\windows\system32\dllcache\rpcss.dll
2009-01-17 12:01 . 2009-01-17 12:01 <REP> d-------- c:\program files\Panda Security
2009-01-17 12:01 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-01-17 10:57 . 2009-01-18 13:31 <REP> d-------- c:\program files\CrossLoop
2009-01-17 10:55 . 2009-01-17 10:55 <REP> d-------- c:\program files\Spybot - Search & Destroy
2009-01-13 17:53 . 2009-01-13 17:53 <REP> d-------- c:\program files\LedPC Application
2009-01-10 18:58 . 2009-01-10 18:59 <REP> d-------- c:\documents and settings\SolennL\Application Data\Move Networks
2009-01-08 21:37 . 2003-12-12 16:06 1,693,696 --a------ c:\windows\system32\ltclr13n.dll
2009-01-08 21:37 . 2003-11-04 15:11 155,648 --a------ c:\windows\system32\lftif13n.dll
2009-01-08 21:37 . 2003-11-04 15:10 98,304 --a------ c:\windows\system32\lffax13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 462,848 --a------ c:\windows\system32\ltkrn13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 450,560 --a------ c:\windows\system32\ltimg13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 401,408 --a------ c:\windows\system32\lfcmp13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 299,008 --a------ c:\windows\system32\ltdis13n.dll
2009-01-08 21:36 . 2004-01-12 02:09 206,336 --a------ c:\windows\system32\ltefx13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 163,840 --a------ c:\windows\system32\ltfil13n.dll
2009-01-08 21:36 . 2003-11-04 15:10 69,632 --a------ c:\windows\system32\lfgif13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 57,344 --a------ c:\windows\system32\lfbmp13n.dll
2009-01-05 13:13 . 2009-01-05 13:13 <REP> d-------- c:\documents and settings\Administrator
2009-01-05 10:21 . 2009-01-05 10:21 <REP> d-------- c:\program files\Uniblue
2009-01-05 10:21 . 2009-01-05 10:21 <REP> d-------- c:\documents and settings\SolennL\Application Data\Uniblue
2009-01-05 10:21 . 2009-01-15 22:04 <REP> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-01-05 10:18 . 2009-01-05 10:21 <REP> d--h-c--- c:\documents and settings\All Users\Application Data\{148D8B8A-8F96-4822-81EC-D510B626B7D5}
2009-01-05 10:16 . 2008-07-04 01:34 860,160 --a------ c:\windows\system32\lameACM.acm
2009-01-05 10:16 . 2007-09-20 19:52 118,784 --a------ c:\windows\system32\ac3acm.acm
2009-01-05 10:16 . 2007-10-03 10:03 414 --a------ c:\windows\system32\lame_acm.xml
2009-01-05 10:07 . 2009-01-05 10:08 <REP> d-------- C:\b5e2808e51682d5a7841c69aa526
2009-01-05 09:36 . 2009-01-05 09:36 <REP> d-------- c:\windows\Downloaded Installations
2009-01-05 09:07 . 2009-01-05 10:16 <REP> d-------- c:\program files\K-Lite Codec Pack
2009-01-05 09:06 . 2009-01-05 09:06 <REP> d-------- c:\program files\CCleaner
2009-01-05 09:06 . 2009-01-05 09:06 <REP> d-------- c:\documents and settings\SolennL\Application Data\Yahoo!
2009-01-05 07:01 . 2009-01-05 07:01 <REP> d-------- c:\program files\Citrix
2009-01-04 16:13 . 2009-01-17 11:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-04 16:07 . 2009-01-05 09:07 <REP> d-------- c:\program files\K-Lite Codec Pack(2)
2009-01-04 15:28 . 2009-01-05 10:07 <REP> d-------- c:\windows\system32\drivers\UMDF
2009-01-04 15:19 . 2009-01-04 15:19 <REP> d-------- c:\documents and settings\SolennL\Application Data\Media Player Classic
2009-01-04 15:16 . 2008-05-22 17:22 3,596,288 --a------ c:\windows\system32\qt-dx331.dll
2009-01-04 15:16 . 2008-01-10 07:15 755,027 --a------ c:\windows\system32\xvidcore.dll
2009-01-04 15:16 . 2008-05-30 18:22 683,520 --a------ c:\windows\system32\divx.dll
2009-01-04 15:16 . 2004-01-25 11:18 217,088 --a------ c:\windows\system32\yv12vfw.dll
2009-01-04 15:16 . 2008-09-16 14:23 168,448 --a------ c:\windows\system32\unrar.dll
2009-01-04 15:16 . 2008-01-10 07:16 159,839 --a------ c:\windows\system32\xvidvfw.dll
2009-01-04 15:16 . 2008-05-22 17:19 81,920 --a------ c:\windows\system32\dpl100.dll
2009-01-04 15:16 . 2008-06-12 13:36 7,680 --a------ c:\windows\system32\ff_vfw.dll
2009-01-04 15:16 . 2007-07-10 11:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-01-04 15:09 . 2009-01-05 09:32 <REP> d-------- c:\program files\Yahoo!
2008-12-29 10:36 . 2008-12-29 10:36 <REP> d--hs---- c:\documents and settings\NetworkService\Temporary Internet Files
2008-12-29 10:36 . 2008-12-29 10:36 <REP> d--hs---- c:\documents and settings\NetworkService\Historique
2008-12-27 10:10 . 2008-12-27 10:10 <REP> d-------- c:\documents and settings\SolennL\Application Data\AdobeUM
2008-12-26 13:21 . 2008-12-26 13:21 <REP> d-------- c:\windows\Sun
2008-12-26 13:18 . 2008-12-26 13:18 <REP> d-------- c:\program files\iPod
2008-12-26 13:18 . 2008-12-26 13:18 <REP> d-------- c:\documents and settings\SolennL\Application Data\Apple Computer
2008-12-26 13:18 . 2008-04-17 07:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-12-26 13:18 . 2008-04-17 07:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-12-26 13:17 . 2008-12-26 13:17 <REP> d-------- c:\program files\QuickTime
2008-12-26 13:17 . 2008-12-26 13:18 <REP> d-------- c:\program files\iTunes
2008-12-26 13:17 . 2008-12-26 13:17 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-26 13:17 . 2008-12-26 13:18 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-26 13:16 . 2008-12-26 13:18 <REP> d-------- c:\program files\Fichiers communs\Apple
2008-12-26 13:16 . 2008-12-26 13:16 <REP> d-------- c:\program files\Apple Software Update
2008-12-26 13:16 . 2008-12-26 13:16 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-12-26 13:16 . 2008-11-07 08:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys
2008-12-25 10:24 . 2009-01-14 11:17 <REP> d-------- c:\program files\eMule
2008-12-22 09:16 . 2009-01-05 10:07 <REP> d-------- c:\windows\system32\LogFiles
2008-12-20 12:13 . 2008-12-20 12:13 <REP> d-------- c:\documents and settings\All Users\Application Data\Zylom
2008-12-20 11:54 . 2008-12-20 12:08 <REP> d-------- c:\documents and settings\SolennL\Contacts
2008-12-20 11:47 . 2008-12-20 11:47 <REP> d-------- c:\program files\Windows Live
2008-12-20 11:46 . 2008-04-13 13:45 26,368 --a------ c:\windows\system32\dllcache\usbstor.sys
2008-12-20 11:14 . 2008-12-20 11:14 <REP> d-------- c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-20 10:34 . 2008-12-20 10:46 <REP> d-------- c:\documents and settings\SolennL\Application Data\MSNInstaller
2008-12-20 10:04 . 2008-12-20 10:04 <REP> d-------- c:\program files\Microsoft Sync Framework
2008-12-20 09:27 . 2008-12-20 09:27 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 22:32 --------- d-----w c:\documents and settings\SolennL\Application Data\Skype
2009-01-20 16:41 11,138 ----a-w c:\program files\hijackthis.log
2009-01-20 02:09 --------- d-----w c:\documents and settings\SolennL\Application Data\skypePM
2009-01-16 03:00 --------- d-----w c:\program files\GemMasterFrench
2009-01-15 15:17 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-05 15:31 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-01-05 15:08 --------- d-----w c:\program files\Windows Media Connect 2
2008-12-20 15:05 --------- d-----w c:\program files\Microsoft
2008-12-19 21:32 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-19 21:31 --------- d-----w c:\program files\Java
2008-12-19 21:03 --------- d-----w c:\program files\Microsoft Works
2008-12-19 20:51 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-19 20:45 --------- d-----w c:\program files\Microsoft.NET
2008-12-19 20:44 --------- d-----w c:\documents and settings\SolennL\Application Data\HP
2008-12-19 20:06 --------- d-----w c:\documents and settings\SolennL\Application Data\Otto
2008-12-19 20:06 --------- d-----w c:\documents and settings\All Users\Application Data\Otto
2008-12-18 19:26 --------- d-----w c:\program files\Skype
2008-12-18 19:26 --------- d-----w c:\program files\Fichiers communs\Skype
2008-12-18 19:26 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-18 18:48 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-18 17:56 --------- d-----w c:\program files\MSXML 4.0
2008-12-18 12:24 --------- d-----w c:\program files\Alwil Software
2008-12-18 12:14 --------- d-----w c:\documents and settings\SolennL\Application Data\Sonic
2008-12-18 12:13 --------- d-----w c:\documents and settings\SolennL\Application Data\Leadertech
2008-12-18 12:10 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-12-18 12:10 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-18 05:52 1,741 --sha-r c:\windows\system32\drivers\103C_HP_NTBK_HP Pavilion dv6000 (RR371EA#ABF)_YN_0Pavi_QCNF64527ZH_E419857053_46_I30BC_SQuanta_V66.21_BF.08_T061106_WXP2_L40C_M2047_J120_7Intel_8Core2 T5500_91.66_#061029_N8086109A_(RR371EA#ABF)_XMOBILE_CN10_Z.MRK
2008-12-18 05:46 --------- d-----w c:\program files\HPQ
2008-12-18 04:24 --------- d-----w c:\program files\Windows Plus
2008-12-18 04:24 --------- d-----w c:\program files\Synaptics
2008-12-18 04:24 --------- d-----w c:\program files\Sonic
2008-12-18 04:23 --------- d-----w c:\program files\Services en ligne
2008-12-18 04:23 --------- d-----w c:\program files\NetWaiting
2008-12-18 04:22 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-18 04:22 --------- d-----w c:\program files\microsoft frontpage
2008-12-18 04:22 --------- d-----w c:\program files\HP
2008-12-18 04:21 --------- d-----w c:\program files\Hewlett-Packard
2008-12-18 04:21 --------- d-----w c:\program files\Google
2008-12-18 04:21 --------- d-----w c:\program files\FrenchOtto
2008-12-18 04:21 --------- d-----w c:\program files\Fichiers communs\TiVo Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\SureThing Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Sonic Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\LightScribe
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Java
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\HP
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-12-18 04:20 --------- d-----w c:\program files\CONEXANT
2008-12-18 04:17 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\Symantec
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\Sonic
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\SBSI
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 458752]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-19 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-20 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 794713]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-19 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"f4c320d3"="c:\windows\system32\njaiawuo.dll" [BU]
"nwiz"="nwiz.exe" [2006-07-20 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-13 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-26 c:\windows\system32\CHDAudPropShortcut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\SolennL\Menu D‚marrer\Programmes\D‚marrage\
MSN.lnk - c:\program files\Windows Live\Messenger\msnmsgr.exe [2008-12-20 5724184]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=ywluji.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\CrossLoop\\CrossLoopConnect.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S0 gezuxnon;gezuxnon;c:\windows\system32\drivers\qghkzene.sys --> c:\windows\system32\drivers\qghkzene.sys [?]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-17 28544]
S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [2006-06-06 61952]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - MDMXSDK

