Chevaux de troie: quikac.exe - zasujokooz.exe

Bonjour

1- Télécharge et installe le logiciel HijackThis :

https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
ou ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html

-->Clique sur le setup pour lancer l'installation : laisse toi guider et ne modifie pas les paramètres d'installation .
A la fin de l’installation, le programme se lance automatiquement : ferme le en cliquant sur la croix rouge.
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme :
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .

(Ne lance pas ce prg pour l'instant et fais la suite ... )

2- Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.

-> http://images.malwareremoval.com/random/RSIT.exe

! Déconnecte toi et ferme toutes tes applications en cours !

Double-clique sur " RSIT.exe " pour le lancer.

Clic droit sous VISTA (exécuter en tant que…)

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " .

* Devant l'option "List files/folders created ..." , tu choisis : 2 months

* clique ensuite sur " Continue " pour lancer l'analyse ...

-> laisse faire le scan et ne touche pas au PC ...

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-notes).

Poste le contenu de " log.txt " (c'est celui qui apparaît à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

Important : poste un rapport, puis l'autre dans la réponse suivante ...
Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum ...
( Et si "log.txt" seul, ne passe pas non plus , fais le en 2 fois ... merci ... )

( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )

Merci

Salut, si tu sais ou sont localisés les virus je te conseille le logiciel Unlocker. Il force les fichiers récalcitrants aux effacements...
Ou sinon les suites antivirus Kaspersky ou Bitdefender (les 2 meilleures du marché grand plubic). Mais ils sont payants alors tu n'auras qu'à les utiliser pour virer les merdes qui sont présents et de remettre ton ancienne installation de sécurité....

@ Guillaume5188, voici les fichiers txt (le premier log.txt)

Logfile of random's system information tool 1.06 (written by random/random)
Run by Vanessa at 2009-11-14 16:40:20
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 11 GB (54%) free of 20 GB
Total RAM: 1278 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:40:47, on 14/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\quikac.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\zasujokooz.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Vanessa\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Vanessa.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [coojooquoos] C:\WINDOWS\system32\quikac.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\RunServices: [coojooquoos] C:\WINDOWS\system32\quikac.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] C:\WINDOWS\mslsrv32.exe
O4 - HKUS\S-1-5-18\..\Run: [coojooquoos] C:\Documents and Settings\LocalService\Application Data\Microsoft\quikac.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [coojooquoos] C:\Documents and Settings\LocalService\Application Data\Microsoft\quikac.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: OdqehqGSvPAy - {B0791395-1AD3-B93F-ABC7-3A3AA1D28C9C} - (no file)

le second, info.txt

info.txt logfile of random's system information tool 1.06 2009-11-14 16:40:48

======Uninstall list======

-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware-->"C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 6.0.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A00000000001}
Athlon 64 Processor Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe" -l0x40c
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Control Panel-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AVG Free 9.0-->C:\Program Files\AVG\AVG9\setup.exe /UNINSTALL
Broadcom 802.11 Wireless LAN Adapter-->C:\WINDOWS\system32\BCMWLU00.exe verbose /rootkey=Software\Broadcom\802.11\UninstallInfo
Compaq Presario r4000 User Guides-->C:\PROGRA~1\CPQ\UNWISE.EXE C:\PROGRA~1\CPQ\INSTALL.LOG
Conexant AC-Link Audio-->CIAunwdm.exe
Data Fax SoftModem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_1002&DEV_4378&SUBSYS_3085103C\HXFSETUP.EXE -U -Icpl30855.inf
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HouseCall 6.6-->"C:\Documents and Settings\Vanessa\Application Data\HouseCall 6.6\uninstaller.exe"
HP Help and Support-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}\setup.exe" -l0x40c -removeonly
HP Pavillion zv6000 User Guides-->C:\PROGRA~1\HPQ\UNWISE.EXE C:\PROGRA~1\HPQ\INSTALL.LOG
HP Update-->MsiExec.exe /X{818ABC3C-635C-4651-8183-D0E9640B7DD1}
HP Wireless Assistant 1.01 A3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}\setup.exe" -l0x40c hpquninst
InterVideo WinDVD-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
iTunes-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{BE20E2F5-1903-4AAE-B1AF-2046E586C925}
J2SE Runtime Environment 5.0 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150020}
Lecteur Windows Media 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB886903)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M886903\M886903Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
O&O DiskRecovery-->MsiExec.exe /X{53480880-18E0-4097-A460-F22DD3AC6D70}
Quick Launch Buttons 5.10 B3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CEB326EC-8F40-47B2-BA22-BB092565D66F}\setup.exe" -l0x40c -uninst
QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
REALTEK Gigabit and Fast Ethernet NIC Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\setup.exe" -l0x40c REMOVE
Sonic Audio Module-->MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Sonic Copy Module-->MsiExec.exe /I{B12665F4-4E93-4AB4-B7FC-37053B524629}
Sonic Data Module-->MsiExec.exe /I{075473F5-846A-448B-BCB3-104AA1760205}
Sonic Express Labeler-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus-->MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Texas Instruments PCIxx21/x515 drivers.-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{96C0E73B-8813-4F4A-9EA1-D407C27AA1A1} /l1036
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
UserGuides-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{02E22217-0E96-4C3F-B831-83AA942B7715}\setup.exe" -l0x40c
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: AVG Anti-Virus Free

======System event log======

Computer Name: HP-12BDF32
Event Code: 60054
Message: Le programme d'installation a correctement installé Windows version 2600.
Record Number: 5
Source Name: Setup
Time Written: 20091111171949.000000+060
Event Type: Informations
User:

Computer Name: HP-12BDF32
Event Code: 15007
Message: La réservation de l'espace de nom identifié par le préfixe d'URL http://*:2869/ a été correctement ajoutée.

Record Number: 4
Source Name: HTTP
Time Written: 20091111171541.000000+060
Event Type: Informations
User:

Computer Name: HP-12BDF32
Event Code: 6011
Message: Le nom NetBIOS et le nom de l'hôte DNS de cet ordinateur ont été modifiés de MACHINENAME vers HP-12BDF32.

