Problème svchost.exe et temp

Bonjour,
Pour commencer merci pour ta réponse rapide!
J'ai un petit soucis: USBfix est introuvable (par ton lien et d'autres que j'ai cherché). Est 'il toujours disponible en téléchargement?

Merci pour le lien ça a fonctionné impeccable!
voici le rapport:

############################## | UsbFix V6.073 |

User : Daniela Ayala (Administrateurs) # ANTOINE
Update on 09/01/2010 by El Desaparecido , C_XX & Chimay8
Start at: 14:42:35 | 14/01/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz
Microsoft Windows 7 Édition Intégrale (6.1.7600 32-bit) #
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled

C:\ -> Disque fixe local # 126,96 Go (34,7 Go free) [HDD] # NTFS
D:\ -> Disque CD-ROM
F:\ -> Disque fixe local # 93,93 Go (71,67 Go free) [Stockage] # NTFS

############################## | Processus actifs |

C:\Windows\System32\smss.exe 352
C:\Windows\system32\csrss.exe 492
C:\Windows\system32\wininit.exe 560
C:\Windows\system32\csrss.exe 572
C:\Windows\system32\winlogon.exe 608
C:\Windows\system32\services.exe 664
C:\Windows\system32\lsass.exe 680
C:\Windows\system32\lsm.exe 688
C:\Windows\system32\svchost.exe 800
C:\Windows\system32\svchost.exe 904
C:\Windows\System32\svchost.exe 1000
C:\Windows\System32\svchost.exe 1040
C:\Windows\system32\svchost.exe 1108
C:\Windows\system32\svchost.exe 1244
C:\Windows\system32\svchost.exe 1356
C:\Windows\System32\spoolsv.exe 1472
C:\Windows\system32\taskeng.exe 1484
C:\Program Files\Avira\AntiVir Desktop\sched.exe 1528
C:\Windows\system32\svchost.exe 1572
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe 1736
C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1808
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1844
C:\Program Files\Bonjour\mDNSResponder.exe 1880
C:\Windows\system32\svchost.exe 1940
C:\Program Files\Mouse Driver\KMWDSrv.exe 2016
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe 500
C:\Windows\system32\DRIVERS\o2flash.exe 408
C:\Windows\system32\IoctlSvc.exe 196
C:\Windows\system32\PnkBstrA.exe 1304
C:\Windows\system32\svchost.exe 736
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 2180
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe 2476
C:\Windows\system32\taskeng.exe 2568
C:\Windows\system32\taskhost.exe 2632
C:\Program Files\Avira\AntiVir Desktop\avmailc.exe 2832
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE 2852
C:\Windows\servicing\TrustedInstaller.exe 2956
C:\Windows\system32\Dwm.exe 3120
C:\Windows\system32\svchost.exe 3148
C:\Windows\Explorer.EXE 3164
C:\Windows\System32\rundll32.exe 3224
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 3404
C:\Windows\RtHDVCpl.exe 3416
C:\Program Files\Mouse Driver\StartAutorun.exe 3424
C:\Program Files\Mouse Driver\KMConfig.exe 3452
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 3472
C:\Program Files\iTunes\iTunesHelper.exe 3492
C:\Program Files\Windows Sidebar\sidebar.exe 3720
C:\Program Files\Mouse Driver\KMProcess.exe 3736
C:\Program Files\iPod\bin\iPodService.exe 4092
C:\Windows\System32\svchost.exe 1924
C:\Windows\System32\svchost.exe 3000
C:\Windows\system32\taskhost.exe 808
C:\Program Files\Mozilla Firefox\firefox.exe 388
C:\Windows\system32\wbem\wmiprvse.exe 3024
C:\Windows\system32\conhost.exe 2204

################## | Elements infectieux |


################## | Registre |


################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\E
shell\AutoRun\command =E:\Setup.exe

################## | Cracks > Keygens > Serials |


################## | ! Fin du rapport # UsbFix V6.073 ! |

voici le fichier et le nom du trojan
C:\Windows\System32\ighwnez.dl
TR/Crypt.FKM.Gen' [trojan]