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{181874ca-d68f-11dd-8f5b-001636b108c3}]
\Shell\AutoRun\command - g:\wd_windows_tools\Setup.exe
.
Contenu du dossier 'Tâches planifiées'

2009-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 06:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{2C24852C-1005-4B13-B4CE-0FA4DEEEFC03} - (no file)
BHO-{5EA3B6D0-0912-424D-B995-A503974C102F} - (no file)

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=64&bd=pavilion&pf=laptop
IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game11.zylom.com/activex/zylomgamesplayer.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-20 17:43:42
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????Z??????`?@?????L?@

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-01-20 17:44:42
ComboFix-quarantined-files.txt 2009-01-20 22:44:41
ComboFix2.txt 2009-01-19 15:46:46

Avant-CF: 71 505 162 240 octets libres
Après-CF: 72,419,139,584 octets libres

251 --- E O F --- 2009-01-15 15:17:21

rapport hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:48:41, on 20/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {2C24852C-1005-4B13-B4CE-0FA4DEEEFC03} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {5EA3B6D0-0912-424D-B995-A503974C102F} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [f4c320d3] rundll32.exe "C:\WINDOWS\system32\njaiawuo.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MSN.lnk = C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom.com/activex/zylomgamesplayer.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ywluji.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Je ne suis pas sûre d'avoir tout compris... j'ai des gros doutes...

voici mes rapports en mode sans échec:

ComboFix 09-01-18.05 - SolennL 2009-01-20 17:41:28.3 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2046.1801 [GMT -5:00]
Lancé depuis: c:\program files\ComboFix2.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-20 au 2009-01-20 ))))))))))))))))))))))))))))))))))))
.