Record Number: 3
Source Name: EventLog
Time Written: 20091111170040.000000+060
Event Type: Informations
User:

Computer Name: MACHINENAME
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20091111175028.000000+060
Event Type: Informations
User:

Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Uniprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20091111175028.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;C:\Program Files\ATI Technologies\ATI Control Panel
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 15 Stepping 0, AuthenticAMD
"PROCESSOR_REVISION"=0f00
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SonicCentral"=C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\

-----------------EOF-----------------

As tu eu tout le premier .txt? Une partie est grisée...

Voici le texte :

ComboFix 09-11-14.03 - Vanessa 14/11/2009 17:08..1 - FAT32x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1278.691 [GMT 1:00]
Lancé depuis: c:\documents and settings\Vanessa\Bureau\asdehi.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\Application Data\Microsoft\cymmo.exe
c:\documents and settings\LocalService\Application Data\Microsoft\quikac.exe
c:\documents and settings\LocalService\Application Data\Microsoft\zasujokooz.exe
c:\documents and settings\NetworkService\Application Data\Microsoft\quikac.exe
c:\windows\logfile32.txt
c:\windows\system32\9new.exe
c:\windows\system32\i

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_aaxuc4myeszii4
-------\Service_aaxuc4myeszii4

((((((((((((((((((((((((((((( Fichiers créés du 2009-10-14 au 2009-11-14 ))))))))))))))))))))))))))))))))))))
.

