Virus Bagle qui revient tout le temps !

slt
tu as bien viré tout tes cracks! car sinon l'infection revien!

puis

Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau

sous le nom de antibagle. Fais le avant que le fichier ne soit enregistré sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

_______________________

mets un rapport FINDYKILL option 1

Tous les cracks ont bien été supprimés. J'ai installé et lancé combofix comme vous m'avez indiqué mais au démarrage du programme une fenêtre bleu s'ouvre et cela me met : Le texte du message associé au numéro 0*8 est introuvable dans le fichier de messages pour System.
Merci de patienter. Combofix s'apprête à démarrer. Failed to get data for "enableLVA"
Pourtant j'ai bien fermé tous les programmes , mon antivirus et pare feu sont désactivé d toute façon étant donné qu'il ne s'ouvre plus à cause du virus.

EDIT: Oula je corrige, le programme continu, il se lance bien en fait désolé, j'attends la fin pour poster le rapport.

ok à plus

Alors voici les rapports de combofix et findykill, tout deux lancés en mode sans échec:

Combofix:

ComboFix 09-04-19.01 - SYSTEM 20/04/2009 13:38.1 - NTFSx86 NETWORK
Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.33.1036.18.2037.1663 [GMT 2:00]
Lancé depuis: c:\windows\system32\config\systemprofile\Desktop\antibagle.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\InfoSat.txt
C:\install.exe
c:\users\Atypikk\x.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-03-20 au 2009-04-20 ))))))))))))))))))))))))))))))))))))
.

2009-04-20 10:11 . 2009-04-20 10:11 -------- d--h--r C:\AHCache
2009-04-20 02:33 . 2009-04-20 11:10 -------- d-----w C:\FindyKill
2009-04-20 01:38 . 2009-04-20 01:38 -------- d-----w c:\program files\Avira
2009-04-20 01:38 . 2009-04-20 01:38 -------- d-----w c:\progra~2\Avira
2009-04-19 19:22 . 2009-04-19 19:22 -------- d-sha-r C:\autorun.inf
2009-04-19 17:31 . 2009-04-19 17:31 0 ---ha-w C:\ntuser.dat.LOG2
2009-04-19 17:31 . 2009-04-19 17:31 0 ---ha-w C:\ntuser.dat.LOG1
2009-04-19 17:31 . 2009-04-19 17:31 0 ----a-w C:\ntuser.dat
2009-04-19 12:10 . 2009-04-19 12:10 -------- d-----w c:\windows\System32\config\SYSTEM~1\AppData\Roaming\Malwarebytes
2009-04-19 12:10 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-19 12:10 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-19 12:10 . 2009-04-19 12:11 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-19 12:10 . 2009-04-19 12:10 -------- d-----w c:\progra~2\Malwarebytes
2009-04-19 10:14 . 2009-04-19 10:14 -------- d-----w c:\windows\System32\config\SYSTEM~1\AppData\Local\Mozilla
2009-04-19 01:09 . 2009-04-19 01:09 -------- d--h--w c:\windows\System32\config\SYSTEM~1\AppData\Roaming\drivers
2009-04-19 01:07 . 2009-04-20 11:43 -------- d-----w c:\windows\System32\config\SYSTEM~1\AppData\Local\Temp
2009-04-18 13:31 . 2009-04-18 18:06 -------- d-----w c:\users\Atypikk\album
2009-04-17 14:23 . 2009-04-19 19:13 -------- d-----w c:\program files\Fou-de-fric
2009-04-17 13:00 . 2009-04-17 13:00 -------- d-----w c:\users\Atypikk\vw
2009-04-17 13:00 . 2009-04-17 13:00 -------- d-----w c:\users\Atypikk\VisualRoute
2009-04-17 11:49 . 2009-04-19 19:07 -------- d-----w c:\program files\NeoTrace Express
2009-04-17 00:44 . 2009-04-17 00:44 -------- d-----w c:\program files\WinPcap
2009-04-17 00:43 . 2009-04-19 19:14 -------- d-----w c:\program files\Cain
2009-04-17 00:01 . 2009-04-17 00:01 -------- d-----w c:\program files\Netscape
2009-04-16 23:41 . 2009-04-16 23:41 -------- d-----w c:\program files\A4Proxy
2009-04-16 23:31 . 2009-04-16 23:32 -------- d-----w C:\Identity Cloaker
2009-04-16 19:15 . 2009-04-16 23:19 -------- d-----w c:\program files\MultiProxy
2009-04-15 15:55 . 2009-04-19 18:10 -------- d-----r c:\program files\Skype
2009-04-13 18:09 . 2009-04-13 18:10 28 ----a-w c:\windows\system\ATMAIL.AT
2009-04-13 18:09 . 2009-04-13 18:10 26 ----a-w c:\windows\system\ATINFO.AT
2009-04-13 18:09 . 2009-04-13 18:10 12 ----a-w c:\windows\system\ATNAME.AT
2009-03-28 15:09 . 2009-03-28 15:11 -------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2009-03-28 15:09 . 2009-03-28 15:09 -------- d-----w c:\progra~2\WLInstaller
2009-03-28 14:19 . 2009-03-28 14:19 -------- d-----w c:\program files\SharpDevelop
2009-03-28 14:14 . 2009-03-28 14:16 -------- d-----w c:\program files\Microsoft Visual Studio 8
2009-03-28 14:14 . 2009-03-28 14:14 -------- d-----w c:\program files\Microsoft.NET
2009-03-24 16:54 . 2009-03-27 13:39 -------- d-----w c:\windows\system32\Adobe
2009-03-23 12:35 . 2009-03-23 12:35 -------- d-----w c:\users\Atypikk\repliks atypikk