2009-01-19 10:21 . 2009-01-19 10:19 3,043,099 -ra------ c:\program files\ComboFix2.exe
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\documents and settings\SolennL\Application Data\Malwarebytes
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-18 16:06 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-18 16:06 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-18 13:58 . 2009-01-18 13:58 401,720 --a------ c:\program files\HiJackThis.exe
2009-01-18 10:03 . 2009-01-18 10:03 <REP> d-------- c:\windows\system32\Kaspersky Lab
2009-01-17 13:23 . 2009-01-17 13:23 <REP> d--hs---- c:\documents and settings\LocalService\Temporary Internet Files
2009-01-17 13:23 . 2009-01-17 13:23 <REP> d--hs---- c:\documents and settings\LocalService\Historique
2009-01-17 13:21 . 2009-01-17 13:21 <REP> d-------- c:\program files\Avira
2009-01-17 13:21 . 2009-01-17 13:21 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-01-17 12:03 . 2009-01-17 12:03 399,360 --a------ c:\windows\system32\dllcache\rpcss.dll
2009-01-17 12:01 . 2009-01-17 12:01 <REP> d-------- c:\program files\Panda Security
2009-01-17 12:01 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-01-17 10:57 . 2009-01-18 13:31 <REP> d-------- c:\program files\CrossLoop
2009-01-17 10:55 . 2009-01-17 10:55 <REP> d-------- c:\program files\Spybot - Search & Destroy
2009-01-13 17:53 . 2009-01-13 17:53 <REP> d-------- c:\program files\LedPC Application
2009-01-10 18:58 . 2009-01-10 18:59 <REP> d-------- c:\documents and settings\SolennL\Application Data\Move Networks
2009-01-08 21:37 . 2003-12-12 16:06 1,693,696 --a------ c:\windows\system32\ltclr13n.dll
2009-01-08 21:37 . 2003-11-04 15:11 155,648 --a------ c:\windows\system32\lftif13n.dll
2009-01-08 21:37 . 2003-11-04 15:10 98,304 --a------ c:\windows\system32\lffax13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 462,848 --a------ c:\windows\system32\ltkrn13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 450,560 --a------ c:\windows\system32\ltimg13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 401,408 --a------ c:\windows\system32\lfcmp13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 299,008 --a------ c:\windows\system32\ltdis13n.dll
2009-01-08 21:36 . 2004-01-12 02:09 206,336 --a------ c:\windows\system32\ltefx13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 163,840 --a------ c:\windows\system32\ltfil13n.dll
2009-01-08 21:36 . 2003-11-04 15:10 69,632 --a------ c:\windows\system32\lfgif13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 57,344 --a------ c:\windows\system32\lfbmp13n.dll
2009-01-05 13:13 . 2009-01-05 13:13 <REP> d-------- c:\documents and settings\Administrator
2009-01-05 10:21 . 2009-01-05 10:21 <REP> d-------- c:\program files\Uniblue
2009-01-05 10:21 . 2009-01-05 10:21 <REP> d-------- c:\documents and settings\SolennL\Application Data\Uniblue
2009-01-05 10:21 . 2009-01-15 22:04 <REP> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-01-05 10:18 . 2009-01-05 10:21 <REP> d--h-c--- c:\documents and settings\All Users\Application Data\{148D8B8A-8F96-4822-81EC-D510B626B7D5}
2009-01-05 10:16 . 2008-07-04 01:34 860,160 --a------ c:\windows\system32\lameACM.acm
2009-01-05 10:16 . 2007-09-20 19:52 118,784 --a------ c:\windows\system32\ac3acm.acm
2009-01-05 10:16 . 2007-10-03 10:03 414 --a------ c:\windows\system32\lame_acm.xml
2009-01-05 10:07 . 2009-01-05 10:08 <REP> d-------- C:\b5e2808e51682d5a7841c69aa526
2009-01-05 09:36 . 2009-01-05 09:36 <REP> d-------- c:\windows\Downloaded Installations
2009-01-05 09:07 . 2009-01-05 10:16 <REP> d-------- c:\program files\K-Lite Codec Pack
2009-01-05 09:06 . 2009-01-05 09:06 <REP> d-------- c:\program files\CCleaner
2009-01-05 09:06 . 2009-01-05 09:06 <REP> d-------- c:\documents and settings\SolennL\Application Data\Yahoo!
2009-01-05 07:01 . 2009-01-05 07:01 <REP> d-------- c:\program files\Citrix
2009-01-04 16:13 . 2009-01-17 11:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-04 16:07 . 2009-01-05 09:07 <REP> d-------- c:\program files\K-Lite Codec Pack(2)
2009-01-04 15:28 . 2009-01-05 10:07 <REP> d-------- c:\windows\system32\drivers\UMDF
2009-01-04 15:19 . 2009-01-04 15:19 <REP> d-------- c:\documents and settings\SolennL\Application Data\Media Player Classic
2009-01-04 15:16 . 2008-05-22 17:22 3,596,288 --a------ c:\windows\system32\qt-dx331.dll
2009-01-04 15:16 . 2008-01-10 07:15 755,027 --a------ c:\windows\system32\xvidcore.dll
2009-01-04 15:16 . 2008-05-30 18:22 683,520 --a------ c:\windows\system32\divx.dll
2009-01-04 15:16 . 2004-01-25 11:18 217,088 --a------ c:\windows\system32\yv12vfw.dll
2009-01-04 15:16 . 2008-09-16 14:23 168,448 --a------ c:\windows\system32\unrar.dll
2009-01-04 15:16 . 2008-01-10 07:16 159,839 --a------ c:\windows\system32\xvidvfw.dll
2009-01-04 15:16 . 2008-05-22 17:19 81,920 --a------ c:\windows\system32\dpl100.dll
2009-01-04 15:16 . 2008-06-12 13:36 7,680 --a------ c:\windows\system32\ff_vfw.dll
2009-01-04 15:16 . 2007-07-10 11:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-01-04 15:09 . 2009-01-05 09:32 <REP> d-------- c:\program files\Yahoo!
2008-12-29 10:36 . 2008-12-29 10:36 <REP> d--hs---- c:\documents and settings\NetworkService\Temporary Internet Files
2008-12-29 10:36 . 2008-12-29 10:36 <REP> d--hs---- c:\documents and settings\NetworkService\Historique
2008-12-27 10:10 . 2008-12-27 10:10 <REP> d-------- c:\documents and settings\SolennL\Application Data\AdobeUM
2008-12-26 13:21 . 2008-12-26 13:21 <REP> d-------- c:\windows\Sun
2008-12-26 13:18 . 2008-12-26 13:18 <REP> d-------- c:\program files\iPod
2008-12-26 13:18 . 2008-12-26 13:18 <REP> d-------- c:\documents and settings\SolennL\Application Data\Apple Computer
2008-12-26 13:18 . 2008-04-17 07:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-12-26 13:18 . 2008-04-17 07:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-12-26 13:17 . 2008-12-26 13:17 <REP> d-------- c:\program files\QuickTime
2008-12-26 13:17 . 2008-12-26 13:18 <REP> d-------- c:\program files\iTunes
2008-12-26 13:17 . 2008-12-26 13:17 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-26 13:17 . 2008-12-26 13:18 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-26 13:16 . 2008-12-26 13:18 <REP> d-------- c:\program files\Fichiers communs\Apple