2009-11-14 15:40 . 2009-11-14 15:40 -------- d-----w- C:\rsit
2009-11-14 15:33 . 2009-11-14 15:33 -------- d-----w- c:\program files\Trend Micro
2009-11-14 14:50 . 2009-11-14 14:50 -------- d-----w- c:\documents and settings\Vanessa\.housecall6.6
2009-11-14 14:48 . 2009-11-14 14:48 -------- d-----w- c:\windows\Sun
2009-11-14 14:44 . 2009-11-14 14:44 -------- d-----w- c:\windows\BDOSCAN8
2009-11-14 14:24 . 2009-11-14 14:24 -------- dc----w- c:\windows\system32\DRVSTORE
2009-11-14 14:24 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-11-14 14:22 . 2009-11-14 14:22 242984 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\SBRE.dll
2009-11-14 14:22 . 2009-11-14 14:22 5908024 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2009-11-14 14:22 . 2009-11-14 14:22 327000 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-11-14 14:22 . 2009-11-14 14:22 87496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-11-14 14:22 . 2009-11-14 14:22 933120 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-11-14 14:22 . 2009-11-14 14:22 640608 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-11-14 14:21 . 2009-11-14 14:21 815760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-11-14 14:21 . 2009-11-14 14:21 822904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-11-14 14:21 . 2009-11-14 14:21 1638104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-11-14 14:21 . 2009-11-14 14:21 788368 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-11-14 14:21 . 2009-11-14 14:21 1179232 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-11-14 14:18 . 2009-11-14 14:18 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-11-14 14:18 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
2009-11-14 14:17 . 2009-11-14 14:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-11-14 14:17 . 2009-11-14 14:17 -------- d-----w- c:\program files\Lavasoft
2009-11-14 14:04 . 2008-03-30 18:55 1213784 ----a-w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6\vsapi32.dll
2009-11-14 14:03 . 2006-11-22 16:48 91744 ----a-w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6\BPMNT.dll
2009-11-14 14:03 . 2007-12-24 16:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-11-14 14:03 . 2007-12-24 16:37 138384 ----a-w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6\tmcomm.sys
2009-11-14 14:03 . 2006-07-07 15:29 1197584 ----a-w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6\ssapi32.dll
2009-11-14 14:03 . 2009-03-27 16:38 366344 ----a-w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6\tsc.exe
2009-11-14 14:01 . 2009-11-14 14:04 -------- d-----w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6
2009-11-14 14:01 . 2009-11-14 14:50 -------- d-----w- c:\windows\system32\HouseCall 6.6
2009-11-14 13:31 . 2009-11-12 10:47 267264 ----a-w- c:\windows\system32\cymmo.exe
2009-11-13 11:23 . 2004-08-05 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2009-11-13 11:23 . 2004-08-05 12:00 31360 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2009-11-13 11:21 . 2004-08-05 12:00 39936 -c--a-w- c:\windows\system32\dllcache\hostmib.dll
2009-11-13 11:20 . 2004-05-12 23:39 184435 -c--a-w- c:\windows\system32\dllcache\fp4amsft.dll
2009-11-13 11:20 . 2003-03-24 14:52 82035 -c--a-w- c:\windows\system32\dllcache\fp4anscp.dll
2009-11-13 11:20 . 2003-03-24 14:52 49212 -c--a-w- c:\windows\system32\dllcache\fp4awebs.dll
2009-11-13 11:20 . 2003-03-24 14:52 49210 -c--a-w- c:\windows\system32\dllcache\fp4areg.dll
2009-11-13 11:20 . 2003-03-24 14:52 41020 -c--a-w- c:\windows\system32\dllcache\fp4avnb.dll
2009-11-13 11:20 . 2003-03-24 14:52 32826 -c--a-w- c:\windows\system32\dllcache\fp4avss.dll
2009-11-13 11:20 . 2003-03-24 14:52 147513 -c--a-w- c:\windows\system32\dllcache\fp4apws.dll
2009-11-13 11:20 . 2003-03-24 14:52 102509 -c--a-w- c:\windows\system32\dllcache\fp4atxt.dll
2009-11-13 11:20 . 2003-03-24 14:52 20540 -c--a-w- c:\windows\system32\dllcache\author.dll
2009-11-13 11:20 . 2003-03-24 14:52 188480 -c--a-w- c:\windows\system32\dllcache\cfgwiz.exe
2009-11-13 11:20 . 2003-03-24 14:52 16439 -c--a-w- c:\windows\system32\dllcache\author.exe
2009-11-13 11:20 . 2003-03-24 14:52 16439 -c--a-w- c:\windows\system32\dllcache\admin.exe
2009-11-13 11:20 . 2003-03-24 14:52 20540 -c--a-w- c:\windows\system32\dllcache\admin.dll
2009-11-13 11:11 . 2004-08-05 12:00 480256 -c--a-w- c:\windows\system32\dllcache\cintsetp.exe
2009-11-13 11:11 . 2004-08-05 12:00 198656 -c--a-w- c:\windows\system32\dllcache\cintime.dll
2009-11-13 11:11 . 2004-08-05 12:00 97792 -c--a-w- c:\windows\system32\dllcache\chtmbx.dll
2009-11-13 11:11 . 2004-08-05 12:00 56320 -c--a-w- c:\windows\system32\dllcache\chtskdic.dll
2009-11-13 11:11 . 2004-08-05 12:00 455168 -c--a-w- c:\windows\system32\dllcache\tintsetp.exe
2009-11-13 11:11 . 2004-08-05 12:00 44032 -c--a-w- c:\windows\system32\dllcache\tintlphr.exe
2009-11-13 11:11 . 2004-08-05 12:00 173568 -c--a-w- c:\windows\system32\dllcache\chtskf.dll
2009-11-13 11:11 . 2004-08-05 12:00 10240 -c--a-w- c:\windows\system32\dllcache\tmigrate.dll
2009-11-13 11:11 . 2004-08-05 12:00 70144 -c--a-w- c:\windows\system32\dllcache\pintlphr.exe
2009-11-13 11:11 . 2004-08-05 12:00 67584 -c--a-w- c:\windows\system32\dllcache\pmigrate.dll
2009-11-13 11:11 . 2004-08-05 12:00 59392 -c--a-w- c:\windows\system32\dllcache\imscinst.exe
2009-11-13 11:11 . 2004-08-05 12:00 10096640 -c--a-w- c:\windows\system32\dllcache\hwxcht.dll
2009-11-13 11:10 . 2004-08-05 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-11-13 11:10 . 2004-08-05 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2009-11-13 11:10 . 2004-08-05 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2009-11-13 11:10 . 2004-08-05 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2009-11-12 18:44 . 2009-11-12 18:47 -------- d-----w- C:\$AVG
2009-11-12 18:44 . 2009-11-12 18:44 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-11-12 18:44 . 2009-11-12 18:44 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-12 18:44 . 2009-11-12 18:44 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-12 18:44 . 2009-11-12 18:44 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-11-12 18:44 . 2009-11-14 10:32 -------- d-----w- c:\windows\system32\drivers\Avg
2009-11-12 18:43 . 2009-11-14 10:26 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-11-12 18:43 . 2009-11-12 18:43 -------- d-----w- c:\program files\AVG
2009-11-12 18:02 . 2009-11-12 18:02 -------- d-----w- c:\program files\Hp
2009-11-12 18:02 . 2009-11-12 18:10 -------- d-----w- c:\documents and settings\Vanessa\Application Data\HpUpdate
2009-11-12 16:59 . 2009-11-12 16:59 -------- d-sh--w- c:\documents and settings\Vanessa\PrivacIE
2009-11-12 16:44 . 2009-11-12 16:44 -------- d-sh--w- c:\documents and settings\Vanessa\IETldCache
2009-11-12 16:42 . 2009-11-12 16:42 -------- d--h--w- c:\windows\msdownld.tmp
2009-11-12 16:41 . 2009-11-12 16:41 -------- d-----w- c:\windows\ie8updates
2009-11-12 16:41 . 2009-11-12 20:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-12 16:41 . 2009-11-12 20:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-12 16:37 . 2009-11-12 16:39 -------- dc-h--w- c:\windows\ie8
2009-11-12 11:57 . 2009-11-12 11:57 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard
2009-11-12 11:55 . 2009-11-12 11:55 -------- d-----w- c:\program files\Fichiers communs\iS3
2009-11-12 11:55 . 2009-11-12 12:34 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-11-11 22:39 . 2009-11-11 22:39 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-11-11 22:39 . 2009-11-13 14:24 96168 ----a-w- c:\documents and settings\Vanessa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-11 20:25 . 2009-11-11 20:25 -------- d-----w- c:\program files\Microsoft Works
2009-11-11 20:25 . 2009-11-11 20:25 -------- d-----w- c:\program files\MSBuild
2009-11-11 20:24 . 2009-11-11 20:24 -------- d-----w- c:\program files\Microsoft.NET
2009-11-11 20:10 . 2009-11-11 20:25 -------- d--h--w- c:\windows\ShellNew
2009-11-11 20:09 . 2009-11-11 20:09 -------- d-----w- c:\documents and settings\Vanessa\Local Settings\Application Data\Microsoft Help
2009-11-11 20:09 . 2009-11-11 20:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-11-11 20:08 . 2009-11-11 20:08 -------- d-----r- C:\MSOCache
2009-11-11 18:43 . 2009-11-11 18:43 -------- d-----w- c:\program files\OO Software
2009-11-11 18:30 . 2009-11-11 18:30 604416 ----a-w- c:\windows\system32\TUProgSt.exe
2009-11-11 18:30 . 2009-04-27 12:21 28928 ----a-w- c:\windows\system32\uxtuneup.dll
2009-11-11 18:29 . 2009-11-11 18:29 361216 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-11-11 18:28 . 2009-11-11 18:28 -------- d-----w- c:\documents and settings\Vanessa\Application Data\TuneUp Software
2009-11-11 18:27 . 2009-11-11 18:27 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-11-11 18:27 . 2009-11-11 18:30 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-11-11 18:27 . 2009-11-11 18:27 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-11-11 18:12 . 2009-01-07 17:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-11-11 17:34 . 2009-11-11 17:34 6113439 ----a-w- c:\documents and settings\Vanessa\Application Data\EoRezo\install.exe
2009-11-11 17:34 . 2009-11-12 12:01 -------- d-----w- c:\documents and settings\Vanessa\Application Data\EoRezo
2009-11-11 17:19 . 2009-11-11 17:19 -------- d-----w- c:\documents and settings\All Users\Application Data\hpqwmi
2009-11-11 17:11 . 2004-08-05 12:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-11-11 17:09 . 2009-11-11 17:09 -------- d-----w- c:\program files\Java
2009-11-11 17:09 . 2009-11-11 17:09 -------- d-----w- c:\program files\Fichiers communs\Java
2009-11-11 17:09 . 2009-11-11 17:09 -------- d-----w- c:\documents and settings\Vanessa\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150020}
2009-11-11 17:08 . 2009-11-11 17:08 -------- d-----w- c:\program files\Fichiers communs\SureThing Shared
2009-11-11 17:08 . 2009-11-11 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-11-11 17:07 . 2009-11-11 17:07 -------- d-----w- c:\program files\Fichiers communs\TiVo Shared
2009-11-11 17:07 . 2009-11-11 17:08 -------- d-----w- c:\program files\Sonic
2009-11-11 17:05 . 2009-11-11 17:06 -------- d-----w- c:\program files\Fichiers communs\Sonic Shared
2009-11-11 17:05 . 2002-10-15 08:13 32356 ----a-w- c:\windows\system32\pusbfd1.sys
2009-11-11 17:03 . 2004-12-07 09:46 425984 ----a-w- c:\windows\system32\hpqPres.dll
2009-11-11 17:03 . 2004-12-07 09:45 65536 ----a-w- c:\windows\system32\hpqactn.dll
2009-11-11 17:03 . 2004-12-01 11:46 32768 ----a-w- c:\windows\system32\eabhbrn8.dll
2009-11-11 17:03 . 2004-12-01 11:45 225280 ----a-w- c:\windows\system32\cpqinfo.dll
2009-11-11 17:03 . 2004-04-14 06:36 7432 ----a-w- c:\windows\system32\drivers\eabfiltr.sys
2009-11-11 17:03 . 2003-06-06 10:46 5220 ----a-w- c:\windows\system32\drivers\EabUsb.sys
2009-11-11 17:00 . 2009-11-12 16:41 -------- d--h--w- c:\windows\$hf_mig$