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-20 11:10 . 2009-04-20 11:10 704 ----a-w C:\FindyKill.txt
2009-04-20 10:10 . 2008-11-22 17:50 120840 ----a-w c:\windows\System32\config\SYSTEM~1\AppData\Local\GDIPFONTCACHEV1.DAT
2009-04-20 10:09 . 2006-11-02 12:59 1356 ----a-w c:\windows\System32\config\SYSTEM~1\AppData\Local\d3d9caps.dat
2009-04-19 21:39 . 2008-05-22 04:28 -------- d-----w c:\program files\Google
2009-04-19 19:25 . 2008-01-21 07:23 697248 ----a-w c:\windows\System32\perfh00C.dat
2009-04-19 19:25 . 2008-01-21 07:23 136102 ----a-w c:\windows\System32\perfc00C.dat
2009-04-19 19:15 . 2008-11-25 11:32 -------- d-----w c:\progra~2\Spybot - Search & Destroy
2009-04-19 19:13 . 2008-11-22 21:04 -------- d-----w c:\program files\Gimp-2.0
2009-04-19 19:11 . 2008-05-22 03:47 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-19 01:10 . 2008-11-22 18:13 -------- d-----w c:\program files\DAEMON Tools Lite
2009-04-17 12:03 . 2009-02-16 12:55 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-17 02:33 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-17 01:32 . 2008-11-25 11:32 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-12 14:27 . 2009-01-08 14:58 268 ---ha-w C:\sqmdata06.sqm
2009-04-12 14:27 . 2009-01-08 14:58 244 ---ha-w C:\sqmnoopt06.sqm
2009-04-10 06:04 . 2009-02-28 17:14 -------- d-----w c:\program files\polytrans
2009-03-28 15:11 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstrng.dat
2009-03-28 15:11 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstor.dat
2009-03-28 15:11 . 2006-11-02 10:25 51200 ----a-w c:\windows\Inf\infpub.dat
2009-03-28 15:09 . 2009-02-16 12:55 -------- d-----w c:\program files\Windows Live
2009-03-28 14:18 . 2008-05-22 04:08 -------- d-----w c:\progra~2\Microsoft Help
2009-03-28 09:25 . 2009-01-08 11:50 268 ---ha-w C:\sqmdata05.sqm
2009-03-28 09:25 . 2009-01-08 11:50 244 ---ha-w C:\sqmnoopt05.sqm
2009-03-27 14:58 . 2009-01-07 23:28 268 ---ha-w C:\sqmdata04.sqm
2009-03-27 14:58 . 2009-01-07 23:28 244 ---ha-w C:\sqmnoopt04.sqm
2009-03-27 14:15 . 2008-12-09 17:08 268 ---ha-w C:\sqmdata03.sqm
2009-03-27 14:15 . 2008-12-09 17:08 244 ---ha-w C:\sqmnoopt03.sqm
2009-03-27 07:13 . 2008-12-08 22:46 268 ---ha-w C:\sqmdata02.sqm
2009-03-27 07:13 . 2008-12-08 22:46 244 ---ha-w C:\sqmnoopt02.sqm
2009-03-26 19:20 . 2008-12-08 21:16 268 ---ha-w C:\sqmdata01.sqm
2009-03-26 19:20 . 2008-12-08 21:16 244 ---ha-w C:\sqmnoopt01.sqm
2009-03-26 17:15 . 2008-12-08 17:46 268 ---ha-w C:\sqmdata00.sqm
2009-03-26 17:15 . 2008-12-08 17:46 244 ---ha-w C:\sqmnoopt00.sqm
2009-03-26 15:48 . 2009-01-14 12:46 268 ---ha-w C:\sqmdata19.sqm
2009-03-26 15:48 . 2009-01-14 12:46 244 ---ha-w C:\sqmnoopt19.sqm
2009-03-26 13:04 . 2009-01-14 00:38 268 ---ha-w C:\sqmdata18.sqm
2009-03-26 13:04 . 2009-01-14 00:38 244 ---ha-w C:\sqmnoopt18.sqm
2009-03-26 10:21 . 2009-01-13 00:19 268 ---ha-w C:\sqmdata17.sqm
2009-03-26 10:21 . 2009-01-13 00:19 244 ---ha-w C:\sqmnoopt17.sqm
2009-03-25 20:44 . 2009-01-11 20:39 268 ---ha-w C:\sqmdata16.sqm
2009-03-25 20:44 . 2009-01-11 20:39 244 ---ha-w C:\sqmnoopt16.sqm
2009-03-25 07:02 . 2009-01-11 14:15 268 ---ha-w C:\sqmdata15.sqm