2008-12-26 13:16 . 2008-12-26 13:16 <REP> d-------- c:\program files\Apple Software Update
2008-12-26 13:16 . 2008-12-26 13:16 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-12-26 13:16 . 2008-11-07 08:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys
2008-12-25 10:24 . 2009-01-14 11:17 <REP> d-------- c:\program files\eMule
2008-12-22 09:16 . 2009-01-05 10:07 <REP> d-------- c:\windows\system32\LogFiles
2008-12-20 12:13 . 2008-12-20 12:13 <REP> d-------- c:\documents and settings\All Users\Application Data\Zylom
2008-12-20 11:54 . 2008-12-20 12:08 <REP> d-------- c:\documents and settings\SolennL\Contacts
2008-12-20 11:47 . 2008-12-20 11:47 <REP> d-------- c:\program files\Windows Live
2008-12-20 11:46 . 2008-04-13 13:45 26,368 --a------ c:\windows\system32\dllcache\usbstor.sys
2008-12-20 11:14 . 2008-12-20 11:14 <REP> d-------- c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-20 10:34 . 2008-12-20 10:46 <REP> d-------- c:\documents and settings\SolennL\Application Data\MSNInstaller
2008-12-20 10:04 . 2008-12-20 10:04 <REP> d-------- c:\program files\Microsoft Sync Framework
2008-12-20 09:27 . 2008-12-20 09:27 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 22:32 --------- d-----w c:\documents and settings\SolennL\Application Data\Skype
2009-01-20 16:41 11,138 ----a-w c:\program files\hijackthis.log
2009-01-20 02:09 --------- d-----w c:\documents and settings\SolennL\Application Data\skypePM
2009-01-16 03:00 --------- d-----w c:\program files\GemMasterFrench
2009-01-15 15:17 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-05 15:31 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-01-05 15:08 --------- d-----w c:\program files\Windows Media Connect 2
2008-12-20 15:05 --------- d-----w c:\program files\Microsoft
2008-12-19 21:32 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-19 21:31 --------- d-----w c:\program files\Java
2008-12-19 21:03 --------- d-----w c:\program files\Microsoft Works
2008-12-19 20:51 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-19 20:45 --------- d-----w c:\program files\Microsoft.NET
2008-12-19 20:44 --------- d-----w c:\documents and settings\SolennL\Application Data\HP
2008-12-19 20:06 --------- d-----w c:\documents and settings\SolennL\Application Data\Otto
2008-12-19 20:06 --------- d-----w c:\documents and settings\All Users\Application Data\Otto
2008-12-18 19:26 --------- d-----w c:\program files\Skype
2008-12-18 19:26 --------- d-----w c:\program files\Fichiers communs\Skype
2008-12-18 19:26 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-18 18:48 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-18 17:56 --------- d-----w c:\program files\MSXML 4.0
2008-12-18 12:24 --------- d-----w c:\program files\Alwil Software
2008-12-18 12:14 --------- d-----w c:\documents and settings\SolennL\Application Data\Sonic
2008-12-18 12:13 --------- d-----w c:\documents and settings\SolennL\Application Data\Leadertech
2008-12-18 12:10 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-12-18 12:10 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-18 05:52 1,741 --sha-r c:\windows\system32\drivers\103C_HP_NTBK_HP Pavilion dv6000 (RR371EA#ABF)_YN_0Pavi_QCNF64527ZH_E419857053_46_I30BC_SQuanta_V66.21_BF.08_T061106_WXP2_L40C_M2047_J120_7Intel_8Core2 T5500_91.66_#061029_N8086109A_(RR371EA#ABF)_XMOBILE_CN10_Z.MRK
2008-12-18 05:46 --------- d-----w c:\program files\HPQ
2008-12-18 04:24 --------- d-----w c:\program files\Windows Plus
2008-12-18 04:24 --------- d-----w c:\program files\Synaptics
2008-12-18 04:24 --------- d-----w c:\program files\Sonic
2008-12-18 04:23 --------- d-----w c:\program files\Services en ligne
2008-12-18 04:23 --------- d-----w c:\program files\NetWaiting
2008-12-18 04:22 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-18 04:22 --------- d-----w c:\program files\microsoft frontpage
2008-12-18 04:22 --------- d-----w c:\program files\HP
2008-12-18 04:21 --------- d-----w c:\program files\Hewlett-Packard
2008-12-18 04:21 --------- d-----w c:\program files\Google
2008-12-18 04:21 --------- d-----w c:\program files\FrenchOtto
2008-12-18 04:21 --------- d-----w c:\program files\Fichiers communs\TiVo Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\SureThing Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Sonic Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\LightScribe
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Java
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\HP
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-12-18 04:20 --------- d-----w c:\program files\CONEXANT
2008-12-18 04:17 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\Symantec
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\Sonic
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\SBSI
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 458752]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-19 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-20 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 794713]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-19 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"f4c320d3"="c:\windows\system32\njaiawuo.dll" [BU]
"nwiz"="nwiz.exe" [2006-07-20 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-13 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-26 c:\windows\system32\CHDAudPropShortcut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\SolennL\Menu D‚marrer\Programmes\D‚marrage\
MSN.lnk - c:\program files\Windows Live\Messenger\msnmsgr.exe [2008-12-20 5724184]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=ywluji.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\CrossLoop\\CrossLoopConnect.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S0 gezuxnon;gezuxnon;c:\windows\system32\drivers\qghkzene.sys --> c:\windows\system32\drivers\qghkzene.sys [?]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-17 28544]
S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [2006-06-06 61952]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - MDMXSDK