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-14 13:42 . 2009-11-11 16:46 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-14 13:40 . 2009-11-11 23:40 -------- d-----w- c:\program files\Ontrack
2009-11-14 10:30 . 2004-08-05 12:00 64930 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-14 10:30 . 2004-08-05 12:00 448428 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-13 11:18 . 2009-11-11 16:13 23704 ----a-w- c:\windows\system32\emptyregdb.dat
2009-11-12 12:04 . 2009-11-12 12:04 360 ----a-w- c:\windows\system32\drivers\kgpfr2.cfg
2009-11-12 12:03 . 2009-11-12 12:03 728 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-11-12 11:50 . 2009-11-12 11:50 1961720 ----a-w- c:\documents and settings\Vanessa\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-11-12 10:47 . 2009-11-12 10:47 267264 ----a-w- c:\windows\system32\quikac.exe
2009-11-12 00:21 . 2009-11-12 00:21 4442624 ----a-w- c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2009-11-12 00:15 . 2009-11-12 00:15 2322816 ----a-w- c:\windows\system32\TUKernel.exe
2009-11-11 23:09 . 2009-11-11 23:09 -------- d-----w- c:\program files\Windows Desktop Search
2009-11-11 22:40 . 2009-11-11 22:40 -------- d-----w- c:\documents and settings\Vanessa\Application Data\AdobeUM
2009-11-11 21:47 . 2009-11-11 16:58 -------- d-----w- c:\documents and settings\All Users\Application Data\QuickTime
2009-11-11 17:10 . 2009-11-11 16:52 -------- d-----w- c:\program files\HPQ
2009-11-11 17:08 . 2009-11-11 16:46 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-11-11 17:05 . 2009-11-11 17:05 1566 --sha-r- c:\windows\system32\drivers\103C_HP_NTBK_Pavilion ZV6100 (EE984EA#ABF)_YN_0Pavi_QCND5300MTY_EU_46_I3085_SHP_V42.39_BF.17_T050621_WXH2_L40C_M1279_J80_7AMD_8Athlon 64_90.99_#091111_N10EC8139_(EE984EA#ABF)_XMOBILE_CN10_Z10024378_2F.17_G10025955.MRK
2009-11-11 16:59 . 2009-11-11 16:59 -------- d-----w- c:\program files\Synaptics
2009-11-11 16:59 . 2009-11-11 16:59 -------- d-----w- c:\documents and settings\Vanessa\Application Data\Apple Computer
2009-11-11 16:59 . 2009-11-11 16:58 -------- d-----w- c:\program files\QuickTime
2009-11-11 16:58 . 2009-11-11 16:16 79431 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-11 16:58 . 2009-11-11 16:58 -------- d-----w- c:\program files\iPod
2009-11-11 16:58 . 2009-11-11 16:58 -------- d-----w- c:\program files\iTunes
2009-11-11 16:58 . 2009-11-11 16:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-11-11 16:56 . 2009-11-11 16:56 -------- d-----w- c:\program files\CPQ
2009-11-11 16:55 . 2009-11-11 16:55 -------- d-----w- c:\program files\InterVideo
2009-11-11 16:53 . 2009-11-11 16:53 130 ----a-w- c:\documents and settings\Vanessa\Local Settings\Application Data\fusioncache.dat
2009-11-11 16:49 . 2009-11-11 16:49 -------- d-----w- c:\program files\ATI Technologies
2009-11-11 16:48 . 2009-11-11 16:48 -------- d-----w- c:\program files\CONEXANT
2009-11-11 16:46 . 2009-11-11 16:46 -------- d-----w- c:\program files\AMD
2009-11-11 16:17 . 2009-11-11 16:17 -------- d-----w- c:\program files\microsoft frontpage
2009-11-11 16:15 . 2009-11-11 16:15 -------- d-----w- c:\program files\Services en ligne
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_02\bin\jusched.exe" [2005-03-04 36975]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 794624]
"coojooquoos"="c:\windows\system32\quikac.exe" [2009-11-12 267264]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 98304]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-12 2020120]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"coojooquoos"="c:\windows\system32\quikac.exe" [2009-11-12 267264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-12 18:44 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"=c:\program files\iTunes\iTunesHelper.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [14/11/2009 15:24 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/11/2009 19:44 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/11/2009 19:44 360584]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [12/11/2009 19:44 285392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 12:17 1179232]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [11/11/2009 19:30 604416]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [11/11/2009 17:48 200192]
S2 aaxuc4myeszii4;SigmaTel Audio Service;c:\windows\system32\cymmo.exe [14/11/2009 14:31 267264]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - MBR
*Deregistered* - mbr
.
Contenu du dossier 'Tâches planifiées'

2009-11-14 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 14:21]

2009-11-14 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 13:42]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

Toolbar-SITEguard - (no file)
SSODL-OdqehqGSvPAy-{B0791395-1AD3-B93F-ABC7-3A3AA1D28C9C} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-14 17:13
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe??????????A????|?????? ???B?????????????hLC? ??????

