Rootkit dans system32

ok merci v allez voir dans le dossier
mais vus que je ne suis pas trop un crack en informatique
j ai aussi telechargé pc tools c pas ce que cela vas donné mais je vais essayer

merci encore

salut je te poste les deux premier rapports dans l ordre
maintenant je m attaque au dernier point

merci encore ComboFix 09-10-14.09 - krysz 15/10/2009 14:44.1.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3070.1853 [GMT 2:00]
Lancé depuis: c:\users\krysz\Downloads\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-648983067-450269448-3683575503-500
c:\program files\QUAD Utilities
c:\windows\Installer\123c88.msi
c:\windows\Installer\14819f91.msi
c:\windows\Installer\17d7960.msi
c:\windows\Installer\365aae.msp
c:\windows\Installer\3c35bfe.msp
c:\windows\Installer\3c35c00.msp
c:\windows\Installer\42e30.msi
c:\windows\Installer\53966.msi
c:\windows\Installer\5bc591.msp
c:\windows\Installer\731018.msp
c:\windows\Installer\ca033.msp
c:\windows\Installer\e098c8.msp
c:\windows\Installer\e098ca.msp
c:\windows\system32\ban_list.txt

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA
-------\Service_Boonty Games

((((((((((((((((((((((((((((( Fichiers créés du 2009-09-15 au 2009-10-15 ))))))))))))))))))))))))))))))))))))
.

2009-10-15 12:51 . 2009-10-15 12:56 -------- d-----w- c:\users\krysz\AppData\Local\temp
2009-10-15 12:51 . 2009-10-15 12:51 -------- d-----w- c:\users\REMY.PC-de-krysz\AppData\Local\temp
2009-10-15 12:51 . 2009-10-15 12:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-15 12:51 . 2009-10-15 12:51 -------- d-----w- c:\users\REMY\AppData\Local\temp
2009-10-15 04:36 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-15 04:36 . 2009-08-04 12:34 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-15 04:36 . 2009-08-04 12:34 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-13 08:42 . 2008-11-12 14:44 27904 ----a-w- c:\windows\system32\uxtuneup.dll
2009-10-13 08:37 . 2009-10-13 08:37 362240 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-10-12 15:01 . 2009-10-12 15:01 -------- d-----w- c:\program files\trend micro
2009-10-12 15:01 . 2009-10-12 15:01 -------- d-----w- C:\rsit
2009-10-07 01:32 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-07 01:32 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-07 01:32 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-07 01:32 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-07 01:31 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-07 01:31 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-07 01:31 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-07 01:31 . 2009-08-06 17:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-07 01:31 . 2009-08-06 16:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-02 18:29 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-01 10:34 . 2009-10-01 10:34 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-09-28 09:43 . 2009-05-18 12:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-09-28 09:43 . 2008-04-17 11:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-09-28 09:42 . 2009-09-28 09:42 -------- d-----w- c:\program files\iPod
2009-09-28 09:42 . 2009-09-28 09:43 -------- d-----w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-28 09:42 . 2009-09-28 09:43 -------- d-----w- c:\program files\iTunes
2009-09-28 09:40 . 2009-09-28 09:41 -------- d-----w- c:\program files\QuickTime
2009-09-24 06:49 . 2009-09-24 06:49 -------- d-----w- c:\programdata\QUAD Utilities
2009-09-24 05:36 . 2009-09-24 05:36 -------- d-----w- c:\users\krysz\AppData\Local\Cooliris
2009-09-22 04:32 . 2009-09-22 04:32 -------- d-----w- c:\program files\CAPCOM