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{181874ca-d68f-11dd-8f5b-001636b108c3}]
\Shell\AutoRun\command - g:\wd_windows_tools\Setup.exe
.
Contenu du dossier 'Tâches planifiées'

2009-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 06:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{2C24852C-1005-4B13-B4CE-0FA4DEEEFC03} - (no file)
BHO-{5EA3B6D0-0912-424D-B995-A503974C102F} - (no file)

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=64&bd=pavilion&pf=laptop
IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game11.zylom.com/activex/zylomgamesplayer.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-20 17:43:42
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????Z??????`?@?????L?@

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-01-20 17:44:42
ComboFix-quarantined-files.txt 2009-01-20 22:44:41
ComboFix2.txt 2009-01-19 15:46:46

Avant-CF: 71 505 162 240 octets libres
Après-CF: 72,419,139,584 octets libres

251 --- E O F --- 2009-01-15 15:17:21

rapport hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:48:41, on 20/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {2C24852C-1005-4B13-B4CE-0FA4DEEEFC03} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {5EA3B6D0-0912-424D-B995-A503974C102F} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [f4c320d3] rundll32.exe "C:\WINDOWS\system32\njaiawuo.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MSN.lnk = C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom.com/activex/zylomgamesplayer.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ywluji.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Je ne suis pas sûre d'avoir tout compris... j'ai des gros doutes...

voici mes rapports en mode sans échec:

ComboFix 09-01-18.05 - SolennL 2009-01-20 17:41:28.3 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2046.1801 [GMT -5:00]
Lancé depuis: c:\program files\ComboFix2.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-20 au 2009-01-20 ))))))))))))))))))))))))))))))))))))
.

