Infection Trojan horse Agent2.CUX

Logfile of random's system information tool 1.06 (written by random/random)
Run by Utilisateur at 2009-04-06 10:39:14
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 68 GB (45%) free of 153 GB
Total RAM: 1015 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:39:30, on 2009-04-06
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\MétéoMédia\MétéoÉclair\WeatherEye.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\Webshots\Webshots.scr
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\Content.IE5\HRX3IEUZ\RSIT[1].exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\Utilisateur.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Qgudayidado] rundll32.exe "C:\WINDOWS\erawoniqivuxege.dll",e
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\MétéoMédia\MétéoÉclair\WeatherEye.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD7/JSCDL/jdk/6u13-b03/jinstall-6u13-windows-i586-jc.cab?AuthParam=1238768273_a3ce3dbe14413d7c9ce87946e29606dd&GroupName=JSC&FilePath=/ESD7/JSCDL/jdk/6u13-b03/jinstall-6u13-windows-i586-jc.cab&File=jinstall-6u13-windows-i586-jc.cab&BHost=javadl.sun.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\WINDOWS\System32\drprov32.dll
O20 - Winlogon Notify: 40326c56573 - C:\WINDOWS\System32\drprov32.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: __c00C004E - C:\WINDOWS\system32\__c00C004E.dat (file missing)
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

info.txt logfile of random's system information tool 1.06 2009-04-06 10:39:32

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
AIDA32 v3.93-->"C:\Program Files\AIDA32 - Personal System Information\unins000.exe"
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
AVG 8.5-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
CanoScan Toolbox 4.1-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BCE46757-7674-4416-BEDB-68205A60409E}\Setup.exe" -l0x40c anything
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
DFX for Winamp-->C:\Program Files\DFX\uninstall_Winamp.exe
Encyclopédie Microsoft Encarta 2000-->"C:\Program Files\Microsoft Encarta\Encyclopédie Encarta 2000\unee2000.exe" /uninstall
FrostWire 4.17.2-->C:\Program Files\FrostWire\Uninstall.exe
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
Intel(R) Extreme Graphics 2 Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
IZArc 3.6-->"C:\Program Files\IZArc\unins000.exe"
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
jetAudio Basic-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}\setup.exe" -l0xc0c -removeonly
Ma-Config.com-->MsiExec.exe /X{560BD6E0-0BA6-43AF-B423-E1DF4D2EB3C3}
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works 2000-->MsiExec.exe /I{A3088CD2-612B-11D3-AF43-00C04F443448}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Paint Shop Pro 7 ESD-->MsiExec.exe /I{D6DE02C7-1F47-11D4-9515-00105AE4B89A}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Webshots Desktop-->"C:\Program Files\Webshots\unins000.exe"
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}

======Hosts File======

0.0.0.0 virusinfo.info
0.0.0.0 www.virusinfo.info
0.0.0.0 projecthoneypot.org
0.0.0.0 www.projecthoneypot.org
0.0.0.0 novirus.ru
0.0.0.0 www.novirus.ru
0.0.0.0 www.anti-malware.com
0.0.0.0 zeustracker.abuse.ch
0.0.0.0 www.zeustracker.abuse.ch
0.0.0.0 www.malekal.com

======Security center information======

AV: AVG Anti-Virus Free

======System event log======

Computer Name: COMPAQ
Event Code: 7
Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

Record Number: 20
Source Name: Cdrom
Time Written: 20090325100117.000000-240
Event Type: error
User:

Computer Name: COMPAQ
Event Code: 7
Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

Record Number: 19
Source Name: Cdrom
Time Written: 20090325100110.000000-240
Event Type: error
User:

Computer Name: COMPAQ
Event Code: 7
Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

Record Number: 18
Source Name: Cdrom
Time Written: 20090325100105.000000-240
Event Type: error
User:

Computer Name: COMPAQ
Event Code: 7
Message: Le périphérique \Device\CdRom0 comporte un bloc défectueux.

Record Number: 17
Source Name: Cdrom
Time Written: 20090325100105.000000-240
Event Type: error
User:

Computer Name: COMPAQ
Event Code: 51
Message: Une erreur a été détectée sur le périphérique \Device\CdRom0 au cours d'une opération de pagination.

Record Number: 16
Source Name: Cdrom
Time Written: 20090325100105.000000-240
Event Type: warning
User:

=====Application event log=====

Computer Name: COMPAQ
Event Code: 1001
Message: Détecteur d'erreurs 771809955.

Record Number: 105
Source Name: Application Error
Time Written: 20090403000801.000000-240
Event Type: error
User:

Computer Name: COMPAQ
Event Code: 1000
Message: Application défaillante ctzapxx.exe, version 1.40.0.6, module défaillant user32.dll, version 5.1.2600.5512, adresse de défaillance 0x00016779.

Record Number: 104
Source Name: Application Error
Time Written: 20090403000753.000000-240
Event Type: error
User:

Computer Name: COMPAQ
Event Code: 1000
Message: Application défaillante winamp.exe, version 5.5.4.2165, module défaillant unknown, version 0.0.0.0, adresse de défaillance 0x00730028.

Record Number: 102
Source Name: Application Error
Time Written: 20090402223100.000000-240
Event Type: error
User:

Computer Name: COMPAQ
Event Code: 1001
Message: Détecteur d'erreurs 875439345.

Record Number: 100
Source Name: Application Error
Time Written: 20090402222927.000000-240
Event Type: error
User:

Computer Name: COMPAQ
Event Code: 1000
Message: Application défaillante winamp.exe, version 5.5.4.2165, module défaillant unknown, version 0.0.0.0, adresse de défaillance 0x00730028.