2009-03-25 07:02 . 2009-01-11 14:15 244 ---ha-w C:\sqmnoopt15.sqm
2009-03-24 22:11 . 2009-01-11 01:14 268 ---ha-w C:\sqmdata14.sqm
2009-03-24 22:11 . 2009-01-11 01:14 244 ---ha-w C:\sqmnoopt14.sqm
2009-03-24 12:04 . 2009-01-10 23:01 268 ---ha-w C:\sqmdata13.sqm
2009-03-24 12:04 . 2009-01-10 23:01 244 ---ha-w C:\sqmnoopt13.sqm
2009-03-24 10:26 . 2009-01-10 22:26 268 ---ha-w C:\sqmdata12.sqm
2009-03-24 10:26 . 2009-01-10 22:26 244 ---ha-w C:\sqmnoopt12.sqm
2009-03-24 10:06 . 2009-01-10 21:37 268 ---ha-w C:\sqmdata11.sqm
2009-03-24 10:06 . 2009-01-10 21:37 244 ---ha-w C:\sqmnoopt11.sqm
2009-03-23 20:59 . 2008-11-30 21:49 -------- d-----w c:\program files\particleIllusion_3
2009-03-23 17:52 . 2009-01-10 21:16 268 ---ha-w C:\sqmdata10.sqm
2009-03-23 17:52 . 2009-01-10 21:16 244 ---ha-w C:\sqmnoopt10.sqm
2009-03-23 16:01 . 2009-01-09 22:57 268 ---ha-w C:\sqmdata09.sqm
2009-03-23 16:01 . 2009-01-09 22:57 244 ---ha-w C:\sqmnoopt09.sqm
2009-03-22 20:00 . 2009-01-08 22:39 268 ---ha-w C:\sqmdata08.sqm
2009-03-22 20:00 . 2009-01-08 22:39 244 ---ha-w C:\sqmnoopt08.sqm
2009-03-22 11:48 . 2009-01-08 15:03 268 ---ha-w C:\sqmdata07.sqm
2009-03-22 11:48 . 2009-01-08 15:03 244 ---ha-w C:\sqmnoopt07.sqm
2009-03-19 19:28 . 2009-02-25 18:59 -------- d-----w c:\program files\RapidCheck
2009-03-17 03:38 . 2009-04-16 09:42 40960 ----a-w c:\windows\AppPatch\apihex86.dll
2009-03-17 03:38 . 2009-04-16 09:42 13824 ----a-w c:\windows\System32\apilogen.dll
2009-03-17 03:38 . 2009-04-16 09:42 24064 ----a-w c:\windows\System32\amxread.dll
2009-03-12 21:12 . 2009-03-04 10:36 -------- d-----w c:\program files\The Game Creators
2009-03-09 22:58 . 2009-03-09 22:57 -------- d-----w c:\program files\MilkShape 3D 1.8.2
2009-03-08 20:34 . 2009-02-24 07:32 -------- d-----w c:\program files\GStudio7
2009-03-08 18:32 . 2009-03-02 22:12 -------- d-----w c:\program files\Magic Swf2Avi 2008
2009-03-08 13:57 . 2009-03-08 13:42 -------- d-----w c:\program files\Amabilis
2009-03-07 17:29 . 2009-03-04 23:03 -------- d-----w c:\program files\FPI Maker
2009-03-07 15:33 . 2009-03-07 15:04 -------- d-----w c:\program files\fragMOTION 0.9.1a
2009-03-04 19:07 . 2009-03-04 19:07 -------- d-----w c:\program files\Metal Fence
2009-03-04 13:49 . 2009-01-04 19:54 178228 ----a-w c:\windows\OG WWII Content Pack #1 for FPSC Uninstaller.exe
2009-03-03 11:34 . 2009-03-02 21:37 -------- d-----w c:\program files\Internet Download Manager
2009-03-03 04:46 . 2009-04-16 09:42 3599328 ----a-w c:\windows\System32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-16 09:42 3547632 ----a-w c:\windows\System32\ntoskrnl.exe
2009-03-03 04:40 . 2009-04-16 09:42 827392 ----a-w c:\windows\System32\wininet.dll
2009-03-03 04:39 . 2009-04-16 09:42 183296 ----a-w c:\windows\System32\sdohlp.dll
2009-03-03 04:39 . 2009-04-16 09:42 551424 ----a-w c:\windows\System32\rpcss.dll
2009-03-03 04:39 . 2009-04-16 09:42 26112 ----a-w c:\windows\System32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-16 09:42 78336 ----a-w c:\windows\System32\ieencode.dll
2009-03-03 04:37 . 2009-04-16 09:42 98304 ----a-w c:\windows\System32\iasrecst.dll