Gnarf,
petit souci: après 3 essais en mode sans échec (avec et sans l'antivirus activé) Dr Web CureIt s'exécute et plante,
mon écran devient bleu avec écrit en blanc que windows a rencontré un pb et que par sécurité il a a arrété et doit redémarrer.
Je sais pas comment faire...
Je vai bosser la, je serai de retour dans 2-3 heures.
et MERCI, je le dirais jamais assez!
Antoine

Bonsoir,
Voici le rapport généré:
ComboFix 10-01-14.02 - Daniela Ayala 15/01/2010 0:07.1.2 - x86
Microsoft Windows 7 Édition Intégrale 6.1.7600.0.1252.33.1036.18.3067.2085 [GMT 1:00]
Lancé depuis: c:\users\Daniela Ayala\Desktop\antoine.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2517691425-357515915-2978579402-500
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
c:\programdata\Microsoft\Windows\Start Menu\Programs\AntiVirus Plus
c:\programdata\Microsoft\Windows\Start Menu\Programs\AntiVirus Plus\EULA.url
c:\users\Daniela Ayala\AppData\Roaming\SystemProc
c:\windows\system32\~.inf

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Boonty Games


((((((((((((((((((((((((((((( Fichiers créés du 2009-12-14 au 2010-01-14 ))))))))))))))))))))))))))))))))))))
.

2010-01-14 23:34 . 2010-01-14 23:48 -------- d-----w- c:\users\Daniela Ayala\AppData\Local\temp
2010-01-14 23:34 . 2010-01-14 23:34 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-01-14 23:34 . 2010-01-14 23:34 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2010-01-14 23:34 . 2010-01-14 23:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-14 16:23 . 2010-01-14 16:23 -------- d-----w- c:\users\Daniela Ayala\DoctorWeb
2010-01-14 13:41 . 2010-01-14 13:50 -------- d-----w- C:\UsbFix
2010-01-14 13:39 . 2010-01-14 13:39 -------- d-----w- C:\ToolBar SD
2010-01-14 13:28 . 2010-01-14 13:29 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\Apple Computer
2010-01-14 13:28 . 2010-01-14 13:29 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\Apple Computer
2010-01-14 10:56 . 2010-01-14 10:56 111896 ----a-w- c:\windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-14 10:53 . 2010-01-14 10:53 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\Mozilla
2010-01-14 10:34 . 2010-01-14 10:38 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-14 10:34 . 2009-03-30 09:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-01-14 10:34 . 2010-01-14 10:34 -------- d-----w- c:\programdata\Avira
2010-01-14 10:34 . 2010-01-14 10:34 -------- d-----w- c:\program files\Avira
2010-01-14 09:21 . 2010-01-14 09:41 -------- d-----w- c:\programdata\AVP 2009
2010-01-14 09:21 . 2010-01-14 09:46 -------- d-----w- c:\program files\RegistryDoktor 4.1
2010-01-13 18:40 . 2010-01-13 18:40 -------- d-----w- c:\programdata\ReviverSoft
2010-01-13 18:04 . 2009-10-19 14:10 108544 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 18:04 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-01-13 09:18 . 2010-01-13 17:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-10 18:33 . 2010-01-10 18:33 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\WindSolutions
2010-01-08 09:52 . 2010-01-08 09:52 -------- d-----w- c:\users\Daniela Ayala\AppData\Local\CutePDF Writer
2010-01-08 09:51 . 2010-01-08 09:51 -------- d-----w- c:\program files\GPLGS
2010-01-08 09:43 . 2009-11-05 07:39 87552 ----a-w- c:\windows\system32\cpwmon2k.dll
2010-01-08 09:43 . 2010-01-08 09:43 -------- d-----w- c:\program files\Acro Software
2010-01-08 09:43 . 2010-01-08 09:43 -------- d-----w- c:\users\Daniela Ayala\AppData\Local\ApplicationHistory
2010-01-08 09:43 . 2010-01-08 09:43 101 ----a-w- c:\users\Daniela Ayala\AppData\Local\fusioncache.dat
2010-01-01 20:12 . 2010-01-01 20:34 -------- d-----w- c:\programdata\Blizzard Entertainment
2010-01-01 16:58 . 2010-01-01 16:58 -------- d-----w- c:\programdata\Blizzard
2010-01-01 16:21 . 2010-01-01 16:21 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\teamspeak2
2010-01-01 16:21 . 2010-01-01 16:21 -------- d-----w- c:\program files\Teamspeak2_RC2
2009-12-26 01:46 . 2009-12-26 01:46 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\AVS4YOU
2009-12-26 01:45 . 2009-12-26 01:45 -------- d-----w- c:\programdata\AVS4YOU
2009-12-26 01:45 . 2009-12-26 01:45 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-12-26 01:45 . 2008-08-13 09:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-12-26 01:45 . 2008-08-13 09:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2009-12-26 01:45 . 2008-08-13 09:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-12-26 01:45 . 2009-12-26 01:45 -------- d-----w- c:\program files\AVS4YOU
2009-12-19 19:47 . 2009-12-19 19:47 144388 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-16 23:28 . 2009-12-16 23:28 -------- d-----w- c:\program files\Windows Live SkyDrive