Record Number: 99
Source Name: Application Error
Time Written: 20090402222922.000000-240
Event Type: error
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 3 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0304
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

[b]SDFix: Version 1.240 [/b]
Run by Utilisateur on 2009-04-06 at 11:35

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\Documents and Settings\LocalService\Application Data\sysproc64\sysproc32.sys - Deleted
C:\WINDOWS\system32\sysproc64\sysproc32.sys - Deleted
C:\WINDOWS\system32\sysproc64\sysproc32.sys.cla - Deleted
C:\WINDOWS\system32\sysproc64\sysproc86.sys - Deleted



Folder C:\Documents and Settings\LocalService\Application Data\sysproc64 - Removed
Folder C:\WINDOWS\system32\sysproc64 - Removed


Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-06 11:58:09
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Ex‚cuter une DLL en tant qu'application"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\VieuxDiskC\\StubInstaller.exe"="C:\\VieuxDiskC\\StubInstaller.exe:*:Disabled:LimeWire swarmed installer"
"C:\\Program Files\\FrostWire\\FrostWire.exe"="C:\\Program Files\\FrostWire\\FrostWire.exe:*:Enabled:FrostWire"
"C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Enabled:Windows Shell"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="C:\\Program Files\\AVG\\AVG8\\avgnsx.exe:*:Enabled:avgnsx.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Wed 19 Sep 2007 848 A.SH. --- "C:\VieuxDiskC\WINDOWS\system32\KGyGaAvL.sys"
Thu 25 Oct 2007 10,028,150 A.SH. --- "C:\VieuxDiskC\WINDOWS\Temp\$_2341233.TMP"
Sun 12 Nov 2006 8 A.SH. --- "C:\VieuxDiskC\WINDOWS\Temp\$_2341235.TMP"
Sun 24 Oct 2004 4,348 A.SH. --- "C:\VieuxDiskC\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 4 Jan 2008 169 A..H. --- "C:\VieuxDiskC\Program Files\InterActual\InterActual Player\iti8F.tmp"
Fri 12 Nov 2004 37,376 A..H. --- "C:\VieuxDiskC\Program Files\Fichiers communs\Adobe\ESD\DLMCleanup.exe"
Thu 22 Jan 2009 246,304 A..H. --- "C:\VieuxDiskC\WINDOWS\SoftwareDistribution\Download\5213340213efd8fcb83f1bfeb41dacf3\BIT4.tmp"
Thu 26 Feb 2009 3,551,794 A..H. --- "C:\VieuxDiskC\WINDOWS\SoftwareDistribution\Download\fb4da36766e26322554115638628df9d\BIT5.tmp"

[b]Finished![/b]

Voila le rapport

Malwarebytes' Anti-Malware 1.35
Version de la base de données: 1945
Windows 5.1.2600 Service Pack 3

2009-04-06 18:17:48
mbam-log-2009-04-06 (18-17-48).txt

Type de recherche: Examen rapide
Eléments examinés: 67625
Temps écoulé: 3 minute(s), 27 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 17

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qgudayidado (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\WINDOWS\system32\NetworkService32 (Worm.Archive) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\NetworkService32\85.crack.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\85.crack.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\86.keygen.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\86.keygen.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\87.serial.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\87.serial.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\88.setup.zip (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\88.setup.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\89.music.mp3 (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\89.music.mp3.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\90.music.snd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\90.music.snd.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\91.music.au (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\91.music.au.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\92.VIDEO.WMV (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NetworkService32\92.video.wmv.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\elofitiz.dll (Trojan.Agent) -> Delete on reboot.

Apres la desinfection avec Malwarebytes, AVG m'a encore signalé trojan horse Agent2.CUX dans C:\Systeme Volume Information\restore[901004EF-668D-4DC5-A334-29C34A38DBD9]RP10\A0006647.dll mais cette fois j'ai pus faire Heal avec succes...

Voila, je ne sais pas si tout est ok car a la premiere fenetre bleu je n'Ai pas eu le temps de taper 1, juste le temps de jetter un oeil a ma feuille d'instructuction et combofix s'était deja lancé delui-meme dans son analyse....
Voici le rapport obtenu

ComboFix 09-04-04.01 - Utilisateur 2009-04-07 9:59:03.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1015.763 [GMT -4:00]
Lancé depuis: c:\documents and settings\Utilisateur\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Utilisateur\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((( Fichiers créés du 2009-03-07 au 2009-04-07 ))))))))))))))))))))))))))))))))))))
.

