Viru et firefox qui ne se connecte pas

J'ai appliqué l'application dont voici le rapport :

SmitFraudFix v2.402

Rapport fait à 14:33:15,51, 12/03/2009
Executé à partir de J:\Applications\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\Drivers\WTSRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\WINDOWS\system32\WTClient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\

C:\autorun.inf PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\WYLL


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\WYLL\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\WYLL\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\WYLL\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,EXPLORER.EXE"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

J'ai choisi l'option 2 et voici le rapport :

SmitFraudFix v2.402

Rapport fait à 15:35:13,85, 12/03/2009
Executé à partir de J:\Applications\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

J'ai lance RSIT et les fichiers logs et infos donne ceci :

Logfile of random's system information tool 1.05 (written by random/random)
Run by WYLL at 2009-03-12 17:17:47
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 88 GB (88%) free of 100 GB
Total RAM: 2047 MB (85% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:17:50, on 12/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\Drivers\WTSRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\WINDOWS\system32\WTClient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\WYLL\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\WYLL.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,EXPLORER.EXE
O2 - BHO: Google plugin - {085E2757-F41D-42d1-B4CC-9DADF7113BBC} - aj32.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [WTClient] WTClient.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://J:\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'jx8007.dll' missing
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (Contrôleur de DownloadManager) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FBEEC868-97A9-4C6B-928D-6CB0106AAD26}: Domain = 10.0.0.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2.2 - Apache Software Foundation - K:\xampplite\apache\bin\apache.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: mysql - Unknown owner - K:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE

Le programme a fait le nettoyaye et voila le rapport :


[b]SDFix: Version 1.240 [/b]
Run by WYLL on 12/03/2009 at 18:22

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\system32\bb1.dat - Deleted
C:\WINDOWS\system32\cs.dat - Deleted
C:\WINDOWS\system32\ps1.dat - Deleted
C:\WINDOWS\system32\rc.dat - Deleted
C:\WINDOWS\system32\tb.dr - Deleted





Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-12 18:27:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Sun 25 Jan 2009 56 A.SHR --- "C:\WINDOWS\system32\22CD707F50.sys"
Fri 6 Feb 2009 1,734 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Fri 16 Mar 2007 1,140,312 ...H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\hpzmsi01.exe"
Fri 16 Mar 2007 1,099,352 ...H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\hpzscr01.exe"
Mon 4 Feb 2008 53,834 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\nsu3.exe"
Mon 4 Feb 2008 0 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\nsu3.tmp"
Mon 4 Feb 2008 53,834 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\nsu4.exe"
Mon 4 Feb 2008 0 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\nsu4.tmp"
Mon 4 Feb 2008 53,834 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\nsu5.exe"
Mon 4 Feb 2008 0 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\nsu5.tmp"
Thu 7 Apr 2005 121,064 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\setA.tmp"
Sun 18 Apr 2004 116,688 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\SetD.tmp"
Fri 18 Apr 2008 16,384 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\~DF3A82.tmp"
Fri 18 Apr 2008 16,384 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\~DF7DE7.tmp"
Fri 18 Apr 2008 16,384 A..H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\~DFAAB2.tmp"
Thu 20 Dec 2007 113 A..H. --- "C:\Documents and Settings\Administrateur\Application Data\Microsoft\Internet Explorer\brndlog.bak"
Tue 24 Oct 2006 534,528 ...H. --- "C:\Documents and Settings\Administrateur\Local Settings\Temp\dpinst_x32\dpinst.exe"
Wed 6 Dec 2006 4,096 A..H. --- "C:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll"
Fri 2 Mar 2007 2,560 A..H. --- "C:\Documents and Settings\All Users\Application Data\HP\Digital Imaging\Data\hpqd_cul_s.dll"
Sat 19 Apr 2008 7,187 A..H. --- "C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\zlp4vqjq.default\bookmarks.bak"
Tue 6 Mar 2007 12,288 A..H. --- "C:\Documents and Settings\All Users\Application Data\HP\Digital Imaging\Data\Destination\aiopfl.dll"

[b]Finished![/b]