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-14 13:36 . 2009-07-27 22:37 -------- d-----w- c:\program files\DivX
2010-01-14 13:16 . 2009-05-27 00:31 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-01-14 13:16 . 2009-11-07 13:10 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-01-14 08:29 . 2009-12-06 14:29 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\SoftGrid Client
2010-01-14 08:28 . 2009-12-06 14:30 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\SoftGrid Client
2010-01-13 20:26 . 2009-07-13 23:11 21584 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-01-13 18:48 . 2008-09-05 14:24 -------- d-----w- c:\programdata\Microsoft Help
2010-01-13 18:47 . 2008-12-07 16:52 -------- d-----w- c:\program files\Nokia
2010-01-13 18:45 . 2008-09-05 13:59 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-13 18:45 . 2009-01-04 11:40 -------- d-----w- c:\program files\Electronic Arts
2010-01-13 18:44 . 2009-10-31 09:14 -------- d-----w- c:\program files\League of Legends
2010-01-13 18:44 . 2009-01-04 11:42 3058 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-01-13 18:40 . 2008-12-05 13:55 -------- d-----w- c:\program files\CCleaner
2010-01-13 17:47 . 2009-11-26 09:48 -------- d-----w- c:\program files\JDownloader
2010-01-12 22:57 . 2009-09-18 14:10 111896 ----a-w- c:\users\Daniela Ayala\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-09 10:01 . 2009-04-27 19:04 1366 ----a-w- c:\users\Daniela Ayala\errorlog.tmp
2010-01-08 09:32 . 2009-09-22 13:25 1192030 ----a-w- c:\windows\system32\~.tmp
2010-01-01 20:47 . 2009-08-28 00:36 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\vlc
2010-01-01 18:00 . 2009-12-08 17:07 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-12-21 18:16 . 2009-12-06 16:40 -------- d-----w- c:\programdata\VirtualizedApplications
2009-12-16 23:31 . 2008-12-05 15:28 -------- d-----w- c:\program files\Windows Live
2009-12-16 23:28 . 2008-12-22 18:38 -------- d-----w- c:\program files\Microsoft
2009-12-15 07:36 . 2009-12-14 18:24 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-12-15 07:36 . 2009-07-14 09:01 -------- d-----w- c:\program files\Windows Journal
2009-12-15 07:36 . 2009-07-14 04:52 -------- d-----w- c:\program files\Windows Sidebar
2009-12-15 07:36 . 2009-07-14 04:52 -------- d-----w- c:\program files\Windows Defender
2009-12-15 07:36 . 2009-07-14 04:52 -------- d-----w- c:\program files\DVD Maker
2009-12-15 07:36 . 2009-07-14 22:37 -------- d-----w- c:\program files\WowCartographe
2009-12-15 07:36 . 2009-01-12 21:56 -------- d-----w- c:\program files\Mouse Driver
2009-12-15 07:36 . 2008-12-09 10:24 -------- d-----w- c:\program files\7-Zip
2009-12-14 18:23 . 2009-12-14 18:23 -------- d-----w- c:\program files\Microsoft Analysis Services
2009-12-06 14:30 . 2009-12-06 14:30 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\NVD
2009-12-06 14:30 . 2009-12-06 14:28 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\TP
2009-11-30 17:02 . 2009-11-30 17:02 171144 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-30 17:02 . 2009-11-30 17:02 72840 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-11-29 15:16 . 2009-01-18 15:18 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\uTorrent
2009-11-06 09:59 . 2009-11-06 09:59 15406728 ----a-w- c:\windows\system32\xlive.dll
2009-11-06 09:59 . 2009-11-06 09:59 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2009-11-02 19:42 . 2009-10-03 06:51 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 07:22 . 2009-11-25 10:12 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-20 01:47 . 2009-10-20 06:58 43068 ----a-w- c:\windows\system32\perfd013.dat
2009-10-20 01:47 . 2009-10-20 06:58 341322 ----a-w- c:\windows\system32\perfi013.dat
2009-10-20 01:34 . 2009-10-20 06:58 39236 ----a-w- c:\windows\system32\perfd006.dat
2009-10-20 01:34 . 2009-10-20 06:58 306636 ----a-w- c:\windows\system32\perfi006.dat
2009-10-20 01:24 . 2009-10-20 06:58 294764 ----a-w- c:\windows\system32\perfi01D.dat
2009-10-20 01:24 . 2009-10-20 06:58 37052 ----a-w- c:\windows\system32\perfd01D.dat
2009-10-20 01:07 . 2009-10-20 06:58 42056 ----a-w- c:\windows\system32\perfd001.dat
2009-10-20 01:07 . 2009-10-20 06:58 289060 ----a-w- c:\windows\system32\perfi001.dat