2009-03-03 04:37 . 2009-04-16 09:42 54784 ----a-w c:\windows\System32\iasads.dll
2009-03-03 04:37 . 2009-04-16 09:42 44032 ----a-w c:\windows\System32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-16 09:42 666624 ----a-w c:\windows\System32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-16 09:42 17408 ----a-w c:\windows\System32\iashost.exe
2009-03-03 02:28 . 2009-04-16 09:42 26624 ----a-w c:\windows\System32\ieUnatt.exe
2009-03-02 22:35 . 2008-11-22 18:19 -------- d---a-w c:\progra~2\TEMP
2009-03-02 22:09 . 2009-02-17 00:07 -------- d-----w c:\progra~2\Messenger Plus!
2009-03-01 16:26 . 2009-03-01 16:26 -------- d-----w c:\program files\Real Alternative
2009-02-28 21:44 . 2009-02-28 21:44 -------- d-----w c:\program files\The Foundry
2009-02-28 02:27 . 2009-02-28 02:27 -------- d-----w c:\program files\GenArts
2009-02-28 00:03 . 2009-02-28 00:03 163532 ---ha-w c:\windows\System32\mlfcache.dat
2009-02-27 16:55 . 2009-02-27 16:55 -------- d-----w c:\program files\Intelore
2009-02-27 01:35 . 2009-02-27 01:28 -------- d-----w c:\progra~2\Autodesk
2009-02-27 01:32 . 2009-02-27 01:27 -------- d-----w c:\program files\Autodesk
2009-02-27 01:32 . 2009-02-27 01:28 -------- d-----w c:\program files\Common Files\Autodesk Shared
2009-02-26 10:22 . 2009-02-26 10:22 -------- d-----w c:\program files\WMV9_VCM
2009-02-26 10:22 . 2009-02-26 10:22 -------- d-----w c:\program files\Common Files\MAGIX Shared
2009-02-26 10:22 . 2009-02-26 10:22 -------- d-----w c:\progra~2\MAGIX
2008-12-14 12:52 . 2008-12-14 12:52 76 --sh--r c:\windows\3DXCT.BIN
2008-12-13 18:30 . 2008-12-13 18:30 76 --sh--r c:\windows\ICSET30.BIN
2008-11-24 21:27 . 2008-11-24 21:27 16384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-11-24 21:27 . 2008-11-24 21:27 32768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-11-24 21:27 . 2008-11-24 21:27 16384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2006-05-03 10:06 . 2009-03-02 21:52 163328 --sh--r c:\windows\System32\flvDX.dll
2007-02-21 11:47 . 2009-03-02 21:52 31232 --sh--r c:\windows\System32\msfDX.dll
2008-03-16 13:30 . 2009-03-02 21:52 216064 --sh--r c:\windows\System32\nbDX.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-22 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-22 133656]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-05-13 768520]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-07-21 159744]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-18 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2008-12-23 6707744]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2009-04-20 266497]
"Creative SB Monitoring Utility"="sbavmon.dll" - c:\windows\System32\SBAVMon.dll [2008-07-01 94720]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"UacDisableNotify"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=CLKERN.DLL,c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKLM\~\startupfolder\C:^Users^Atypikk^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\users\Atypikk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-609385513-1770226948-2333106635-1000]
"EnableNotificationsRef"=dword:00000005