2009-01-19 10:21 . 2009-01-19 10:19 3,043,099 -ra------ c:\program files\ComboFix2.exe
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\documents and settings\SolennL\Application Data\Malwarebytes
2009-01-18 16:06 . 2009-01-18 16:06 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-18 16:06 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-18 16:06 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-18 13:58 . 2009-01-18 13:58 401,720 --a------ c:\program files\HiJackThis.exe
2009-01-18 10:03 . 2009-01-18 10:03 <REP> d-------- c:\windows\system32\Kaspersky Lab
2009-01-17 13:23 . 2009-01-17 13:23 <REP> d--hs---- c:\documents and settings\LocalService\Temporary Internet Files
2009-01-17 13:23 . 2009-01-17 13:23 <REP> d--hs---- c:\documents and settings\LocalService\Historique
2009-01-17 13:21 . 2009-01-17 13:21 <REP> d-------- c:\program files\Avira
2009-01-17 13:21 . 2009-01-17 13:21 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-01-17 12:03 . 2009-01-17 12:03 399,360 --a------ c:\windows\system32\dllcache\rpcss.dll
2009-01-17 12:01 . 2009-01-17 12:01 <REP> d-------- c:\program files\Panda Security
2009-01-17 12:01 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-01-17 10:57 . 2009-01-18 13:31 <REP> d-------- c:\program files\CrossLoop
2009-01-17 10:55 . 2009-01-17 10:55 <REP> d-------- c:\program files\Spybot - Search & Destroy
2009-01-13 17:53 . 2009-01-13 17:53 <REP> d-------- c:\program files\LedPC Application
2009-01-10 18:58 . 2009-01-10 18:59 <REP> d-------- c:\documents and settings\SolennL\Application Data\Move Networks
2009-01-08 21:37 . 2003-12-12 16:06 1,693,696 --a------ c:\windows\system32\ltclr13n.dll
2009-01-08 21:37 . 2003-11-04 15:11 155,648 --a------ c:\windows\system32\lftif13n.dll
2009-01-08 21:37 . 2003-11-04 15:10 98,304 --a------ c:\windows\system32\lffax13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 462,848 --a------ c:\windows\system32\ltkrn13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 450,560 --a------ c:\windows\system32\ltimg13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 401,408 --a------ c:\windows\system32\lfcmp13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 299,008 --a------ c:\windows\system32\ltdis13n.dll
2009-01-08 21:36 . 2004-01-12 02:09 206,336 --a------ c:\windows\system32\ltefx13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 163,840 --a------ c:\windows\system32\ltfil13n.dll
2009-01-08 21:36 . 2003-11-04 15:10 69,632 --a------ c:\windows\system32\lfgif13n.dll
2009-01-08 21:36 . 2004-05-14 16:53 57,344 --a------ c:\windows\system32\lfbmp13n.dll
2009-01-05 13:13 . 2009-01-05 13:13 <REP> d-------- c:\documents and settings\Administrator
2009-01-05 10:21 . 2009-01-05 10:21 <REP> d-------- c:\program files\Uniblue
2009-01-05 10:21 . 2009-01-05 10:21 <REP> d-------- c:\documents and settings\SolennL\Application Data\Uniblue
2009-01-05 10:21 . 2009-01-15 22:04 <REP> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-01-05 10:18 . 2009-01-05 10:21 <REP> d--h-c--- c:\documents and settings\All Users\Application Data\{148D8B8A-8F96-4822-81EC-D510B626B7D5}
2009-01-05 10:16 . 2008-07-04 01:34 860,160 --a------ c:\windows\system32\lameACM.acm
2009-01-05 10:16 . 2007-09-20 19:52 118,784 --a------ c:\windows\system32\ac3acm.acm
2009-01-05 10:16 . 2007-10-03 10:03 414 --a------ c:\windows\system32\lame_acm.xml
2009-01-05 10:07 . 2009-01-05 10:08 <REP> d-------- C:\b5e2808e51682d5a7841c69aa526
2009-01-05 09:36 . 2009-01-05 09:36 <REP> d-------- c:\windows\Downloaded Installations
2009-01-05 09:07 . 2009-01-05 10:16 <REP> d-------- c:\program files\K-Lite Codec Pack
2009-01-05 09:06 . 2009-01-05 09:06 <REP> d-------- c:\program files\CCleaner
2009-01-05 09:06 . 2009-01-05 09:06 <REP> d-------- c:\documents and settings\SolennL\Application Data\Yahoo!
2009-01-05 07:01 . 2009-01-05 07:01 <REP> d-------- c:\program files\Citrix
2009-01-04 16:13 . 2009-01-17 11:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-04 16:07 . 2009-01-05 09:07 <REP> d-------- c:\program files\K-Lite Codec Pack(2)
2009-01-04 15:28 . 2009-01-05 10:07 <REP> d-------- c:\windows\system32\drivers\UMDF
2009-01-04 15:19 . 2009-01-04 15:19 <REP> d-------- c:\documents and settings\SolennL\Application Data\Media Player Classic
2009-01-04 15:16 . 2008-05-22 17:22 3,596,288 --a------ c:\windows\system32\qt-dx331.dll
2009-01-04 15:16 . 2008-01-10 07:15 755,027 --a------ c:\windows\system32\xvidcore.dll
2009-01-04 15:16 . 2008-05-30 18:22 683,520 --a------ c:\windows\system32\divx.dll
2009-01-04 15:16 . 2004-01-25 11:18 217,088 --a------ c:\windows\system32\yv12vfw.dll
2009-01-04 15:16 . 2008-09-16 14:23 168,448 --a------ c:\windows\system32\unrar.dll
2009-01-04 15:16 . 2008-01-10 07:16 159,839 --a------ c:\windows\system32\xvidvfw.dll
2009-01-04 15:16 . 2008-05-22 17:19 81,920 --a------ c:\windows\system32\dpl100.dll
2009-01-04 15:16 . 2008-06-12 13:36 7,680 --a------ c:\windows\system32\ff_vfw.dll
2009-01-04 15:16 . 2007-07-10 11:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-01-04 15:09 . 2009-01-05 09:32 <REP> d-------- c:\program files\Yahoo!
2008-12-29 10:36 . 2008-12-29 10:36 <REP> d--hs---- c:\documents and settings\NetworkService\Temporary Internet Files
2008-12-29 10:36 . 2008-12-29 10:36 <REP> d--hs---- c:\documents and settings\NetworkService\Historique
2008-12-27 10:10 . 2008-12-27 10:10 <REP> d-------- c:\documents and settings\SolennL\Application Data\AdobeUM
2008-12-26 13:21 . 2008-12-26 13:21 <REP> d-------- c:\windows\Sun
2008-12-26 13:18 . 2008-12-26 13:18 <REP> d-------- c:\program files\iPod
2008-12-26 13:18 . 2008-12-26 13:18 <REP> d-------- c:\documents and settings\SolennL\Application Data\Apple Computer
2008-12-26 13:18 . 2008-04-17 07:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-12-26 13:18 . 2008-04-17 07:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-12-26 13:17 . 2008-12-26 13:17 <REP> d-------- c:\program files\QuickTime
2008-12-26 13:17 . 2008-12-26 13:18 <REP> d-------- c:\program files\iTunes
2008-12-26 13:17 . 2008-12-26 13:17 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-26 13:17 . 2008-12-26 13:18 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-26 13:16 . 2008-12-26 13:18 <REP> d-------- c:\program files\Fichiers communs\Apple