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1112)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\HPQ\shared\hpqwmi.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Heure de fin: 2009-11-14 17:16 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-11-14 16:16

Avant-CF: 11 329 028 096 octets libres
Après-CF: 11 242 004 480 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect /tutag=4tc7xt /kernel=tukernel.exe

- - End Of File - - F74CF470CB316C5065AD94FB5EDB862B

Le premier :

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.11.14 Backdoor.Win32.Oderoor!IK
AhnLab-V3 5.0.0.2 2009.11.13 -
AntiVir 7.9.1.65 2009.11.13 BDS/Oderoor.267264H
Antiy-AVL 2.0.3.7 2009.11.13 -
Authentium 5.2.0.5 2009.11.14 -
Avast 4.8.1351.0 2009.11.14 -
AVG 8.5.0.425 2009.11.14 -
BitDefender 7.2 2009.11.14 Backdoor.Agent.AAJS
CAT-QuickHeal 10.00 2009.11.13 -
ClamAV 0.94.1 2009.11.14 -
Comodo 2955 2009.11.14 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.0.12182 2009.11.14 -
eSafe 7.0.17.0 2009.11.12 -
eTrust-Vet 35.1.7121 2009.11.14 -
F-Prot 4.5.1.85 2009.11.13 -
F-Secure 9.0.15370.0 2009.11.11 -
Fortinet 3.120.0.0 2009.11.14 -
GData 19 2009.11.14 Backdoor.Agent.AAJS
Ikarus T3.1.1.74.0 2009.11.14 Backdoor.Win32.Oderoor
Jiangmin 11.0.800 2009.11.12 -
K7AntiVirus 7.10.896 2009.11.13 -
Kaspersky 7.0.0.125 2009.11.14 Backdoor.Win32.Inject.cxl
McAfee 5801 2009.11.13 -
McAfee+Artemis 5801 2009.11.13 Artemis!DE1961D0D4B2
McAfee-GW-Edition 6.8.5 2009.11.14 Trojan.Backdoor.Oderoor.267264H
Microsoft 1.5202 2009.11.14 Backdoor:Win32/Oderoor.gen!H
NOD32 4607 2009.11.14 a variant of Win32/Meslice.D
Norman 6.03.02 2009.11.14 -
nProtect 2009.1.8.0 2009.11.14 -
Panda 10.0.2.2 2009.11.14 Generic Malware
PCTools 7.0.3.5 2009.11.13 Backdoor.Trojan
Prevx 3.0 2009.11.14 Medium Risk Malware
Rising 22.21.05.04 2009.11.14 Trojan.Win32.Generic.51F0D0D8
Sophos 4.47.0 2009.11.14 -
Sunbelt 3.2.1858.2 2009.11.12 -
Symantec 1.4.4.12 2009.11.14 Backdoor.Trojan
TheHacker 6.5.0.2.070 2009.11.14 -
TrendMicro 9.0.0.1003 2009.11.14 -
VBA32 3.12.10.11 2009.11.13 -
ViRobot 2009.11.14.2037 2009.11.14 -
VirusBuster 4.6.5.0 2009.11.13 -
Information additionnelle
File size: 267264 bytes
MD5...: de1961d0d4b2090ca43175b954f2a9a0
SHA1..: bd0a472a0363b1dee3b6c5c580f4283329877c6d
SHA256: ca254392914d0efd5844989319688102c6788d12aafe325de8e114ad97953a7e
ssdeep: 6144:3zBb8GiXKv8FvKcdznbmhQ2i3sAF+baokastdFPNKhSwvwc4HgXP:3jiXKi
C6zn6o3f5LZtB7wYcegXP

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2036
timedatestamp.....: 0x4af787fa (Mon Nov 09 03:09:46 2009)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x4098e 0x40a00 6.10 3cefc17737357b84d9b15e6f5d25cde5
.rdata 0x42000 0x3aa 0x400 4.86 3e5ee68ad7de0170461794e3e99960a7
.data 0x43000 0x446 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x44000 0x1a0 0x200 2.26 30f7fe395bc4d352071e4bce490e1ebf

( 2 imports )
> kernel32.dll: CreateThread, ExitProcess, FindClose, FindFirstFileA, GetLocalTime, GetProfileStringA, GetTickCount, GlobalFree, LoadLibraryA, LocalLock, LocalReAlloc, SetCurrentDirectoryA, SetFilePointer, SetLastError, Sleep, lstrcmpiA, lstrcpyA
> user32.dll: ClientToScreen, CopyRect, DestroyWindow, DispatchMessageW, EnableWindow, EndDialog, GetAsyncKeyState, GetCursorPos, GetMenuItemInfoW, GetWindowRect, LoadIconW, LoadStringW, PaintDesktop, SetCapture, SetTimer, SetWindowTextW, TrackPopupMenuEx, TranslateAcceleratorW

( 0 exports )

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=de1961d0d4b2090ca43175b954f2a9a0' target='_blank'>https://www.symantec.com?md5=de1961d0d4b2090ca43175b954f2a9a0</a>
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: 1.0.0.0
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=B203BEC300783FDA14FA0483126C4A000EC74466' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=B203BEC300783FDA14FA0483126C4A000EC74466</a>

Il n'y a plus personne? Je ne sais pas ce que je dois faire à présent...
Merci...

Hello

Déja supprimé par Combo...

(((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) 
. 

c:\documents and settings\LocalService\Application Data\Microsoft\cymmo.exe 
c:\documents and settings\LocalService\Application Data\Microsoft\quikac.exe 

a+

Merci Guillaume de ta précisieuse aide et navrée d'avoir posté un peu dans tous les sens... :) C'est vraiment plaisant de pouvoir compter sur des pros comme toi !!! Est ce que cela veut dire que mon pc est complètement nettoyé maintenant ?