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{3F53DBAA-E0E8-4148-ACBD-A9C33804D543}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{EDB90C08-40C1-478C-BFD3-B2BD1ADDDE68}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{7B0614EA-1126-4747-A4EE-F8ECE4E0D6D7}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{F6CAA00F-027A-4A97-BA22-7523E39600E3}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{847C8A95-32EB-4F75-8CBE-A4F723CEFE6C}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{3AB68FA2-8AB1-45E0-B685-14876A649D7D}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"TCP Query User{89BD4F9C-43F0-4097-98D6-5D3E6FE0F9D2}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{E20CB990-F8BC-4344-9DA4-A8FC49BDDA26}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{4104D711-16D2-4203-8957-5CEE8D7607A6}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent (TCP-In)
"{6E245268-C313-48E5-AC8F-C9A7A8D1F394}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent (UDP-In)
"{773B088C-80E3-41C7-8984-75478A6C30A8}"= UDP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk
"{4A726E37-3FE9-44EF-8F3A-FB4A93974BBB}"= TCP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk
"TCP Query User{FE077429-CB09-46F5-872F-F76E4AF883F7}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet
"UDP Query User{44ED50E5-E215-47F1-82E2-6E7BE6620D88}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet
"TCP Query User{A6D767C3-554E-406E-90C1-B08239A8BCC6}c:\\program files\\free download manager\\fdm.exe"= UDP:c:\program files\free download manager\fdm.exe:Free Download Manager
"UDP Query User{E6F20FF4-C5FD-4E0D-8B46-14D3C682CDA6}c:\\program files\\free download manager\\fdm.exe"= TCP:c:\program files\free download manager\fdm.exe:Free Download Manager
"{D6FFC918-24C3-4145-9FFA-ABDFF7415BDC}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{7C5D164E-79F7-4E13-8129-4EA1F78B32AB}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{947BDA31-8AF5-4A5B-A40B-B49DB75FAF58}c:\\program files\\adobe\\adobe after effects 7.0\\support files\\afterfx.exe"= UDP:c:\program files\adobe\adobe after effects 7.0\support files\afterfx.exe:Adobe After Effects
"UDP Query User{3BC0A234-9A45-4E7F-8F1A-796CF1461DEB}c:\\program files\\adobe\\adobe after effects 7.0\\support files\\afterfx.exe"= TCP:c:\program files\adobe\adobe after effects 7.0\support files\afterfx.exe:Adobe After Effects
"{84384510-6C2C-42D2-A293-1BB19C150CE6}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{E6F6E6FB-4D57-4B6C-977A-F685390A8568}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D73E3085-A474-45D8-AD1E-F2ACA154EBAE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{397BD4D2-F808-46A1-9CED-BB0D90262E2B}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{78ACB41B-4E1E-43F6-A4C5-7321BC492843}"= UDP:c:\program files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor
"{1066429D-94C9-4932-9F80-F8E820A33F7E}"= TCP:c:\program files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor
"{75F73747-2CA4-43D0-B7E6-1B7D31FAF871}"= UDP:c:\program files\Autodesk\Backburner\manager.exe:backburner 2.3 manager
"{A6C8290F-CEE9-4C40-84B9-5D556F776F89}"= TCP:c:\program files\Autodesk\Backburner\manager.exe:backburner 2.3 manager
"{F5925B13-2024-4D0E-BC6F-2D5366859AB4}"= UDP:c:\program files\Autodesk\Backburner\server.exe:backburner 2.3 server
"{A236DB2D-5FC5-4A45-A5D1-33C4AEBFA583}"= TCP:c:\program files\Autodesk\Backburner\server.exe:backburner 2.3 server
"{03238F13-FF79-4E92-AC00-B80FBB242DAE}"= UDP:c:\program files\Autodesk\3ds Max 2009\3dsmax.exe:Autodesk 3ds Max 2009 32-bit
"{856AAF04-13AA-40F6-81E7-4F26A714BE14}"= TCP:c:\program files\Autodesk\3ds Max 2009\3dsmax.exe:Autodesk 3ds Max 2009 32-bit
"{D7C6981D-CCB5-4899-9302-450C86BBCCF7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{E37AF3C4-FC5C-4F71-B6DC-CD056B7C5B1D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{89FEDCB3-DE9C-460E-A8B2-6DEE0C6B1ABF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C18DA80C-623F-4A56-85E8-A2CE5C57CBB6}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{986DC2CF-E255-4DF0-B73B-060A24542C9A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{9CC00FD0-36D8-45FD-A933-0E3FAA2BE15A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EBA2E69E-9385-4E0A-93DB-A602FDEE33F1}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{9ED4EBB0-ED77-485D-9A9B-CBF700