2008-12-26 13:16 . 2008-12-26 13:16 <REP> d-------- c:\program files\Apple Software Update
2008-12-26 13:16 . 2008-12-26 13:16 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-12-26 13:16 . 2008-11-07 08:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys
2008-12-25 10:24 . 2009-01-14 11:17 <REP> d-------- c:\program files\eMule
2008-12-22 09:16 . 2009-01-05 10:07 <REP> d-------- c:\windows\system32\LogFiles
2008-12-20 12:13 . 2008-12-20 12:13 <REP> d-------- c:\documents and settings\All Users\Application Data\Zylom
2008-12-20 11:54 . 2008-12-20 12:08 <REP> d-------- c:\documents and settings\SolennL\Contacts
2008-12-20 11:47 . 2008-12-20 11:47 <REP> d-------- c:\program files\Windows Live
2008-12-20 11:46 . 2008-04-13 13:45 26,368 --a------ c:\windows\system32\dllcache\usbstor.sys
2008-12-20 11:14 . 2008-12-20 11:14 <REP> d-------- c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-20 10:34 . 2008-12-20 10:46 <REP> d-------- c:\documents and settings\SolennL\Application Data\MSNInstaller
2008-12-20 10:04 . 2008-12-20 10:04 <REP> d-------- c:\program files\Microsoft Sync Framework
2008-12-20 09:27 . 2008-12-20 09:27 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 22:32 --------- d-----w c:\documents and settings\SolennL\Application Data\Skype
2009-01-20 16:41 11,138 ----a-w c:\program files\hijackthis.log
2009-01-20 02:09 --------- d-----w c:\documents and settings\SolennL\Application Data\skypePM
2009-01-16 03:00 --------- d-----w c:\program files\GemMasterFrench
2009-01-15 15:17 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-05 15:31 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-01-05 15:08 --------- d-----w c:\program files\Windows Media Connect 2
2008-12-20 15:05 --------- d-----w c:\program files\Microsoft
2008-12-19 21:32 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-19 21:31 --------- d-----w c:\program files\Java
2008-12-19 21:03 --------- d-----w c:\program files\Microsoft Works
2008-12-19 20:51 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-19 20:45 --------- d-----w c:\program files\Microsoft.NET
2008-12-19 20:44 --------- d-----w c:\documents and settings\SolennL\Application Data\HP
2008-12-19 20:06 --------- d-----w c:\documents and settings\SolennL\Application Data\Otto
2008-12-19 20:06 --------- d-----w c:\documents and settings\All Users\Application Data\Otto
2008-12-18 19:26 --------- d-----w c:\program files\Skype
2008-12-18 19:26 --------- d-----w c:\program files\Fichiers communs\Skype
2008-12-18 19:26 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-18 18:48 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-18 17:56 --------- d-----w c:\program files\MSXML 4.0
2008-12-18 12:24 --------- d-----w c:\program files\Alwil Software
2008-12-18 12:14 --------- d-----w c:\documents and settings\SolennL\Application Data\Sonic
2008-12-18 12:13 --------- d-----w c:\documents and settings\SolennL\Application Data\Leadertech
2008-12-18 12:10 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-12-18 12:10 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-18 05:52 1,741 --sha-r c:\windows\system32\drivers\103C_HP_NTBK_HP Pavilion dv6000 (RR371EA#ABF)_YN_0Pavi_QCNF64527ZH_E419857053_46_I30BC_SQuanta_V66.21_BF.08_T061106_WXP2_L40C_M2047_J120_7Intel_8Core2 T5500_91.66_#061029_N8086109A_(RR371EA#ABF)_XMOBILE_CN10_Z.MRK
2008-12-18 05:46 --------- d-----w c:\program files\HPQ
2008-12-18 04:24 --------- d-----w c:\program files\Windows Plus
2008-12-18 04:24 --------- d-----w c:\program files\Synaptics
2008-12-18 04:24 --------- d-----w c:\program files\Sonic
2008-12-18 04:23 --------- d-----w c:\program files\Services en ligne
2008-12-18 04:23 --------- d-----w c:\program files\NetWaiting
2008-12-18 04:22 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-18 04:22 --------- d-----w c:\program files\microsoft frontpage
2008-12-18 04:22 --------- d-----w c:\program files\HP
2008-12-18 04:21 --------- d-----w c:\program files\Hewlett-Packard
2008-12-18 04:21 --------- d-----w c:\program files\Google
2008-12-18 04:21 --------- d-----w c:\program files\FrenchOtto
2008-12-18 04:21 --------- d-----w c:\program files\Fichiers communs\TiVo Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\SureThing Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Sonic Shared
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\LightScribe
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Java
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\HP
2008-12-18 04:20 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-12-18 04:20 --------- d-----w c:\program files\CONEXANT
2008-12-18 04:17 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\Symantec
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\Sonic
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\SBSI
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2008-12-18 04:17 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 458752]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-19 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-20 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 794713]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-19 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"f4c320d3"="c:\windows\system32\njaiawuo.dll" [BU]
"nwiz"="nwiz.exe" [2006-07-20 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-13 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-26 c:\windows\system32\CHDAudPropShortcut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\SolennL\Menu D‚marrer\Programmes\D‚marrage\
MSN.lnk - c:\program files\Windows Live\Messenger\msnmsgr.exe [2008-12-20 5724184]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=ywluji.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\CrossLoop\\CrossLoopConnect.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S0 gezuxnon;gezuxnon;c:\windows\system32\drivers\qghkzene.sys --> c:\windows\system32\drivers\qghkzene.sys [?]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-17 28544]
S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [2006-06-06 61952]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - MDMXSDK