2009-04-06 17:22 . 2009-04-06 17:22 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-04-06 17:22 . 2009-04-06 17:22 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\Malwarebytes
2009-04-06 17:22 . 2009-04-06 17:22 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-06 17:22 . 2009-03-26 16:49 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 17:22 . 2009-03-26 16:49 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-04-06 13:41 . 2009-04-06 13:41 <REP> d-------- c:\program files\AVG
2009-04-06 11:31 . 2009-04-06 11:32 <REP> d-------- c:\windows\ERUNT
2009-04-06 11:22 . 2009-04-06 12:00 <REP> d-------- C:\SDFix
2009-04-06 10:39 . 2009-04-06 10:39 <REP> d-------- C:\rsit
2009-04-06 10:39 . 2009-04-06 10:39 <REP> d-------- c:\program files\trend micro
2009-04-06 09:08 . 2009-04-06 20:16 <REP> d--h----- C:\$AVG8.VAULT$
2009-04-05 18:52 . 2009-04-05 18:52 <REP> d-------- c:\program files\CCleaner
2009-04-05 16:49 . 2009-04-05 16:49 <REP> d-------- c:\windows\report
2009-04-05 16:49 . 2009-04-05 16:48 22,722,697 --a------ c:\windows\LPT$VPN.943
2009-04-05 15:58 . 2009-04-07 09:54 <REP> d-------- c:\documents and settings\All Users\Application Data\avg8
2009-04-05 11:00 . 2009-04-05 11:00 <REP> d-------- c:\program files\Alwil Software
2009-04-05 11:00 . 2003-03-18 16:20 1,060,864 --a------ c:\windows\system32\MFC71.dll
2009-04-05 11:00 . 2003-03-18 15:14 499,712 --a------ c:\windows\system32\MSVCP71.dll
2009-04-05 11:00 . 2003-02-20 22:42 348,160 --a------ c:\windows\system32\MSVCR71.dll
2009-04-05 10:33 . 2009-04-05 10:33 615 --a------ c:\windows\system32\8xatL.vbs
2009-04-05 10:32 . 2009-04-05 10:32 615 --a------ c:\windows\system32\boXP8EYm2zx9N.vbs
2009-04-05 10:31 . 2009-04-05 10:31 615 --a------ c:\windows\system32\uXWcT9a.vbs
2009-04-05 10:31 . 2009-04-05 10:31 615 --a------ c:\windows\system32\1xI25uPvJB38R.vbs
2009-04-05 10:30 . 2009-04-05 10:30 615 --a------ c:\windows\system32\rWI8x8p0yva0Ki0.vbs
2009-04-05 10:15 . 2009-04-05 10:26 <REP> d-------- c:\program files\Incomplete
2009-04-05 10:14 . 2009-04-05 10:27 <REP> d-------- c:\program files\FrostWire
2009-04-05 10:14 . 2009-04-05 10:47 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\FrostWire
2009-04-05 09:56 . 2009-04-05 09:56 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\COWON
2009-04-05 09:46 . 2009-04-05 10:03 <REP> d-------- c:\program files\JetAudio
2009-04-05 09:46 . 2009-04-05 09:46 <REP> d-------- c:\program files\Fichiers communs\COWON
2009-04-03 14:14 . 2009-04-03 14:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-04-03 10:16 . 2009-04-03 10:16 <REP> d-------- c:\windows\Sun
2009-04-03 10:16 . 2009-04-03 10:16 <REP> d-------- c:\program files\Java
2009-04-03 10:16 . 2009-04-03 10:16 410,984 --a------ c:\windows\system32\deploytk.dll
2009-04-03 10:16 . 2009-04-03 10:16 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-04-03 09:57 . 2009-04-03 09:58 <REP> d--h----- c:\windows\msdownld.tmp
2009-04-03 09:57 . 2009-04-03 09:57 <REP> d-------- c:\windows\Logs
2009-04-03 09:47 . 2009-04-03 22:57 <REP> d-------- c:\program files\Sonicism Digital Audio Solutions
2009-04-03 09:47 . 2004-03-29 15:45 551,936 --a------ c:\windows\th_inst2.exe
2009-04-03 08:24 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2009-04-03 08:24 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
2009-04-03 08:24 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2009-04-03 03:40 . 2009-04-03 03:40 <REP> d-------- c:\program files\Fichiers communs\Adobe
2009-04-03 03:33 . 2009-04-03 03:33 <REP> d-------- c:\program files\Messenger Plus! Live
2009-04-02 23:59 . 2009-04-02 23:59 <REP> d-------- c:\program files\MP3Gain
2009-04-02 21:49 . 2009-04-07 10:01 3,888 --a------ c:\windows\system32\BMXCtrlState-{00000005-00000000-00000004-00001102-00000002-80671102}.rfx
2009-04-02 21:49 . 2009-04-07 10:01 3,888 --a------ c:\windows\system32\BMXBkpCtrlState-{00000005-00000000-00000004-00001102-00000002-80671102}.rfx
2009-04-02 21:47 . 2009-04-02 21:53 <REP> d-------- c:\program files\Microsoft Money
2009-04-02 21:44 . 2009-04-02 21:44 <REP> d-------- c:\program files\Microsoft Encarta
2009-04-02 21:38 . 2009-04-02 21:40 <REP> d-------- c:\program files\Microsoft Works
2009-04-02 21:26 . 2009-04-02 23:49 33 --a------ c:\windows\iltwain.ini
2009-04-02 21:23 . 2009-04-02 21:23 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\ArcSoft
2009-04-02 21:09 . 2009-04-02 21:10 25 --a------ c:\windows\mixerdef.ini
2009-04-02 21:04 . 2009-04-02 21:04 <REP> d-------- c:\documents and settings\Utilisateur\.limewire
2009-04-02 18:17 . 2009-04-02 19:02 <REP> d-------- c:\program files\eMule
2009-04-02 17:19 . 2009-04-02 17:19 <REP> d-------- c:\program files\Microsoft
2009-04-02 17:19 . 2009-04-07 10:02 <REP> d-------- c:\documents and settings\Utilisateur\Tracing
2009-04-02 17:18 . 2009-04-02 17:18 <REP> d-------- c:\program files\Windows Live SkyDrive
2009-04-02 17:18 . 2009-04-02 17:19 <REP> d-------- c:\program files\Windows Live
2009-04-02 17:16 . 2009-04-02 17:16 <REP> d-------- c:\program files\Fichiers communs\Windows Live
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\program files\Fichiers communs\DFX
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\program files\DFX
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\documents and settings\SUPPORT_388945a0
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\documents and settings\Invité
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\documents and settings\HelpAssistant
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\documents and settings\All Users\Application Data\DFX
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\documents and settings\Administrateur
2009-04-02 09:32 . 2009-04-05 09:46 <REP> d--h----- c:\program files\InstallShield Installation Information
2009-04-02 09:32 . 2009-04-02 21:16 <REP> d-------- c:\program files\Canon
2009-04-01 22:20 . 2009-04-01 22:25 <REP> d-------- c:\program files\Webshots
2009-04-01 22:20 . 2009-04-01 22:20 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\Webshots
2009-04-01 22:15 . 2009-04-01 22:15 <REP> d-------- c:\program files\MétéoMédia
2009-04-01 20:22 . 2009-04-01 20:22 <REP> d-------- c:\program files\ma-config.com
2009-04-01 20:22 . 2009-04-01 20:22 <REP> d-------- c:\documents and settings\All Users\Application Data\ma-config.com
2009-04-01 20:14 . 2009-04-01 20:14 <REP> d-------- c:\program files\AIDA32 - Personal System Information
2009-04-01 19:06 . 2009-04-03 02:01 <REP> d-------- c:\program files\Winamp
2009-04-01 19:06 . 2009-04-03 02:01 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\Winamp
2009-04-01 19:06 . 2007-03-07 19:51 129,784 --------- c:\windows\system32\pxafs.dll
2009-04-01 19:06 . 2007-03-07 19:51 43,528 --------- c:\windows\system32\drivers\PxHelp20.sys
2009-04-01 19:06 . 2007-03-07 19:51 9,464 --------- c:\windows\system32\drivers\cdralw2k.sys
2009-04-01 19:06 . 2007-03-07 19:51 9,336 --------- c:\windows\system32\drivers\cdr4_xp.sys
2009-04-01 19:03 . 2009-04-01 19:03 <REP> d-------- c:\program files\IZArc
2009-04-01 19:02 . 2009-04-01 19:02 <REP> d-------- c:\program files\Jasc Software Inc
2009-04-01 19:01 . 2009-04-05 09:45 <REP> d-------- c:\program files\Fichiers communs\InstallShield
2009-04-01 18:51 . 2001-08-23 17:47 173,056 --a------ c:\windows\system32\LXAESUI.DLL
2009-04-01 18:51 . 2008-04-13 11:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-04-01 18:51 . 2008-04-13 11:47 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys
2009-03-31 11:21 . 2009-03-31 11:21 <REP> d-------- c:\windows\system32\Adobe
2009-03-31 10:46 . 2009-03-31 10:46 <REP> d-------- c:\program files\vanBasco's Karaoke Player
2009-03-31 10:37 . 2009-03-31 10:37 <REP> d-------- c:\program files\Microsoft FrontPage Express
2009-03-31 10:31 . 2009-03-31 10:31 <REP> d-------- c:\program files\Corel
2009-03-31 10:31 . 2009-03-31 10:31 <REP> d-------- c:\program files\C-Media
2009-03-31 10:31 . 2009-03-31 10:31 <REP> d-------- c:\program files\byLight
2009-03-31 10:31 . 2009-04-02 22:42 <REP> d-------- c:\program files\Audacity
2009-03-31 10:31 . 2009-03-31 10:31 <REP> d-------- c:\program files\ArcSoft
2009-03-31 09:50 . 2009-04-02 11:13 <REP> d-------- c:\program files\Creative
2009-03-31 09:50 . 2003-03-05 12:19 15,840 --------- c:\windows\system32\drivers\PFMODNT.SYS
2009-03-31 07:53 . 2009-03-31 07:53 <REP> d-------- c:\documents and settings\Utilisateur\Contacts
2009-03-31 07:28 . 2009-04-07 09:21 <REP> d-------- C:\VieuxDiskC
2009-03-30 17:23 . 2001-08-17 20:19 3,712 --a------ c:\windows\system32\drivers\ctljystk.sys
2009-03-30 17:23 . 2001-08-17 20:19 3,712 --a--c--- c:\windows\system32\dllcache\ctljystk.sys
2009-03-30 17:22 . 2008-04-13 11:45 10,624 --a------ c:\windows\system32\drivers\gameenum.sys
2009-03-30 17:22 . 2008-04-13 11:45 10,624 --a--c--- c:\windows\system32\dllcache\gameenum.sys
2009-03-30 17:08 . 2008-04-13 11:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-03-30 17:08 . 2008-04-13 11:45 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2009-03-30 17:08 . 2008-04-13 19:33 21,504 --a------ c:\windows\system32\hidserv.dll
2009-03-30 17:08 . 2008-04-13 19:33 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2009-03-30 17:08 . 2008-04-13 19:05 14,720 --a------ c:\windows\system32\drivers\kbdhid.sys
2009-03-30 17:08 . 2008-04-13 19:05 14,720 --a--c--- c:\windows\system32\dllcache\kbdhid.sys
2009-03-30 17:08 . 2008-04-13 11:45 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2009-03-30 17:08 . 2008-04-13 11:45 10,368 --a--c--- c:\windows\system32\dllcache\hidusb.sys
2009-03-25 13:01 . 2005-09-20 09:36 147,456 --a------ c:\windows\system32\igfxres.dll
2009-03-25 11:42 . 2008-12-20 18:46 6,066,688 -----c--- c:\windows\system32\dllcache\ieframe.dll
2009-03-25 11:42 . 2007-04-17 05:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2009-03-25 11:42 . 2007-03-08 01:10 1,048,576 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2009-03-25 11:42 . 2008-12-20 18:46 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2009-03-25 11:42 . 2008-12-20 18:46 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2009-03-25 11:42 . 2008-12-20 18:46 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2009-03-25 11:42 . 2008-12-20 18:46 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2009-03-25 11:42 . 2008-12-20 18:46 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2009-03-25 11:42 . 2008-12-19 05:10 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
2009-03-25 11:24 . 2008-10-24 07:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-03-25 11:23 . 2008-08-14 09:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-03-25 11:23 . 2008-08-14 09:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-03-25 11:23 . 2008-08-14 09:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-05 20:48 91,744 ----a-w c:\windows\BPMNT.dll
2009-04-05 20:48 71,749 ----a-w c:\windows\hcextoutput.dll
2009-04-05 20:48 69,689 ----a-w c:\windows\UNZIP.DLL
2009-04-05 20:48 507,904 ----a-w c:\windows\TMUPDATE.DLL
2009-04-05 20:48 348,741 ----a-w c:\windows\tsc.exe
2009-04-05 20:48 1,213,784 ----a-w c:\windows\vsapi32.dll
2009-03-25 13:55 --------- d-----w c:\program files\microsoft frontpage
2009-03-25 13:54 --------- d-----w c:\program files\Services en ligne
.