Bonjour,

J'ai fais les deux rapports, le rapport info :

info.txt logfile of random's system information tool 1.05 2009-03-12 17:17:53

======Uninstall list======

-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
Adobe SVG Viewer 3.0-->C:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Install.log
ASUS Gamer OSD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}\setup.exe" -l0x40c -removeonly
ASUS WiFi-AP Solo-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8B3F4499-32E6-470D-8586-E6C03420F889}\Setup.exe" -l0x9 REMOVE
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CutePDF Writer 2.7-->C:\Program Files\Acro Software\CutePDF Writer\uninscpw.exe /uninstall
DeepBurner v1.9.0.228-->"C:\Program Files\Astonsoft\DeepBurner\Uninstall.exe" "C:\Program Files\Astonsoft\DeepBurner\install.log" -u
Extensis Suitcase 9.2-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{90546A9B-9B86-4D8A-B381-EF8D8AAE73E1}\Setup.exe" -l0x9
File Uploader-->MsiExec.exe /X{237CD223-1B9D-47E8-A76C-E478B83CCEA2}
Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HP Imaging Device Functions 9.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP OCR Software 9.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
HP Photosmart All-In-One Software 9.0-->C:\Program Files\HP\Digital Imaging\{B46AC30C-22D2-4610-B041-1DA7BB29EB57}\setup\hpzscr01.exe -datfile hposcr21.dat
IZArc 3.7-->"C:\Program Files\IZArc\unins000.exe"
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
JMB36X Raid Configurer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}\setup.exe" -l0x40c -removeonly
Macromedia Flash Player 8-->MsiExec.exe /X{885A63EA-382B-4DD4-A755-14809B8557D6}
Marvell Miniport Driver-->MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
Nikon Transfer-->MsiExec.exe /X{E9757890-7EC5-46C8-99AB-B00F07B6525C}
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\Setup.exe -runfromtemp -l0x040c -removeonly
SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe" -l0x40c -removeonly
XviD MPEG-4 Video Codec-->C:\WINDOWS\system32\rundll32.exe setupapi,InstallHinfSection Remove_XviD 132 C:\WINDOWS\INF\xvid.inf
ZoneAlarm-->C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe

======Security center information======

FW: ZoneAlarm Firewall (disabled)

System event log

Computer Name: WYLL
Event Code: 10005
Message: DCOM a reçu l'erreur "%1058" lors de la mise en route du service SENS avec les arguments ""
pour démarrer le serveur :
{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}

Record Number: 5
Source Name: DCOM
Time Written: 20090311131627.000000+060
Event Type: erreur
User: AUTORITE NT\SYSTEM

Computer Name: WYLL
Event Code: 10
Message: Ce lecteur ne semble pas prendre en charge la lecture audio numérique.

Record Number: 4
Source Name: redbook
Time Written: 20090311130253.000000+060
Event Type: Informations
User:

Computer Name: WYLL
Event Code: 1001
Message: L'ordinateur a redémarré après une vérification d'erreur. La vérification d'erreur était :
0x000000c2 (0x00000007, 0x00000cd4, 0x00000001, 0x8a32e828).
Un vidage a été enregistré dans : C:\WINDOWS\Minidump\Mini031109-08.dmp.

Record Number: 3
Source Name: Save Dump
Time Written: 20090311130228.000000+060
Event Type: Informations
User:

Computer Name: WYLL
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20090311130227.000000+060
Event Type: Informations
User:

Computer Name: WYLL
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090311130227.000000+060
Event Type: Informations
User:

Application event log

Computer Name: WYLL
Event Code: 1000
Message: Les compteurs de performances pour le service TermService (Services Terminal Server) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090311131445.000000+060
Event Type: Informations
User:

Computer Name: WYLL
Event Code: 1001
Message: Les compteurs de performances pour le service TermService (Services Terminal Server) ont été supprimés.
Les données d'enregistrement contiennent les nouvelles valeurs du dernier compteur système
et les dernières entrées du registre d'aide.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090311131445.000000+060
Event Type: Informations
User:

Computer Name: WYLL
Event Code: 1002
Message: Les compteurs de performances pour le service RSVP (QoS RSVP) existent déjà dans le Registre
des performances. Il n'est pas nécessaire de les réinstaller.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090311131435.000000+060
Event Type: Informations
User:

Computer Name: WYLL
Event Code: 1002
Message: Les compteurs de performances pour le service PSched (Planificateur de paquets QoS) existent déjà dans le Registre
des performances. Il n'est pas nécessaire de les réinstaller.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090311131435.000000+060
Event Type: Informations
User:

Computer Name: WYLL
Event Code: 1002
Message: Les compteurs de performances pour le service RemoteAccess (Routage et accès distant) existent déjà dans le Registre
des performances. Il n'est pas nécessaire de les réinstaller.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090311131431.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 11, GenuineIntel
"PROCESSOR_REVISION"=0f0b
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"tvdumpflags"=8
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip

-----------------EOF-----------------

-) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -)

et le rapport log :

Logfile of random's system information tool 1.05 (written by random/random)
Run by WYLL at 2009-03-13 10:39:19
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 88 GB (88%) free of 100 GB
Total RAM: 2047 MB (85% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:39:23, on 13/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\Drivers\WTSRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\WINDOWS\system32\WTClient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\WYLL\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\WYLL.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,EXPLORER.EXE
O2 - BHO: Google plugin - {085E2757-F41D-42d1-B4CC-9DADF7113BBC} - aj32.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [WTClient] WTClient.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://J:\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'jx8007.dll' missing
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (Contrôleur de DownloadManager) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FBEEC868-97A9-4C6B-928D-6CB0106AAD26}: Domain = 10.0.0.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2.2 - Apache Software Foundation - K:\xampplite\apache\bin\apache.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: mysql - Unknown owner - K:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE

Le navigateur se connecte.