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{181874ca-d68f-11dd-8f5b-001636b108c3}]
\Shell\AutoRun\command - g:\wd_windows_tools\Setup.exe
.
Contenu du dossier 'Tâches planifiées'

2009-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 06:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{2C24852C-1005-4B13-B4CE-0FA4DEEEFC03} - (no file)
BHO-{5EA3B6D0-0912-424D-B995-A503974C102F} - (no file)

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=64&bd=pavilion&pf=laptop
IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game11.zylom.com/activex/zylomgamesplayer.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-20 17:43:42
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????Z??????`?@?????L?@

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-01-20 17:44:42
ComboFix-quarantined-files.txt 2009-01-20 22:44:41
ComboFix2.txt 2009-01-19 15:46:46

Avant-CF: 71 505 162 240 octets libres
Après-CF: 72,419,139,584 octets libres

251 --- E O F --- 2009-01-15 15:17:21

rapport hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:48:41, on 20/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {2C24852C-1005-4B13-B4CE-0FA4DEEEFC03} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {5EA3B6D0-0912-424D-B995-A503974C102F} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [f4c320d3] rundll32.exe "C:\WINDOWS\system32\njaiawuo.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MSN.lnk = C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom.com/activex/zylomgamesplayer.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ywluji.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

voilà ce que GEN PROC me dit:

Rapport GenProc 2.346 [1] - 24/01/2009 - Windows XP

Il est impératif de désactiver le résident TeaTimer de Spybot pendant l'ensemble des manipulations qui vont suivre. Aide Tea-Timer : http://ww11.genproc.com/spybot/spybot.html

Dans CCleaner, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures".
Par la suite, laisse-le avec ses réglages par défaut. C'est tout.

# Etape 1/ Télécharge :

- ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe (sUBs) sur ton Bureau.
Désactive ton antivirus, ton pare-feu et ferme tes programmes en cours. Lance combofix.exe et accepte les termes en cliquant sur OUI. Patiente. Au message "ComboFix a détecté que la 'console de récupération Windows' n'existe pas sur ce PC", clique sur oui puis sur OK, puis patiente. Valide le CLUF Microsoft. Au message "La console de récupération a été installée avec succès", clique impérativement sur NON pour quitter le programme (ferme également le rapport CF-RC.txt qui s'est ouvert)

Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ ; pour retrouver le rapport, clique sur le raccourci "GenProc" sur ton bureau. Choisis ta session courante *** SolennL ***

# Etape 2/

Double clique sur combofix.exe et suis les instructions. Attention de ne pas utiliser ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne au risque de figer l'ordinateur.

# Etape 3/

Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 4/

Redémarre normalement et poste, dans la même réponse :

- Le contenu du rapport situé dans C:\Combofix.txt;
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;

Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

____________________________________________________________________________________________________________

Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com