((((((((((((((((((((((((((((( SnapShot@2009-04-06_13.19.00.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-14 11:00:00 159,232 ----a-w c:\windows\axufozujecaz.dll
+ 2009-04-07 14:01:57 16,384 ----atw c:\windows\temp\Perflib_Perfdata_1cc.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-03 148888]
"Qgudayidado"="c:\windows\axufozujecaz.dll" [2008-04-14 159232]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2008-12-20 c:\windows\system32\advpack.dll]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Rappels du Calendrier Microsoft Works.lnk - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [1999-08-06 53317]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli wilaseu.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=

S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-03-15 216232]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce3477c3-1d70-11de-b013-806d6172696f}]
\Shell\AutoRun\command - e:\hbcd\wintools\autorun.exe
\Shell\Option1\Command - e:\hbcd\wintools\autorun.exe
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ca/
Trusted Zone: secuser.com\www
Handler: ms-its51 - {F6F1E82D-DE4D-11D2-875C-0000F8105754} - c:\program files\Fichiers communs\Microsoft Shared\Information Retrieval\itss51.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-07 10:02:08
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(704)
c:\windows\wilaseu.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Heure de fin: 2009-04-07 10:03:53 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-04-07 14:03:39
ComboFix2.txt 2009-04-06 17:19:39

Avant-CF: 83 586 191 360 octets libres
Après-CF: 83,583,320,064 octets libres

219

désolée mais le lien pour findykill ne fonctionne pas...

a l'occasion pourquoi? il est dangeureux?