Tout marche comme sur des roulettes !

Voici le rapport avec les virus supprimes :

ComboFix 09-03-12.01 - WYLL 2009-03-13 14:00:41.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.2047.1709 [GMT 1:00]
Lancé depuis: c:\documents and settings\WYLL\Bureau\ComboFix.exe
FW: ZoneAlarm Firewall *disabled*
* Un nouveau point de restauration a été créé

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\n6t1h.cmd
c:\windows\system32\AutoRun.inf
c:\windows\system32\ckvo.exe
c:\windows\system32\ckvo0.dll
c:\windows\system32\tmp.reg
J:\Autorun.inf
J:\n6t1h.cmd
K:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_npf


((((((((((((((((((((((((((((( Fichiers créés du 2009-02-13 au 2009-03-13 ))))))))))))))))))))))))))))))))))))
.

2009-03-12 18:20 . 2009-03-12 18:20 <REP> d-------- c:\windows\ERUNT
2009-03-12 18:12 . 2009-03-12 18:28 <REP> d-------- C:\SDFix
2009-03-12 17:17 . 2009-03-12 17:17 <REP> d-------- C:\rsit
2009-03-12 17:16 . 2009-03-12 17:16 <REP> d-------- c:\program files\Trend Micro
2009-03-11 13:18 . 2006-03-02 13:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll
2009-03-11 13:17 . 2006-03-02 13:00 1,677,824 --a--c--- c:\windows\system32\dllcache\chsbrkr.dll
2009-03-11 13:15 . 2009-03-11 13:15 749 -rah----- c:\windows\WindowsShell.Manifest
2009-03-11 13:15 . 2009-03-11 13:15 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest
2009-03-11 13:15 . 2009-03-11 13:15 749 -rah----- c:\windows\system32\sapi.cpl.manifest
2009-03-11 13:15 . 2009-03-11 13:15 749 -rah----- c:\windows\system32\ncpa.cpl.manifest
2009-03-11 13:15 . 2009-03-11 13:15 488 -rah----- c:\windows\system32\logonui.exe.manifest
2009-03-11 13:03 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET7F.tmp
2009-03-11 13:03 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET7B.tmp
2009-03-11 13:03 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SETBE.tmp
2009-03-11 13:03 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET8D.tmp
2009-03-11 12:56 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET78.tmp
2009-03-11 12:56 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET72.tmp
2009-03-11 12:56 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SETB6.tmp
2009-03-11 12:56 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET86.tmp
2009-03-11 09:17 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SETB5.tmp
2009-03-11 09:17 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET85.tmp
2009-03-11 09:16 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET77.tmp
2009-03-11 09:16 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET71.tmp
2009-03-11 09:11 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET70.tmp
2009-03-11 09:11 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET6A.tmp
2009-03-11 09:11 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SETAC.tmp
2009-03-11 09:11 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET7E.tmp
2009-03-11 09:06 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET6F.tmp
2009-03-11 09:06 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET69.tmp
2009-03-11 09:06 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SETAB.tmp
2009-03-11 09:06 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET7D.tmp
2009-03-11 09:01 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET66.tmp
2009-03-11 09:01 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET62.tmp
2009-03-11 09:01 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SETA4.tmp
2009-03-11 09:01 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET76.tmp
2009-03-11 08:56 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SETA3.tmp
2009-03-11 08:55 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET65.tmp
2009-03-11 08:55 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET61.tmp
2009-03-11 08:55 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET75.tmp
2009-03-11 08:47 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET60.tmp
2009-03-11 08:47 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET5C.tmp
2009-03-11 08:47 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SET9E.tmp
2009-03-11 08:47 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET6C.tmp
2009-03-11 08:42 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET5F.tmp
2009-03-11 08:42 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET5B.tmp
2009-03-11 08:42 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SET9C.tmp
2009-03-11 08:42 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET6B.tmp
2009-03-11 08:36 . 2009-03-11 13:16 2,169,957 --a------ c:\windows\setupapi.log.2.old
2009-03-11 08:36 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET5A.tmp
2009-03-11 08:36 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET56.tmp
2009-03-11 08:36 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET64.tmp
2009-03-11 04:17 . 2009-03-11 03:45 0 --a------ c:\windows\MEMORY.DMP
2009-03-11 03:46 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SET93.tmp
2009-03-11 03:46 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET63.tmp
2009-03-11 03:45 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET59.tmp
2009-03-11 03:45 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET55.tmp
2009-03-11 03:39 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET54.tmp
2009-03-11 03:39 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET50.tmp
2009-03-11 03:39 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SET8C.tmp
2009-03-11 03:39 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET5E.tmp
2009-03-11 03:33 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET53.tmp
2009-03-11 03:33 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET4F.tmp
2009-03-11 03:33 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SET8B.tmp
2009-03-11 03:33 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET5D.tmp
2009-03-11 03:29 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET4E.tmp
2009-03-11 03:29 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET4A.tmp
2009-03-11 03:29 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SET84.tmp
2009-03-11 03:29 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET58.tmp
2009-03-11 03:24 . 2009-03-11 03:53 1,194,902 --a------ c:\windows\setupapi.log.1.old
2009-03-11 03:24 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET4D.tmp
2009-03-11 03:24 . 2006-03-02 13:00 1,013,912 -ra------ c:\windows\SET49.tmp
2009-03-11 03:24 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SET83.tmp
2009-03-11 03:24 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET57.tmp
2009-03-11 03:24 . 2009-03-11 12:56 1,344 --a------ c:\windows\imsins.BAK
2009-03-11 01:00 . 2009-03-11 01:00 <REP> d-------- c:\program files\backups
2009-03-11 00:27 . 2009-03-11 02:22 <REP> d--h----- C:\$AVG8.VAULT$
2009-02-27 17:47 . 2009-02-27 17:48 <REP> d-------- C:\musique
2009-02-16 17:58 . 2009-02-16 18:04 <REP> d-------- C:\[u]0/u9_02_16pompiers