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-15 12:28 . 2008-05-28 16:41 -------- d-----w- c:\users\krysz\AppData\Roaming\BitTorrent
2009-10-15 09:59 . 2009-07-08 11:56 -------- d-----w- c:\users\krysz\AppData\Roaming\vlc
2009-10-15 05:52 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-10-15 05:42 . 2007-11-02 14:33 -------- d-----w- c:\programdata\Microsoft Help
2009-10-14 10:20 . 2007-11-02 22:31 681474 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-14 10:20 . 2007-11-02 22:31 128676 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-13 12:02 . 2009-04-16 19:50 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-10-13 11:03 . 2008-05-19 11:14 103 ----a-w- c:\windows\popcinfo.dat
2009-10-08 16:53 . 2007-11-02 14:17 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-08 16:39 . 2008-09-30 05:06 -------- d-----w- c:\users\krysz\AppData\Roaming\dvdcss
2009-10-01 10:33 . 2008-04-10 17:45 -------- d-----w- c:\program files\Windows Live
2009-10-01 10:29 . 2009-03-13 13:28 -------- d-----w- c:\program files\Microsoft
2009-10-01 10:27 . 2009-10-01 10:27 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_xusb21_01007.Wdf
2009-09-28 09:44 . 2009-07-25 18:17 -------- d-----w- c:\users\krysz\AppData\Roaming\Apple Computer
2009-09-28 09:42 . 2009-07-25 18:10 -------- d-----w- c:\program files\Common Files\Apple
2009-09-28 09:40 . 2009-07-25 18:14 -------- d-----w- c:\programdata\Apple Computer
2009-09-27 14:02 . 2007-11-02 14:26 -------- d-----w- c:\programdata\Roxio
2009-09-26 06:08 . 2007-11-02 14:20 -------- d-----w- c:\programdata\NVIDIA
2009-09-25 05:54 . 2009-07-25 18:25 -------- d-----w- c:\program files\BitTorrent
2009-09-21 15:17 . 2008-11-07 22:07 -------- d-----w- c:\program files\BitTorrent Fastest Tool
2009-09-21 15:16 . 2009-06-06 18:30 -------- d-----w- c:\program files\Activision
2009-09-21 06:30 . 2009-04-16 19:50 -------- d-sh--w- c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-21 06:19 . 2007-11-02 14:22 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-14 09:29 . 2009-10-15 04:35 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-09-11 02:00 . 2009-05-28 09:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-10 12:54 . 2009-05-28 09:53 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 12:53 . 2009-05-28 09:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-09 12:08 . 2008-12-17 17:24 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-08 19:47 . 2009-09-08 19:22 -------- d-----w- c:\program files\Windows Live Safety Center
2009-09-04 11:41 . 2009-10-15 04:35 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-09-03 07:44 . 2009-09-03 07:44 -------- d-----w- c:\program files\SpeedyFox
2009-08-31 15:21 . 2008-08-03 21:38 -------- d-----w- c:\users\REMY.PC-de-krysz\AppData\Roaming\vlc
2009-08-29 00:27 . 2009-09-02 19:23 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-02 19:23 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-27 05:22 . 2009-10-15 04:35 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 05:17 . 2009-10-15 04:35 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-08-27 05:17 . 2009-10-15 04:35 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-08-27 03:42 . 2009-10-15 04:35 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-08-26 15:45 . 2009-06-18 08:31 -------- d-----w- c:\programdata\WinZip
2009-08-26 15:44 . 2008-12-29 17:10 -------- d-----w- c:\programdata\Media Center Programs
2009-08-26 15:43 . 2008-09-07 17:41 -------- d-----w- c:\users\krysz\AppData\Roaming\uTorrent
2009-08-24 09:33 . 2008-04-11 06:05 -------- d-----w- c:\program files\Common Files\Adobe
2009-08-23 18:44 . 2009-08-23 18:44 -------- d-----w- c:\programdata\GameHouse
2009-08-22 19:52 . 2008-05-19 10:55 -------- d-----w- c:\programdata\Zylom
2009-08-21 15:46 . 2009-08-21 15:46 -------- d-----w- c:\users\krysz\AppData\Roaming\Samsung
2009-08-21 15:44 . 2009-08-21 15:31 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2009-08-21 15:31 . 2009-08-21 15:31 -------- d-----w- c:\program files\Samsung
2009-08-17 21:33 . 2009-08-17 21:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-14 16:27 . 2009-09-09 10:46 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 15:53 . 2009-09-09 10:46 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-09-09 10:46 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-09 10:46 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-09-09 10:46 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-09-09 10:46 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-09-09 10:46 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-09 10:46 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-09-09 10:46 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-09-09 10:46 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-09-09 10:46 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-08 08:14 . 2009-07-27 16:07 89 ----a-w- c:\users\krysz\AppData\Local\bbjemt.bat
2009-08-07 17:51 . 2009-08-07 17:51 15308424 ----a-w- c:\windows\system32\xlive.dll
2009-08-07 17:51 . 2009-08-07 17:51 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2009-07-31 07:03 . 2009-04-12 07:21 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-07-31 07:03 . 2009-04-12 07:21 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-31 07:03 . 2009-04-12 07:21 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-25 06:57 . 2009-07-25 06:05 138464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-07-25 06:57 . 2009-07-25 06:05 111928 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-07-25 06:05 . 2008-04-16 18:42 22328 ----a-w- c:\users\krysz\AppData\Roaming\PnkBstrK.sys
2009-07-25 06:05 . 2009-07-25 06:05 682280 ----a-w- c:\windows\system32\pbsvc.exe
2009-07-25 06:05 . 2009-07-25 06:05 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-07-25 03:23 . 2009-03-17 19:59 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-21 13:46 . 2008-06-27 05:32 680 ----a-w- c:\users\krysz\AppData\Local\d3d9caps.dat
2009-07-17 13:54 . 2009-08-12 05:52 71680 ----a-w- c:\windows\system32\atl.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-11-02 22:44 . 2007-11-02 22:43 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}]
2007-12-10 11:46 1510424 ----a-w- c:\program files\Sigma_Team\tbSig0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 09:58 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}"= "c:\program files\Sigma_Team\tbSig0.dll" [2007-12-10 1510424]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{5A089BCD-C7F1-4064-8702-F58D8BD5D61F}"= "c:\program files\Sigma_Team\tbSig0.dll" [2007-12-10 1510424]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-20 4363504]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"BitTorrent"="c:\program files\BitTorrent\bittorrent.exe" [2009-07-18 653104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 232184]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 77824]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-10-12 520024]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-30 2023704]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 92704]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-03-01 4390912]