482E34}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D9773A72-46C4-4DA5-831B-9F8FF71889EF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CEC9D11A-D534-4D80-A5D7-1D2A76438096}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{727289E8-1036-4723-B077-DA1C2CC77F18}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{04112C5E-2AF2-4436-9B20-A292B2FFB52B}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{34E489A9-7C81-4535-921E-8AE8FDAC8582}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B27793F8-E8DD-4CC5-AE81-1A229E8351BF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{922847E6-F1B6-4C5D-9E9B-F382EFA4BEE2}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{2F6BFE98-3320-4B09-AD68-4D4F2B8A11F5}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{27900B1A-E555-44C4-8081-4740B448A130}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0B2FD470-0340-498A-AE95-06511949679C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{4665BBD2-95A3-48FE-9045-AF0F66A58263}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{4DF8B2A2-8855-4364-A85A-7D542B3706DC}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{854832CF-EFBB-4415-A862-0C77B545EA9A}c:\\users\\atypikk\\appdata\\local\\temp\\rar$ex02.182\\atomicmail4.exe"= UDP:c:\users\atypikk\appdata\local\temp\rar$ex02.182\atomicmail4.exe:atomicmail4.exe
"UDP Query User{B0A0C069-DE61-479D-8746-9867AD8EAC3E}c:\\users\\atypikk\\appdata\\local\\temp\\rar$ex02.182\\atomicmail4.exe"= TCP:c:\users\atypikk\appdata\local\temp\rar$ex02.182\atomicmail4.exe:atomicmail4.exe
"TCP Query User{259F7EDE-8E29-4B11-9990-E045DE45BEBC}c:\\users\\atypikk\\appdata\\local\\temp\\rar$ex06.380\\atomicmail4.exe"= UDP:c:\users\atypikk\appdata\local\temp\rar$ex06.380\atomicmail4.exe:atomicmail4.exe
"UDP Query User{486C4891-9A51-4FE9-9D1B-57D18E3B1471}c:\\users\\atypikk\\appdata\\local\\temp\\rar$ex06.380\\atomicmail4.exe"= TCP:c:\users\atypikk\appdata\local\temp\rar$ex06.380\atomicmail4.exe:atomicmail4.exe
"TCP Query User{3A2C7E48-CB16-428B-A5A6-CFE97799981B}c:\\users\\atypikk\\appdata\\local\\temp\\rar$ex10.153\\atomicmail4.exe"= UDP:c:\users\atypikk\appdata\local\temp\rar$ex10.153\atomicmail4.exe:atomicmail4.exe
"UDP Query User{B1909165-D6E8-4BE8-850D-F749CB760799}c:\\users\\atypikk\\appdata\\local\\temp\\rar$ex10.153\\atomicmail4.exe"= TCP:c:\users\atypikk\appdata\local\temp\rar$ex10.153\atomicmail4.exe:atomicmail4.exe
"{BEBFC290-5AD2-4436-8CF4-958D2B6E513E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{53FAAB70-FE55-455C-819B-854EEB7F5B5C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{7A399566-27EF-41A5-9F1E-7F90DA7DEFC8}c:\\program files\\multiproxy\\mproxy.exe"= UDP:c:\program files\multiproxy\mproxy.exe:MultiProxy personal proxy server
"UDP Query User{4C4A64B4-96C5-42B4-BE7F-75ED7947129A}c:\\program files\\multiproxy\\mproxy.exe"= TCP:c:\program files\multiproxy\mproxy.exe:MultiProxy personal proxy server
"{D5547728-9462-46D5-B6B7-FCB03B2B45E9}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{FB5370A7-324B-485D-8638-2E57690BB9B6}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B386A741-48B5-467E-8768-ADE75F746EBE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7CBAA8AA-C188-4461-AC6E-91027067933C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A79B038E-76C0-4363-95A7-B729D971474E}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R1 hwinterface;hwinterface;c:\windows\system32\Drivers\hwinterface.sys [2009-02-24 3026]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
R2 ETService;Empowering Technology Service;c:\program files\EMACHINES\eMachines Recovery Management\Service\ETService.exe [2008-04-03 24576]
R2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [2008-03-09 65536]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-06 50424]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2009-01-30 79360]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-01-30 79360]
R3 EditHexaDisk;EditHexaDisk;c:\program files\EditHexa\EditHexaDisk.sys [2008-02-04 6144]
R3 ksaud;Creative USB Audio Driver;c:\windows\system32\drivers\ksaud.sys [2008-07-30 490112]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-06-29 42512]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-07-22 180736]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - ECACHE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-eRecoveryService - (no file)