Voici le rapport :

ComboFix 09-11-14.03 - Vanessa 14/11/2009 19:06..1 - FAT32x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1278.698 [GMT 1:00]
Lancé depuis: c:\documents and settings\Vanessa\Bureau\asdehi.exe
Commutateurs utilisés :: c:\documents and settings\Vanessa\Bureau\CFScript.txt.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\system32\cymmo.exe"
"c:\windows\system32\quikac.exe"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\cymmo.exe
c:\windows\system32\quikac.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-14 au 2009-11-14 ))))))))))))))))))))))))))))))))))))
.

2009-11-14 16:37 . 2009-11-14 16:37 -------- d-----w- c:\documents and settings\Vanessa\Application Data\Malwarebytes
2009-11-14 16:37 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-14 16:37 . 2009-11-14 16:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-14 16:37 . 2009-11-14 16:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-14 16:37 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-14 15:40 . 2009-11-14 15:40 -------- d-----w- C:\rsit
2009-11-14 15:33 . 2009-11-14 15:33 -------- d-----w- c:\program files\Trend Micro
2009-11-14 14:50 . 2009-11-14 14:50 -------- d-----w- c:\documents and settings\Vanessa\.housecall6.6
2009-11-14 14:48 . 2009-11-14 14:48 -------- d-----w- c:\windows\Sun
2009-11-14 14:44 . 2009-11-14 14:44 -------- d-----w- c:\windows\BDOSCAN8
2009-11-14 14:24 . 2009-11-14 14:24 -------- dc----w- c:\windows\system32\DRVSTORE
2009-11-14 14:24 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-11-14 14:22 . 2009-11-14 14:22 242984 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\SBRE.dll
2009-11-14 14:22 . 2009-11-14 14:22 5908024 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2009-11-14 14:22 . 2009-11-14 14:22 327000 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-11-14 14:22 . 2009-11-14 14:22 87496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-11-14 14:22 . 2009-11-14 14:22 933120 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-11-14 14:22 . 2009-11-14 14:22 640608 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-11-14 14:21 . 2009-11-14 14:21 815760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-11-14 14:21 . 2009-11-14 14:21 822904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-11-14 14:21 . 2009-11-14 14:21 1638104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-11-14 14:21 . 2009-11-14 14:21 788368 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-11-14 14:21 . 2009-11-14 14:21 1179232 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-11-14 14:18 . 2009-11-14 14:18 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-11-14 14:18 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
2009-11-14 14:17 . 2009-11-14 14:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-11-14 14:17 . 2009-11-14 14:17 -------- d-----w- c:\program files\Lavasoft
2009-11-14 14:04 . 2008-03-30 18:55 1213784 ----a-w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6\vsapi32.dll
2009-11-14 14:03 . 2006-11-22 16:48 91744 ----a-w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6\BPMNT.dll
2009-11-14 14:03 . 2007-12-24 16:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-11-14 14:03 . 2007-12-24 16:37 138384 ----a-w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6\tmcomm.sys
2009-11-14 14:03 . 2006-07-07 15:29 1197584 ----a-w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6\ssapi32.dll
2009-11-14 14:03 . 2009-03-27 16:38 366344 ----a-w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6\tsc.exe
2009-11-14 14:01 . 2009-11-14 14:04 -------- d-----w- c:\documents and settings\Vanessa\Application Data\HouseCall 6.6
2009-11-14 14:01 . 2009-11-14 14:50 -------- d-----w- c:\windows\system32\HouseCall 6.6
2009-11-13 11:23 . 2004-08-05 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2009-11-13 11:23 . 2004-08-05 12:00 31360 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2009-11-13 11:21 . 2004-08-05 12:00 39936 -c--a-w- c:\windows\system32\dllcache\hostmib.dll
2009-11-13 11:20 . 2004-05-12 23:39 184435 -c--a-w- c:\windows\system32\dllcache\fp4amsft.dll
2009-11-13 11:20 . 2003-03-24 14:52 82035 -c--a-w- c:\windows\system32\dllcache\fp4anscp.dll
2009-11-13 11:20 . 2003-03-24 14:52 49212 -c--a-w- c:\windows\system32\dllcache\fp4awebs.dll
2009-11-13 11:20 . 2003-03-24 14:52 49210 -c--a-w- c:\windows\system32\dllcache\fp4areg.dll
2009-11-13 11:20 . 2003-03-24 14:52 41020 -c--a-w- c:\windows\system32\dllcache\fp4avnb.dll
2009-11-13 11:20 . 2003-03-24 14:52 32826 -c--a-w- c:\windows\system32\dllcache\fp4avss.dll
2009-11-13 11:20 . 2003-03-24 14:52 147513 -c--a-w- c:\windows\system32\dllcache\fp4apws.dll
2009-11-13 11:20 . 2003-03-24 14:52 102509 -c--a-w- c:\windows\system32\dllcache\fp4atxt.dll
2009-11-13 11:20 . 2003-03-24 14:52 20540 -c--a-w- c:\windows\system32\dllcache\author.dll
2009-11-13 11:20 . 2003-03-24 14:52 188480 -c--a-w- c:\windows\system32\dllcache\cfgwiz.exe
2009-11-13 11:20 . 2003-03-24 14:52 16439 -c--a-w- c:\windows\system32\dllcache\author.exe
2009-11-13 11:20 . 2003-03-24 14:52 16439 -c--a-w- c:\windows\system32\dllcache\admin.exe
2009-11-13 11:20 . 2003-03-24 14:52 20540 -c--a-w- c:\windows\system32\dllcache\admin.dll
2009-11-13 11:11 . 2004-08-05 12:00 480256 -c--a-w- c:\windows\system32\dllcache\cintsetp.exe
2009-11-13 11:11 . 2004-08-05 12:00 198656 -c--a-w- c:\windows\system32\dllcache\cintime.dll
2009-11-13 11:11 . 2004-08-05 12:00 97792 -c--a-w- c:\windows\system32\dllcache\chtmbx.dll
2009-11-13 11:11 . 2004-08-05 12:00 56320 -c--a-w- c:\windows\system32\dllcache\chtskdic.dll
2009-11-13 11:11 . 2004-08-05 12:00 455168 -c--a-w- c:\windows\system32\dllcache\tintsetp.exe
2009-11-13 11:11 . 2004-08-05 12:00 44032 -c--a-w- c:\windows\system32\dllcache\tintlphr.exe
2009-11-13 11:11 . 2004-08-05 12:00 173568 -c--a-w- c:\windows\system32\dllcache\chtskf.dll
2009-11-13 11:11 . 2004-08-05 12:00 10240 -c--a-w- c:\windows\system32\dllcache\tmigrate.dll