c:\users\krysz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-7-3 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
"ArcSoft Connection Service"=c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):9e,ec,78,10,97,4d,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2776800960-564032295-3372925530-1002]
"EnableNotificationsRef"=dword:00000002

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{EF271794-82D8-458C-8C5C-2061AEEDF982}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{6D63E2DC-74A1-4B13-89D3-028CD534CC2C}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{86E3405F-ECD4-4574-99BD-EE44C2E8CDC4}c:\\users\\krysz\\documents\\emule\\emule.exe"= UDP:c:\users\krysz\documents\emule\emule.exe:emule.exe
"UDP Query User{993202AA-4B39-4A22-B37E-18BE9ECAC950}c:\\users\\krysz\\documents\\emule\\emule.exe"= TCP:c:\users\krysz\documents\emule\emule.exe:emule.exe
"{7D21DC6F-210C-4619-B860-73E9C2FFC0AD}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{9E22D647-E1C3-48E9-960E-4DB416BBB385}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"{EABD8D90-B6DA-4F1C-8267-239477D09B27}"= UDP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{14080B2C-BF79-46F0-AB2E-41399F4DB44A}"= TCP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{A177491A-E7B6-40E4-9353-5877ACB1162F}"= UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne
"{C366A5DC-011D-423F-A82B-D3B00405AD1D}"= TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne
"{A9967180-51FA-4207-8969-63B1CDD05ACA}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{94F06DE0-82BC-48D3-B7A0-1A2A3488F9AD}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{63A11F31-6158-4B14-B489-4D99FA8F2552}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{EE752CEF-B766-4928-AC31-94CDD1D11B91}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{716698B4-1516-4FDD-AE5E-A1C3974190A9}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{1D197FA8-D5F0-413D-A4BD-8D181166BAFB}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{B9A19919-0B61-4143-A2D5-3255D0BBEE9A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{50183437-F054-4C21-92FA-2E551AB44A3E}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C670204C-7EB6-4184-9687-3A532181BC2A}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{B3BF4706-9656-4874-BEBF-1A07C6F8085D}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{40AAAC24-7C55-49A8-A839-997AC679A3D8}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{05810B72-FBBF-4EFE-937C-BC0AFCDF4BAF}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{456278B2-09B8-48B7-98A8-1782EC565F42}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live FolderShare

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [12/04/2009 09:21 12552]
R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [30/04/2009 19:01 64160]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [12/04/2009 09:21 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [12/04/2009 09:21 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [12/04/2009 09:20 297752]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1028432]
R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [30/03/2009 16:28 1533808]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2009-03-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 13:10]

2009-10-15 c:\windows\Tasks\Extension de garantie.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2007-11-02 16:38]

2009-10-15 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-21 10:14]

2009-10-15 c:\windows\Tasks\Recovery DVD Creator.job
- c:\program files\Packard Bell\SetupMyPc\MCDCheck.exe [2007-11-02 16:34]