Slt
merci pour les compliments, j'ai juste voulu aidé puisque ce programme est suspendu pourquoi on me l'a donné
et ce n'est pas gentil d'insulté les autres parce que tu métrise l'outil informatique;et le straité avec un mépris.
désolé si j'ai trompé et avoir commis un erreur, Bonne chance excellente fin de journée.

Re
M. Ced_King ne soit pas si cruel, je t'avais déjà dis que je me suis trompé
et pour Usbfix il figure tjrs dans ma liste que fais-je avec? le supprimé!!!
j'ai tjrs la main tendue alors SVP acceptez mes excuses.
j'attend ta réponse à propos de ce programme
et à propos des conseils ma grand mère me disait il faut tjrs foncer mon petit fils
désolé encore une fois

Voici tous les rapports des dernieres operation avec findykill et aussi avec virustotal, je te les poste un a la suite de l'autre...


############################## [ FindyKill V4.722 ]

# User : Utilisateur (Utilisateurs) # ISABELLE
# Update on 04/04/09 by Chiquitine29
# Start at: 14:12:34 | 2009-04-07
# Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Enabled

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 149,05 Go (79,01 Go free) # NTFS
# D:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ C:\WINDOWS # C:\WINDOWS\Prefetch ]


################## [ C:\WINDOWS\System32... ]


################## [ C:\Documents and Settings\Utilisateur\Application Data ]


################## [ C:\Documents and Settings\Utilisateur...\Temp Files... ]


################## [ Registre / Clés infectieuses ]



################## [ Recherche dans supports amovibles]

# Recherche fichiers connus :


################## [ Registre / Mountpoint2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.722 ! ]

suite-->

Symantec 1.4.4.12 2009.04.07 -
TheHacker 6.3.4.0.303 2009.04.07 -
TrendMicro 8.700.0.1004 2009.04.07 -
VBA32 3.12.10.2 2009.04.07 -
ViRobot 2009.4.7.1682 2009.04.07 -
VirusBuster 4.6.5.0 2009.04.07 -
Information additionnelle
File size: 159232 bytes
MD5...: 54a14e29c2ade9d30a9b315011047b82
SHA1..: 499258e8e9f9d1c5dbd25dbee00dd9288b90a621
SHA256: adb1a83ff08372b11749ac10f1a65a15fe1bd28350f204b1c8b095827b0b3084
SHA512: 03422aca4cee130227d9398568f7f8b2f7b3e820004a9b8e583b58450ee51c2f
8cc69c1830d6512605860ed95069e143d435eceaac995d2a834956bdcaa6fe0e
ssdeep: 3072:ugWrddtGDJ7/Uio8KHWkbiR/h+gpfm15mFbeI6r5vlFdityvZGe:ugWrtGD
J7HVKhboW5mFyT3diK

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x6640
timedatestamp.....: 0x490c543e (Sat Nov 01 13:06:06 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x28000 0x13000 7.90 ab9a9edbd98a748c66b0f7bde3325a28
.data 0x29000 0x13000 0x12800 6.31 a2c0471f9124297ab2e5ac9c5cb74a56
.rsrc 0x3c000 0x1000 0x400 2.45 34b3fe9e94f0af295d951683b3bee796
.reloc 0x3d000 0x1000 0x200 3.19 ce80dcbe4732bf3a1f1f401154480ecb

( 5 imports )
> KERNEL32.dll: CompareStringA, ExitProcess, FlushFileBuffers, GetACP, GetModuleHandleA, GetOEMCP, GetStartupInfoA, HeapAlloc, HeapCreate, HeapReAlloc, SetProcessWorkingSetSize, lstrlenA
> msvcrt.dll: wcslen, _except_handler3, free, isdigit, malloc, printf, strspn, wcscmp, _XcptFilter
> user32.dll: CreateDialogParamA, DeferWindowPos, DrawMenuBar, GetClientRect, IsWindowVisible, LoadIconA, ReleaseCapture, CloseClipboard, DispatchMessageA
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -
> SHLWAPI.dll: PathFileExistsA, PathGetCharTypeA, SHQueryInfoKeyA, SHSetValueA, StrStrA, SHEnumKeyExA, PathCombineA

( 4 exports )
CaptureDeviceDialog, Direct3DCreateDevice, GetNewCatalog, MIDL_user_free

RDS...: NSRL Reference Data Set
-

Suite -->Symantec 1.4.4.12 2009.04.07 -
TheHacker 6.3.4.0.303 2009.04.07 -
TrendMicro 8.700.0.1004 2009.04.07 -
VBA32 3.12.10.2 2009.04.07 -
ViRobot 2009.4.7.1682 2009.04.07 -
VirusBuster 4.6.5.0 2009.04.07 -
Information additionnelle
File size: 45056 bytes
MD5...: 3055f860ee83627e68ea78953b87b80c
SHA1..: 7c07dfc18f24573049b4fb60044a9143914b64de
SHA256: ba13f504f691ea87958a42c3f7fbfa01ac10605fee2ca03a93a8ea0ef405c007
SHA512: fc91c57bcc2e3a203bdd9769bf28cdc247098d8488d4399dba70eb2353cf695f c3269f603cc672c83a029e154d72e1989b99d7e427fa34dabb5ddd38686e78ee
ssdeep: 768:ImGBWOBKUVjuKB1+rwTw856xIhbfbBw4waHo5/1iuXf4GJoMN:IL/KUhuUj0
8kxIFsaIdFv4GJoMN