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-13 13:03 18,006,048 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-13 13:02 216,164 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-12 10:40 4,542 ----a-w c:\program files\hijackthis.log
2009-03-11 12:21 196,608 ----a-w c:\windows\system32\drivers\nStandard.bin
2009-03-10 21:53 --------- d-----w c:\program files\Fichiers communs\Adobe
2009-02-16 22:52 --------- d-----w c:\program files\Fichiers communs\Nikon
2009-02-16 22:51 0 ---h--w c:\documents and settings\All Users\Application Data\PKP_DLdw.DAT
2009-02-16 16:29 20 ---h--w c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2009-02-09 15:35 --------- d-----w c:\program files\Fichiers communs\Softwin
2009-01-27 13:56 --------- d-----w c:\documents and settings\WYLL\Application Data\Nikon
2009-01-27 13:54 --------- d-----w c:\program files\Nikon
2009-01-27 13:54 --------- d-----w c:\program files\Fichiers communs\muvee Technologies
2009-01-27 13:54 --------- d-----w c:\documents and settings\All Users\Application Data\Nikon
2009-01-27 13:51 --------- d--h--w c:\documents and settings\All Users\Application Data\EnterNHelp
2009-01-27 13:51 --------- d-----w c:\documents and settings\All Users\Application Data\Ultima_T15
2008-11-05 11:59 528,384 ----a-w c:\program files\PowerLaserExpress_1.0_ENG.exe
2006-06-23 06:48 32,768 ----a-r c:\windows\inf\UpdateUSB.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2006-03-02 15360]
"EXPLORER.EXE"="EXPLORER.EXE" [2006-03-02 c:\windows\explorer.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-03-21 1953792]
"ASUSGamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-07-12 380928]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"nwiz"="nwiz.exe" [2007-06-28 c:\windows\system32\nwiz.exe]
"WTClient"="WTClient.exe" [2007-04-11 c:\windows\system32\WTClient.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.VP40"= vp4vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

R2 Apache2.2;Apache2.2;k:\xampplite\apache\bin\apache.exe [2008-08-28 17408]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [2007-12-20 176128]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2007-12-20 13532]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - explorer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - explorer.exe
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: Convertir les liens sélectionnés en fichier Adobe PDF - j:\adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
FF - ProfilePath - c:\documents and settings\WYLL\Application Data\Mozilla\Firefox\Profiles\jeysk3pq.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-13 14:03:14
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1275210071-1614895754-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
------------------------ Autres processus actifs ------------------------
.
k:\xampplite\mysql\bin\mysqld-nt.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\drivers\WTSrv.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiadap.exe
.
**************************************************************************
.
Heure de fin: 2009-03-13 14:04:32 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-03-13 13:04:30

Avant-CF: 92 658 262 016 octets libres
Après-CF: 92,623,118,336 octets libres

209 --- E O F --- 2008-04-24 17:20:20

-) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -) -)

La console de recuperation est instalee.

Merci pour l'aide !