2009-10-20 00:51 . 2009-10-20 06:58 38710 ----a-w- c:\windows\system32\perfd015.dat
2009-10-20 00:51 . 2009-10-20 06:58 337158 ----a-w- c:\windows\system32\perfi015.dat
2009-10-20 00:45 . 2009-10-20 06:58 323154 ----a-w- c:\windows\system32\prfi0416.dat
2009-10-20 00:45 . 2009-10-20 06:58 38536 ----a-w- c:\windows\system32\prfd0416.dat
2009-10-20 00:37 . 2009-10-20 00:38 39446 ----a-w- c:\windows\system32\perfd019.dat
2009-10-20 00:37 . 2009-10-20 00:38 336704 ----a-w- c:\windows\system32\perfi019.dat
2009-10-20 00:28 . 2009-10-20 00:29 341432 ----a-w- c:\windows\system32\perfi00A.dat
2009-10-20 00:28 . 2009-10-20 00:29 41390 ----a-w- c:\windows\system32\perfd00A.dat
2009-10-20 00:12 . 2009-10-20 00:14 32166 ----a-w- c:\windows\system32\perfd00D.dat
2009-10-20 00:12 . 2009-10-20 00:14 229316 ----a-w- c:\windows\system32\perfi00D.dat
2009-10-19 23:52 . 2009-10-19 23:54 37534 ----a-w- c:\windows\system32\perfd010.dat
2009-10-19 23:52 . 2009-10-19 23:54 335478 ----a-w- c:\windows\system32\perfi010.dat
2009-10-19 23:39 . 2009-10-19 23:40 117840 ----a-w- c:\windows\system32\prfi0404.dat
2009-10-19 23:39 . 2009-10-19 23:40 31548 ----a-w- c:\windows\system32\prfd0404.dat
2009-10-19 23:31 . 2009-10-19 23:32 157694 ----a-w- c:\windows\system32\perfi012.dat
2009-10-19 23:31 . 2009-10-19 23:32 31548 ----a-w- c:\windows\system32\perfd012.dat
2009-10-19 23:24 . 2009-10-19 23:25 292004 ----a-w- c:\windows\system32\perfi005.dat
2009-10-19 23:24 . 2009-10-19 23:25 36232 ----a-w- c:\windows\system32\perfd005.dat
2009-10-19 23:17 . 2009-10-19 23:19 38258 ----a-w- c:\windows\system32\perfd00B.dat
2009-10-19 23:17 . 2009-10-19 23:19 279790 ----a-w- c:\windows\system32\perfi00B.dat
2009-10-19 23:10 . 2009-10-19 23:12 111310 ----a-w- c:\windows\system32\prfi0804.dat
2009-10-19 23:10 . 2009-10-19 23:12 31548 ----a-w- c:\windows\system32\prfd0804.dat
2009-10-19 22:42 . 2009-10-19 22:44 36156 ----a-w- c:\windows\system32\perfd014.dat
2009-10-19 22:42 . 2009-10-19 22:44 298300 ----a-w- c:\windows\system32\perfi014.dat
2009-02-03 23:39 . 2009-02-03 22:15 24 --sha-w- c:\windows\S3A171BBB.tmp
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-07-14 144384]
"Google Update"="c:\users\Daniela Ayala\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-11-23 135664]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 894512]
"RtHDVCpl"="RtHDVCpl.exe" [2008-09-18 6294048]
"KMCONFIG"="c:\program files\Mouse Driver\StartAutorun.exe" [2008-05-30 212992]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2009-01-17 12:27 342848 ----a-w- c:\users\Daniela Ayala\Program Files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-10-28 19:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2009-07-27 02:37 180224 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-04 23:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-12-06 18:47 136600 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\toolbar_eula_launcher]
2007-02-20 16:20 28672 ----a-w- c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
2007-09-26 17:05 734264 ----a-w- c:\program files\Microsoft Xbox 360 Accessories\XBoxStat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [14/01/2010 11:34 194817]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [14/01/2010 11:34 108289]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [14/01/2010 11:34 434945]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files\Mouse Driver\KMWDSrv.exe [30/05/2008 01:22 208896]
R3 netw5v32;Pilote de carte de liaison WiFi sans fil Intel(R) 5000 Series pour Windows Vista 32 bits;c:\windows\System32\drivers\netw5v32.sys [10/06/2009 22:18 4231168]
R3 O2MDRDR;O2MDRDR;c:\windows\System32\drivers\o2media.sys [05/12/2008 19:49 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\System32\drivers\o2sd.sys [13/05/2008 02:48 43736]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [08/12/2008 10:05 721904]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [14/07/2009 00:19 20992]
S2 qayymxwz;Performance Counters for Windows Support;c:\windows\System32\svchost.exe -k netsvcs [14/07/2009 00:19 20992]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - aswFsBlk
*Deregistered* - aswMonFlt
*Deregistered* - aswRdr
*Deregistered* - aswSP
*Deregistered* - aswTdi