PEiD..: -
TrID..: File type identification
Win64 Executable Generic (80.9%)
Win32 Executable Generic (8.0%)
Win32 Dynamic Link Library (generic) (7.1%)
Generic Win/DOS Executable (1.8%)
DOS Executable Generic (1.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x616c
timedatestamp.....: 0x4901ebdb (Fri Oct 24 15:38:03 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x8000 0x7600 7.58 458e1a022647e5f887329595a0fdb34e
.data 0x9000 0x3000 0x2400 6.22 8909202c0ed7a0956a5eca0166eb1e0e
.rsrc 0xc000 0x1000 0x400 2.80 7c8331ff25fbae657993b83ddacacc53
.reloc 0xd000 0x1000 0x200 2.64 51268da6577e9499be8a2b9e2da72c52

( 5 imports )
> KERNEL32.dll: DuplicateHandle, ExitProcess, ExpandEnvironmentStringsA, FreeEnvironmentStringsW, GetACP, GetEnvironmentVariableA, GetModuleHandleA, GetOEMCP, GetStartupInfoA, GetSystemInfo, HeapAlloc, HeapCreate, IsValidCodePage, RaiseException, RtlUnwind, SetErrorMode, SetEvent
> msvcrt.dll: malloc, wcslen, _except_handler3
> user32.dll: LoadMenuA, SendMessageA, DeferWindowPos, DestroyIcon, GetFocus
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -
> SHLWAPI.dll: PathFileExistsA, SHQueryInfoKeyA, StrChrA, StrRStrIA, StrToIntA, StrStrIA, PathBuildRootA

( 0 exports )

RDS...: NSRL Reference Data Set
-
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=03E8F2AB00BF4BB7B00A00EC43C71200F8970F8D' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=03E8F2AB00BF4BB7B00A00EC43C71200F8970F8D</a>

ComboFix 09-04-04.01 - Utilisateur 2009-04-07 19:35:11.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1015.709 [GMT -4:00]
Lancé depuis: c:\documents and settings\Utilisateur\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Utilisateur\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\autorun.inf

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-03-07 au 2009-04-07 ))))))))))))))))))))))))))))))))))))
.