.
------- Examen supplémentaire -------
.
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=&Br=EM&Loc=FRN_FR&Sys=PTB&M=eMachines E510
FF - ProfilePath - c:\windows\System32\config\SYSTEM~1\AppData\Roaming\Mozilla\Firefox\Profiles\av97ng5m.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-20 13:43
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-04-20 13:44
ComboFix-quarantined-files.txt 2009-04-20 11:44

Avant-CF: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Après-CF: 22 716 387 328 octets libres

313 --- E O F --- 2009-04-20 10:24

Findykill:

############################## [ FindyKill V4.725 ]

# User : SYSTEM () # PC-DE-ATYPIKK
# Update on 19/04/09 by Chiquitine29
# Start at: 14:01:01 | 20/04/2009
# Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

# Genuine Intel(R) CPU T1400 @ 1.73GHz
# Microsoft® Windows Vista™ Édition Familiale Basique (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 7.0.6001.18000
# Windows Firewall Status : Disabled

# C:\ # Disque fixe local # 101,78 Go (21,19 Go free) [OS] # NTFS
# D:\ # Disque CD-ROM
# F:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## [ Infected File \ Folder ]

################## [ Infected Temp Files ]

################## [ Registre / Clés infectieuses ]

colle un rapport avec malwarebyte et antivir pour voir si c'est ok . À plus