2009-11-13 11:11 . 2004-08-05 12:00 70144 -c--a-w- c:\windows\system32\dllcache\pintlphr.exe
2009-11-13 11:11 . 2004-08-05 12:00 67584 -c--a-w- c:\windows\system32\dllcache\pmigrate.dll
2009-11-13 11:11 . 2004-08-05 12:00 59392 -c--a-w- c:\windows\system32\dllcache\imscinst.exe
2009-11-13 11:11 . 2004-08-05 12:00 10096640 -c--a-w- c:\windows\system32\dllcache\hwxcht.dll
2009-11-13 11:10 . 2004-08-05 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-11-13 11:10 . 2004-08-05 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2009-11-13 11:10 . 2004-08-05 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2009-11-13 11:10 . 2004-08-05 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2009-11-12 18:44 . 2009-11-12 18:47 -------- d-----w- C:\$AVG
2009-11-12 18:44 . 2009-11-12 18:44 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-11-12 18:44 . 2009-11-12 18:44 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-12 18:44 . 2009-11-12 18:44 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-12 18:44 . 2009-11-12 18:44 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-11-12 18:44 . 2009-11-14 10:32 -------- d-----w- c:\windows\system32\drivers\Avg
2009-11-12 18:43 . 2009-11-14 18:06 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-11-12 18:43 . 2009-11-12 18:43 -------- d-----w- c:\program files\AVG
2009-11-12 18:02 . 2009-11-12 18:02 -------- d-----w- c:\program files\Hp
2009-11-12 18:02 . 2009-11-12 18:10 -------- d-----w- c:\documents and settings\Vanessa\Application Data\HpUpdate
2009-11-12 16:59 . 2009-11-12 16:59 -------- d-sh--w- c:\documents and settings\Vanessa\PrivacIE
2009-11-12 16:44 . 2009-11-12 16:44 -------- d-sh--w- c:\documents and settings\Vanessa\IETldCache
2009-11-12 16:42 . 2009-11-12 16:42 -------- d--h--w- c:\windows\msdownld.tmp
2009-11-12 16:41 . 2009-11-12 16:41 -------- d-----w- c:\windows\ie8updates
2009-11-12 16:41 . 2009-11-12 20:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-12 16:41 . 2009-11-12 20:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-11 23:09 . 2009-11-11 23:09 -------- d-----w- c:\program files\Windows Desktop Search
2009-11-11 23:09 . 2009-11-11 23:09 -------- d-----w- c:\windows\system32\GroupPolicy
2009-11-11 22:40 . 2009-11-11 22:40 -------- d-----w- c:\documents and settings\Vanessa\Application Data\AdobeUM
2009-11-11 22:40 . 2009-11-11 22:40 -------- d-----w- c:\documents and settings\Vanessa\Local Settings\Application Data\Adobe
2009-11-11 22:39 . 2009-11-11 22:39 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-11-11 22:39 . 2009-11-13 14:24 96168 ----a-w- c:\documents and settings\Vanessa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-11 20:25 . 2009-11-11 20:25 -------- d-----w- c:\program files\Microsoft Works
2009-11-11 20:25 . 2009-11-11 20:25 -------- d-----w- c:\program files\MSBuild
2009-11-11 20:24 . 2009-11-11 20:24 -------- d-----w- c:\program files\Microsoft.NET
2009-11-11 20:10 . 2009-11-11 20:25 -------- d--h--w- c:\windows\ShellNew
2009-11-11 20:09 . 2009-11-11 20:09 -------- d-----w- c:\documents and settings\Vanessa\Local Settings\Application Data\Microsoft Help
2009-11-11 20:09 . 2009-11-11 20:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-11-11 20:08 . 2009-11-11 20:08 -------- d-----r- C:\MSOCache
2009-11-11 18:43 . 2009-11-11 18:43 -------- d-----w- c:\program files\OO Software
2009-11-11 18:30 . 2009-11-11 18:30 604416 ----a-w- c:\windows\system32\TUProgSt.exe
2009-11-11 18:30 . 2009-04-27 12:21 28928 ----a-w- c:\windows\system32\uxtuneup.dll
2009-11-11 18:29 . 2009-11-11 18:29 361216 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-11-11 18:28 . 2009-11-11 18:28 -------- d-----w- c:\documents and settings\Vanessa\Application Data\TuneUp Software
2009-11-11 18:27 . 2009-11-11 18:27 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-11-11 18:27 . 2009-11-11 18:30 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-11-11 18:27 . 2009-11-11 18:27 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-11-11 18:12 . 2009-01-07 17:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-11-11 17:34 . 2009-11-11 17:34 6113439 ----a-w- c:\documents and settings\Vanessa\Application Data\EoRezo\install.exe
2009-11-11 17:34 . 2009-11-12 12:01 -------- d-----w- c:\documents and settings\Vanessa\Application Data\EoRezo
2009-11-11 17:19 . 2009-11-11 17:19 -------- d-----w- c:\documents and settings\All Users\Application Data\hpqwmi
2009-11-11 17:11 . 2004-08-05 12:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-11-11 17:09 . 2009-11-11 17:09 -------- d-----w- c:\program files\Java
2009-11-11 17:09 . 2009-11-11 17:09 -------- d-----w- c:\program files\Fichiers communs\Java
2009-11-11 17:09 . 2009-11-11 17:09 -------- d-----w- c:\documents and settings\Vanessa\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150020}
2009-11-11 17:08 . 2009-11-11 17:08 -------- d-----w- c:\program files\Fichiers communs\SureThing Shared
2009-11-11 17:08 . 2009-11-11 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-11-11 17:07 . 2009-11-11 17:07 -------- d-----w- c:\program files\Fichiers communs\TiVo Shared
2009-11-11 17:07 . 2009-11-11 17:08 -------- d-----w- c:\program files\Sonic
2009-11-11 17:05 . 2009-11-11 17:06 -------- d-----w- c:\program files\Fichiers communs\Sonic Shared
2009-11-11 17:05 . 2002-10-15 08:13 32356 ----a-w- c:\windows\system32\pusbfd1.sys
2009-11-11 17:03 . 2004-12-07 09:46 425984 ----a-w- c:\windows\system32\hpqPres.dll
2009-11-11 17:03 . 2004-12-07 09:45 65536 ----a-w- c:\windows\system32\hpqactn.dll
2009-11-11 17:03 . 2004-12-01 11:46 32768 ----a-w- c:\windows\system32\eabhbrn8.dll
2009-11-11 17:03 . 2004-12-01 11:45 225280 ----a-w- c:\windows\system32\cpqinfo.dll
2009-11-11 17:03 . 2004-04-14 06:36 7432 ----a-w- c:\windows\system32\drivers\eabfiltr.sys
2009-11-11 17:03 . 2003-06-06 10:46 5220 ----a-w- c:\windows\system32\drivers\EabUsb.sys
2009-11-11 17:00 . 2009-11-12 16:41 -------- d--h--w- c:\windows\$hf_mig$