2009-04-07 14:33 . 2008-04-13 11:45 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2009-04-07 14:11 . 2009-04-07 14:36 <REP> d-------- C:\FindyKill
2009-04-06 17:22 . 2009-04-06 17:22 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-04-06 17:22 . 2009-04-06 17:22 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\Malwarebytes
2009-04-06 17:22 . 2009-04-06 17:22 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-06 17:22 . 2009-03-26 16:49 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 17:22 . 2009-03-26 16:49 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-04-06 13:41 . 2009-04-06 13:41 <REP> d-------- c:\program files\AVG
2009-04-06 11:31 . 2009-04-06 11:32 <REP> d-------- c:\windows\ERUNT
2009-04-06 11:22 . 2009-04-06 12:00 <REP> d-------- C:\SDFix
2009-04-06 10:39 . 2009-04-06 10:39 <REP> d-------- C:\rsit
2009-04-06 10:39 . 2009-04-06 10:39 <REP> d-------- c:\program files\trend micro
2009-04-06 09:08 . 2009-04-06 20:16 <REP> d--h----- C:\$AVG8.VAULT$
2009-04-05 18:52 . 2009-04-05 18:52 <REP> d-------- c:\program files\CCleaner
2009-04-05 16:49 . 2009-04-05 16:49 <REP> d-------- c:\windows\report
2009-04-05 16:49 . 2009-04-05 16:48 22,722,697 --a------ c:\windows\LPT$VPN.943
2009-04-05 15:58 . 2009-04-07 09:54 <REP> d-------- c:\documents and settings\All Users\Application Data\avg8
2009-04-05 11:00 . 2009-04-05 11:00 <REP> d-------- c:\program files\Alwil Software
2009-04-05 11:00 . 2003-03-18 16:20 1,060,864 --a------ c:\windows\system32\MFC71.dll
2009-04-05 11:00 . 2003-03-18 15:14 499,712 --a------ c:\windows\system32\MSVCP71.dll
2009-04-05 11:00 . 2003-02-20 22:42 348,160 --a------ c:\windows\system32\MSVCR71.dll
2009-04-05 10:33 . 2009-04-05 10:33 615 --a------ c:\windows\system32\8xatL.vbs
2009-04-05 10:32 . 2009-04-05 10:32 615 --a------ c:\windows\system32\boXP8EYm2zx9N.vbs
2009-04-05 10:31 . 2009-04-05 10:31 615 --a------ c:\windows\system32\uXWcT9a.vbs
2009-04-05 10:31 . 2009-04-05 10:31 615 --a------ c:\windows\system32\1xI25uPvJB38R.vbs
2009-04-05 10:30 . 2009-04-05 10:30 615 --a------ c:\windows\system32\rWI8x8p0yva0Ki0.vbs
2009-04-05 10:15 . 2009-04-05 10:26 <REP> d-------- c:\program files\Incomplete
2009-04-05 10:14 . 2009-04-05 10:27 <REP> d-------- c:\program files\FrostWire
2009-04-05 10:14 . 2009-04-05 10:47 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\FrostWire
2009-04-05 09:56 . 2009-04-05 09:56 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\COWON
2009-04-05 09:46 . 2009-04-05 10:03 <REP> d-------- c:\program files\JetAudio
2009-04-05 09:46 . 2009-04-05 09:46 <REP> d-------- c:\program files\Fichiers communs\COWON
2009-04-03 14:14 . 2009-04-03 14:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-04-03 10:16 . 2009-04-03 10:16 <REP> d-------- c:\windows\Sun
2009-04-03 10:16 . 2009-04-03 10:16 <REP> d-------- c:\program files\Java
2009-04-03 10:16 . 2009-04-03 10:16 410,984 --a------ c:\windows\system32\deploytk.dll
2009-04-03 10:16 . 2009-04-03 10:16 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-04-03 09:57 . 2009-04-03 09:58 <REP> d--h----- c:\windows\msdownld.tmp
2009-04-03 09:57 . 2009-04-03 09:57 <REP> d-------- c:\windows\Logs
2009-04-03 09:47 . 2009-04-03 22:57 <REP> d-------- c:\program files\Sonicism Digital Audio Solutions
2009-04-03 09:47 . 2004-03-29 15:45 551,936 --a------ c:\windows\th_inst2.exe
2009-04-03 08:24 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2009-04-03 08:24 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
2009-04-03 08:24 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2009-04-03 03:40 . 2009-04-03 03:40 <REP> d-------- c:\program files\Fichiers communs\Adobe
2009-04-03 03:33 . 2009-04-03 03:33 <REP> d-------- c:\program files\Messenger Plus! Live
2009-04-02 23:59 . 2009-04-02 23:59 <REP> d-------- c:\program files\MP3Gain
2009-04-02 21:49 . 2009-04-07 19:37 3,888 --a------ c:\windows\system32\BMXCtrlState-{00000005-00000000-00000004-00001102-00000002-80671102}.rfx
2009-04-02 21:49 . 2009-04-07 19:37 3,888 --a------ c:\windows\system32\BMXBkpCtrlState-{00000005-00000000-00000004-00001102-00000002-80671102}.rfx
2009-04-02 21:47 . 2009-04-02 21:53 <REP> d-------- c:\program files\Microsoft Money
2009-04-02 21:44 . 2009-04-02 21:44 <REP> d-------- c:\program files\Microsoft Encarta
2009-04-02 21:38 . 2009-04-02 21:40 <REP> d-------- c:\program files\Microsoft Works
2009-04-02 21:26 . 2009-04-02 23:49 33 --a------ c:\windows\iltwain.ini
2009-04-02 21:23 . 2009-04-02 21:23 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\ArcSoft
2009-04-02 21:09 . 2009-04-02 21:10 25 --a------ c:\windows\mixerdef.ini
2009-04-02 21:04 . 2009-04-02 21:04 <REP> d-------- c:\documents and settings\Utilisateur\.limewire
2009-04-02 18:17 . 2009-04-02 19:02 <REP> d-------- c:\program files\eMule
2009-04-02 17:19 . 2009-04-02 17:19 <REP> d-------- c:\program files\Microsoft
2009-04-02 17:19 . 2009-04-07 14:09 <REP> d-------- c:\documents and settings\Utilisateur\Tracing
2009-04-02 17:18 . 2009-04-02 17:18 <REP> d-------- c:\program files\Windows Live SkyDrive
2009-04-02 17:18 . 2009-04-02 17:19 <REP> d-------- c:\program files\Windows Live
2009-04-02 17:16 . 2009-04-02 17:16 <REP> d-------- c:\program files\Fichiers communs\Windows Live
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\program files\Fichiers communs\DFX
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\program files\DFX
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\documents and settings\SUPPORT_388945a0
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\documents and settings\Invité
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\documents and settings\HelpAssistant
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\documents and settings\All Users\Application Data\DFX
2009-04-02 11:31 . 2009-04-02 11:31 <REP> d-------- c:\documents and settings\Administrateur
2009-04-02 09:32 . 2009-04-05 09:46 <REP> d--h----- c:\program files\InstallShield Installation Information
2009-04-02 09:32 . 2009-04-02 21:16 <REP> d-------- c:\program files\Canon
2009-04-01 22:20 . 2009-04-01 22:25 <REP> d-------- c:\program files\Webshots
2009-04-01 22:20 . 2009-04-01 22:20 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\Webshots
2009-04-01 22:15 . 2009-04-01 22:15 <REP> d-------- c:\program files\MétéoMédia
2009-04-01 20:22 . 2009-04-01 20:22 <REP> d-------- c:\program files\ma-config.com
2009-04-01 20:22 . 2009-04-01 20:22 <REP> d-------- c:\documents and settings\All Users\Application Data\ma-config.com
2009-04-01 20:14 . 2009-04-01 20:14 <REP> d-------- c:\program files\AIDA32 - Personal System Information
2009-04-01 19:06 . 2009-04-03 02:01 <REP> d-------- c:\program files\Winamp
2009-04-01 19:06 . 2009-04-03 02:01 <REP> d-------- c:\documents and settings\Utilisateur\Application Data\Winamp
2009-04-01 19:06 . 2007-03-07 19:51 129,784 --------- c:\windows\system32\pxafs.dll