2009-10-15 c:\windows\Tasks\User_Feed_Synchronization-{2A89822D-C0D7-452B-BB85-A3AF59209ADD}.job
- c:\windows\system32\msfeedssync.exe [2009-10-15 03:41]

2009-10-15 c:\windows\Tasks\User_Feed_Synchronization-{5DED6E8F-A712-4335-A186-848BE406030C}.job
- c:\windows\system32\msfeedssync.exe [2009-10-15 03:41]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.cherchermalin.com/?t=Q0907271730&s=h
mStart Page = hxxp://www.tinit.org/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.search.yahoo.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\krysz\AppData\Roaming\Mozilla\Firefox\Profiles\f7suszk8.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=18&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://fr.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=18&tid={08F78C5B-87F4-4D3B-1BF8-2D1183387031}&q=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\users\krysz\AppData\Roaming\Mozilla\Firefox\Profiles\f7suszk8.default\extensions\firegpg@firegpg.team\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\users\krysz\AppData\Roaming\Mozilla\Firefox\Profiles\f7suszk8.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\users\krysz\AppData\Roaming\Mozilla\Firefox\Profiles\f7suszk8.default\extensions\{9CCE52B0-5079-4177-9586-1BF6575E62DE}\platform\WINNT\plugins\npcplay.dll
FF - plugin: c:\users\krysz\AppData\Roaming\Mozilla\Firefox\Profiles\f7suszk8.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{196C3A46-4758-433D-A600-802C804AF39C} - (no file)
WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
HKU-Default-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-2776800960-564032295-3372925530-1002\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:eb,91,44,f2,4f,9d,a6,94,9d,4e,b6,f1,44,7d,52,d3,8c,03,65,c0,c6,3a,2a,
4f,a8,28,d5,aa,10,18,51,ba,50,f9,ea,1e,fe,9e,fc,31,fe,a6,f7,ba,03,7a,fa,d6,\
"??"=hex:f2,70,65,65,38,f7,03,37,03,17,67,04,f7,6e,03,82

[HKEY_USERS\S-1-5-21-2776800960-564032295-3372925530-1002\Software\SecuROM\License information*]
"datasecu"=hex:60,4f,1b,a1,c4,10,45,80,58,f4,df,66,f5,e2,bd,78,14,99,50,0b,7d,
be,aa,c8,c7,b5,7c,4b,f5,b8,e7,b0,85,20,05,82,17,5e,07,e6,39,f5,18,55,f7,21,\
"rkeysecu"=hex:1c,52,3d,81,9b,d1,11,53,76,88,58,85,14,51,4c,f0

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\PnkBstrA.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\System32\WUDFHost.exe
c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
c:\windows\System32\wbem\unsecapp.exe
c:\windows\System32\wbem\unsecapp.exe
.
**************************************************************************
.
Heure de fin: 2009-10-15 15:01 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-10-15 13:00

Avant-CF: 40 210 010 112 octets libres
Après-CF: 40 749 592 576 octets libres

356 --- E O F --- 2009-10-15 05:47

############################## | UsbFix V6.042 |

User : krysz (Administrateurs) # PC-DE-KRYSZ
Update on 15/10/2009 by Chiquitine29, C_XX & Chimay8
Start at: 15:24:16 | 15/10/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18828
Windows Firewall Status : Enabled
AV : AVG Anti-Virus 8.5 [ Enabled | Updated ]

C:\ -> Disque fixe local # 141,05 Go (38,18 Go free) [HDD] # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque amovible
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque CD-ROM
J:\ -> Disque CD-ROM
K:\ -> Disque CD-ROM
L:\ -> Disque CD-ROM

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\rundll32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\PnkBstrA.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\runonce.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