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-14 13:42 . 2009-11-11 16:46 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-14 13:40 . 2009-11-11 23:40 -------- d-----w- c:\program files\Ontrack
2009-11-14 10:30 . 2004-08-05 12:00 64930 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-14 10:30 . 2004-08-05 12:00 448428 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-13 11:18 . 2009-11-11 16:13 23704 ----a-w- c:\windows\system32\emptyregdb.dat
2009-11-12 12:34 . 2009-11-12 11:55 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-11-12 12:04 . 2009-11-12 12:04 360 ----a-w- c:\windows\system32\drivers\kgpfr2.cfg
2009-11-12 12:03 . 2009-11-12 12:03 728 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-11-12 11:57 . 2009-11-12 11:57 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard
2009-11-12 11:55 . 2009-11-12 11:55 -------- d-----w- c:\program files\Fichiers communs\iS3
2009-11-12 11:50 . 2009-11-12 11:50 1961720 ----a-w- c:\documents and settings\Vanessa\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-11-12 00:21 . 2009-11-12 00:21 4442624 ----a-w- c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2009-11-12 00:15 . 2009-11-12 00:15 2322816 ----a-w- c:\windows\system32\TUKernel.exe
2009-11-11 21:47 . 2009-11-11 16:58 -------- d-----w- c:\documents and settings\All Users\Application Data\QuickTime
2009-11-11 17:10 . 2009-11-11 16:52 -------- d-----w- c:\program files\HPQ
2009-11-11 17:08 . 2009-11-11 16:46 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-11-11 17:05 . 2009-11-11 17:05 1566 --sha-r- c:\windows\system32\drivers\103C_HP_NTBK_Pavilion ZV6100 (EE984EA#ABF)_YN_0Pavi_QCND5300MTY_EU_46_I3085_SHP_V42.39_BF.17_T050621_WXH2_L40C_M1279_J80_7AMD_8Athlon 64_90.99_#091111_N10EC8139_(EE984EA#ABF)_XMOBILE_CN10_Z10024378_2F.17_G10025955.MRK
2009-11-11 16:59 . 2009-11-11 16:59 -------- d-----w- c:\program files\Synaptics
2009-11-11 16:59 . 2009-11-11 16:59 -------- d-----w- c:\documents and settings\Vanessa\Application Data\Apple Computer
2009-11-11 16:59 . 2009-11-11 16:58 -------- d-----w- c:\program files\QuickTime
2009-11-11 16:58 . 2009-11-11 16:16 79431 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-11 16:58 . 2009-11-11 16:58 -------- d-----w- c:\program files\iPod
2009-11-11 16:58 . 2009-11-11 16:58 -------- d-----w- c:\program files\iTunes
2009-11-11 16:58 . 2009-11-11 16:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-11-11 16:56 . 2009-11-11 16:56 -------- d-----w- c:\program files\CPQ
2009-11-11 16:55 . 2009-11-11 16:55 -------- d-----w- c:\program files\InterVideo
2009-11-11 16:53 . 2009-11-11 16:53 130 ----a-w- c:\documents and settings\Vanessa\Local Settings\Application Data\fusioncache.dat
2009-11-11 16:49 . 2009-11-11 16:49 -------- d-----w- c:\program files\ATI Technologies
2009-11-11 16:48 . 2009-11-11 16:48 -------- d-----w- c:\program files\CONEXANT
2009-11-11 16:46 . 2009-11-11 16:46 -------- d-----w- c:\program files\AMD
2009-11-11 16:17 . 2009-11-11 16:17 -------- d-----w- c:\program files\microsoft frontpage
2009-11-11 16:15 . 2009-11-11 16:15 -------- d-----w- c:\program files\Services en ligne
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_02\bin\jusched.exe" [2005-03-04 36975]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 794624]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 98304]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-12 2020120]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-12 18:44 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"=c:\program files\iTunes\iTunesHelper.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [14/11/2009 15:24 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/11/2009 19:44 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/11/2009 19:44 360584]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [12/11/2009 19:44 285392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 12:17 1179232]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [11/11/2009 19:30 604416]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [11/11/2009 17:48 200192]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - mbr
.
Contenu du dossier 'Tâches planifiées'

2009-11-14 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 14:21]

2009-11-14 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 13:42]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-coojooquoos - c:\windows\system32\quikac.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-14 19:13
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe??????????A????|?????? ???B?????????????hLC? ??????

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1116)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\HPQ\shared\hpqwmi.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Heure de fin: 2009-11-14 19:15 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-11-14 18:15
ComboFix2.txt 2009-11-14 16:16

Avant-CF: 11 238 850 560 octets libres
Après-CF: 11 210 260 480 octets libres

- - End Of File - - EA21D4F1AE5FADF038819F921817D3EA

Re Guillaume...

http://www.commentcamarche.net/forum/affich-15201983-cheval-de-troie-dropper-generic-bfbi

Salut et bien à toi....

a+