2009-04-01 19:06 . 2007-03-07 19:51 43,528 --------- c:\windows\system32\drivers\PxHelp20.sys
2009-04-01 19:06 . 2007-03-07 19:51 9,464 --------- c:\windows\system32\drivers\cdralw2k.sys
2009-04-01 19:06 . 2007-03-07 19:51 9,336 --------- c:\windows\system32\drivers\cdr4_xp.sys
2009-04-01 19:03 . 2009-04-01 19:03 <REP> d-------- c:\program files\IZArc
2009-04-01 19:02 . 2009-04-01 19:02 <REP> d-------- c:\program files\Jasc Software Inc
2009-04-01 19:01 . 2009-04-05 09:45 <REP> d-------- c:\program files\Fichiers communs\InstallShield
2009-04-01 18:51 . 2001-08-23 17:47 173,056 --a------ c:\windows\system32\LXAESUI.DLL
2009-04-01 18:51 . 2008-04-13 11:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-04-01 18:51 . 2008-04-13 11:47 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys
2009-03-31 11:21 . 2009-03-31 11:21 <REP> d-------- c:\windows\system32\Adobe
2009-03-31 10:46 . 2009-03-31 10:46 <REP> d-------- c:\program files\vanBasco's Karaoke Player
2009-03-31 10:37 . 2009-03-31 10:37 <REP> d-------- c:\program files\Microsoft FrontPage Express
2009-03-31 10:31 . 2009-03-31 10:31 <REP> d-------- c:\program files\Corel
2009-03-31 10:31 . 2009-03-31 10:31 <REP> d-------- c:\program files\C-Media
2009-03-31 10:31 . 2009-03-31 10:31 <REP> d-------- c:\program files\byLight
2009-03-31 10:31 . 2009-04-02 22:42 <REP> d-------- c:\program files\Audacity
2009-03-31 10:31 . 2009-03-31 10:31 <REP> d-------- c:\program files\ArcSoft
2009-03-31 09:50 . 2009-04-02 11:13 <REP> d-------- c:\program files\Creative
2009-03-31 09:50 . 2003-03-05 12:19 15,840 --------- c:\windows\system32\drivers\PFMODNT.SYS
2009-03-31 07:53 . 2009-03-31 07:53 <REP> d-------- c:\documents and settings\Utilisateur\Contacts
2009-03-31 07:28 . 2009-04-07 09:21 <REP> d-------- C:\VieuxDiskC
2009-03-30 17:23 . 2001-08-17 20:19 3,712 --a------ c:\windows\system32\drivers\ctljystk.sys
2009-03-30 17:23 . 2001-08-17 20:19 3,712 --a--c--- c:\windows\system32\dllcache\ctljystk.sys
2009-03-30 17:22 . 2008-04-13 11:45 10,624 --a------ c:\windows\system32\drivers\gameenum.sys
2009-03-30 17:22 . 2008-04-13 11:45 10,624 --a--c--- c:\windows\system32\dllcache\gameenum.sys
2009-03-30 17:08 . 2008-04-13 11:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-03-30 17:08 . 2008-04-13 11:45 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2009-03-30 17:08 . 2008-04-13 19:33 21,504 --a------ c:\windows\system32\hidserv.dll
2009-03-30 17:08 . 2008-04-13 19:33 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2009-03-30 17:08 . 2008-04-13 19:05 14,720 --a------ c:\windows\system32\drivers\kbdhid.sys
2009-03-30 17:08 . 2008-04-13 19:05 14,720 --a--c--- c:\windows\system32\dllcache\kbdhid.sys
2009-03-30 17:08 . 2008-04-13 11:45 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2009-03-30 17:08 . 2008-04-13 11:45 10,368 --a--c--- c:\windows\system32\dllcache\hidusb.sys
2009-03-25 13:01 . 2005-09-20 09:36 147,456 --a------ c:\windows\system32\igfxres.dll
2009-03-25 11:42 . 2008-12-20 18:46 6,066,688 -----c--- c:\windows\system32\dllcache\ieframe.dll
2009-03-25 11:42 . 2007-04-17 05:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2009-03-25 11:42 . 2007-03-08 01:10 1,048,576 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2009-03-25 11:42 . 2008-12-20 18:46 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2009-03-25 11:42 . 2008-12-20 18:46 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2009-03-25 11:42 . 2008-12-20 18:46 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2009-03-25 11:42 . 2008-12-20 18:46 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2009-03-25 11:42 . 2008-12-20 18:46 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2009-03-25 11:42 . 2008-12-19 05:10 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
2009-03-25 11:24 . 2008-10-24 07:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-03-25 11:23 . 2008-08-14 09:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-05 20:48 91,744 ----a-w c:\windows\BPMNT.dll
2009-04-05 20:48 71,749 ----a-w c:\windows\hcextoutput.dll
2009-04-05 20:48 69,689 ----a-w c:\windows\UNZIP.DLL
2009-04-05 20:48 507,904 ----a-w c:\windows\TMUPDATE.DLL
2009-04-05 20:48 348,741 ----a-w c:\windows\tsc.exe
2009-04-05 20:48 1,213,784 ----a-w c:\windows\vsapi32.dll
2009-03-25 13:55 --------- d-----w c:\program files\microsoft frontpage
2009-03-25 13:54 --------- d-----w c:\program files\Services en ligne
2009-03-16 18:18 69,448 ----a-w c:\windows\system32\XAPOFX1_3.dll
2009-03-16 18:18 517,448 ----a-w c:\windows\system32\XAudio2_4.dll
2009-03-16 18:18 235,352 ----a-w c:\windows\system32\xactengine3_4.dll
2009-03-16 18:18 22,360 ----a-w c:\windows\system32\X3DAudio1_6.dll
2009-03-09 19:27 453,456 ----a-w c:\windows\system32\d3dx10_41.dll
2009-03-09 19:27 4,178,264 ----a-w c:\windows\system32\D3DX9_41.dll
2009-03-09 19:27 1,846,632 ----a-w c:\windows\system32\D3DCompiler_41.dll
2009-02-10 13:52 1,571,840 ----a-w c:\windows\system32\sfcfiles.dll
2009-02-09 14:05 1,846,912 ----a-w c:\windows\system32\win32k.sys
2009-02-06 22:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-06_13.19.00.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-14 11:00:00 159,232 ----a-w c:\windows\axufozujecaz.dll
+ 2008-04-13 15:45:40 26,368 ----a-w c:\windows\system32\drivers\USBSTOR.SYS
+ 2009-04-07 23:37:54 16,384 ----atw c:\windows\temp\Perflib_Perfdata_548.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-03 148888]
"Qgudayidado"="c:\windows\axufozujecaz.dll" [2008-04-14 159232]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2008-12-20 c:\windows\system32\advpack.dll]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Rappels du Calendrier Microsoft Works.lnk - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [1999-08-06 53317]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli wilaseu.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=

S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-03-15 216232]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce3477c3-1d70-11de-b013-806d6172696f}]
\Shell\AutoRun\command - e:\hbcd\wintools\autorun.exe
\Shell\Option1\Command - e:\hbcd\wintools\autorun.exe
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ca/
Trusted Zone: secuser.com\www
Handler: ms-its51 - {F6F1E82D-DE4D-11D2-875C-0000F8105754} - c:\program files\Fichiers communs\Microsoft Shared\Information Retrieval\itss51.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-07 19:38:14
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(516)
c:\windows\wilaseu.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Heure de fin: 2009-04-07 19:39:45 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-04-07 23:39:25
ComboFix2.txt 2009-04-07 14:03:55
ComboFix3.txt 2009-04-06 17:19:39

Avant-CF: 84 798 046 208 octets libres
Après-CF: 84,818,661,376 octets libres

234

Oui j'ai pourtant bien copier -coller le texte dans CFscript...
Je vais suivre tes dernier conseil et te revenir la dessus