################## | Registre # Clés Run infectieuses |

Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

################## | Registre # Mountpoints2 |

################## | Listing des fichiers présent |

[15/10/2009 15:22|--a------|75373] C:\aaw7boot.log
[18/09/2006 23:43|--a------|24] C:\autoexec.bat
[11/04/2009 08:36|-rahs----|333257] C:\bootmgr
[03/11/2007 00:28|-ra-s----|8192] C:\BOOTSECT.BAK
[15/10/2009 15:01|--a------|26787] C:\ComboFix.txt
[18/09/2006 23:43|--a------|10] C:\config.sys
[03/07/2008 12:36|-rahs----|0] C:\IO.SYS
[03/07/2008 12:36|-rahs----|0] C:\MSDOS.SYS
[29/02/2004 17:44|--a------|52576] C:\orange.bmp
[?|?|?] C:\pagefile.sys
[02/11/2007 16:22|--a------|16262] C:\seatools.log
[09/05/2008 11:37|--ah-----|232] C:\sqmdata00.sqm
[23/05/2008 22:35|--ah-----|232] C:\sqmdata01.sqm
[28/02/2009 12:21|--ah-----|268] C:\sqmdata02.sqm
[01/03/2009 22:11|--ah-----|268] C:\sqmdata03.sqm
[04/03/2009 21:06|--ah-----|268] C:\sqmdata04.sqm
[05/03/2009 22:39|--ah-----|268] C:\sqmdata05.sqm
[06/03/2009 20:52|--ah-----|268] C:\sqmdata06.sqm
[09/05/2008 11:37|--ah-----|244] C:\sqmnoopt00.sqm
[23/05/2008 22:35|--ah-----|244] C:\sqmnoopt01.sqm
[28/02/2009 12:21|--ah-----|244] C:\sqmnoopt02.sqm
[01/03/2009 22:11|--ah-----|244] C:\sqmnoopt03.sqm
[04/03/2009 21:06|--ah-----|244] C:\sqmnoopt04.sqm
[05/03/2009 22:39|--ah-----|244] C:\sqmnoopt05.sqm
[06/03/2009 20:52|--ah-----|244] C:\sqmnoopt06.sqm
[12/02/2009 08:46|--a------|0] C:\Tech_Vista.log
[15/10/2009 15:27|--a------|4532] C:\UsbFix.txt

################## | Vaccination |

# C:\autorun.inf -> Folder created by UsbFix.

################## | ! Fin du rapport # UsbFix V6.042 ! |

salut
j ai fiat comme tu m as dit ,pour ce qui es malawarebytes je l avais deja
je te colle les deux rapports dans l ordre
et merci encore de ton aide
amicalement kryszMalwarebytes' Anti-Malware 1.41
Version de la base de données: 2967
Windows 6.0.6002 Service Pack 2

15/10/2009 20:04:10
mbam-log-2009-10-15 (20-04-10).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Eléments examinés: 287879
Temps écoulé: 2 hour(s), 41 minute(s), 2 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2967
Windows 6.0.6002 Service Pack 2

15/10/2009 20:04:10
mbam-log-2009-10-15 (20-04-10).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Eléments examinés: 287879
Temps écoulé: 2 hour(s), 41 minute(s), 2 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Logfile of random's system information tool 1.06 (written by random/random)
Run by krysz at 2009-10-15 20:38:53
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 38 GB (26%) free of 144 GB
Total RAM: 3070 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:38:55, on 15/10/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\krysz\Downloads\fichiers\RSIT.exe
C:\Program Files\trend micro\krysz.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Sigma Team Toolbar - {5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - C:\Program Files\Sigma_Team\tbSig0.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Sigma Team Toolbar - {5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - C:\Program Files\Sigma_Team\tbSig0.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

salut
voici le rapport de toolscleaner2[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\avenger: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\krysz\Downloads\ComboFix.exe: trouvé !
C:\Documents and Settings\krysz\Downloads\ToolBarSD.exe: trouvé !
C:\Documents and Settings\krysz\Downloads\UsbFix.exe: trouvé !
C:\Documents and Settings\krysz\Downloads\fichiers\Rsit.exe: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\Users\krysz\Downloads\ComboFix.exe: trouvé !
C:\Users\krysz\Downloads\ToolBarSD.exe: trouvé !
C:\Users\krysz\Downloads\UsbFix.exe: trouvé !
C:\Users\krysz\Downloads\fichiers\Rsit.exe: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\krysz\Downloads\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\krysz\Downloads\ToolBarSD.exe: supprimé !
C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\Users\krysz\Downloads\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Combofix.txt: supprimé !
C:\TB.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\krysz\Downloads\UsbFix.exe: supprimé !
C:\Documents and Settings\krysz\Downloads\fichiers\Rsit.exe: supprimé !
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\avenger: ERREUR DE SUPPRESSION !!
C:\Qoobox: supprimé !

salut
OK pour Combo fix c fait
j ai désactiver le pare-feu de Windows et j ai téléchargé comodo firewall comme tu me l avait indiqué
et nickel il marche au poil
et en plus il est en français
j ai suivis les liens que tu m avais mis

merci beaucoup
Amicalement Krysz