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
qayymxwz
.
Contenu du dossier 'Tâches planifiées'

2010-01-14 c:\windows\Tasks\Extension de garantie-Daniela Ayala.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2008-09-05 10:13]

2010-01-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3891736519-3149782466-2473709533-1000Core.job
- c:\users\Daniela Ayala\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-23 14:39]

2010-01-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3891736519-3149782466-2473709533-1000UA.job
- c:\users\Daniela Ayala\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-23 14:39]

2010-01-14 c:\windows\Tasks\Recovery DVD Creator-Daniela Ayala.job
- c:\program files\Packard Bell\SetupMyPc\MCDCheck.exe [2008-09-05 10:13]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.duxot.com/
mStart Page = hxxp://www.duxot.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
Trusted Zone: chat-land.org
FF - ProfilePath - c:\users\Daniela Ayala\AppData\Roaming\Mozilla\Firefox\Profiles\kuqa04q7.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MOAWA1&q=
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Daniela Ayala\AppData\Local\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\users\Daniela Ayala\Program Files\DNA\plugins\npbtdna.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{BD5BE7E8-D40D-4E06-B7DD-75A0F599FD95} - (no file)
MSConfigStartUp-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe



**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x868BF841]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
IoDeviceObjectType -> DumpProcedure -> 0xd46a624f
SecurityProcedure -> 0x85bb4810
QueryNameProcedure -> 0x85bb49a0
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-3891736519-3149782466-2473709533-1000\Software\SecuROM\License information*]
"datasecu"=hex:ac,c8,24,30,8c,08,c9,72,6e,21,2c,22,00,76,46,ee,34,8d,90,ed,92,
38,19,a4,eb,c4,18,00,aa,2d,de,06,96,7d,5d,cb,22,37,73,85,14,5a,83,40,c2,cd,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\DRIVERS\o2flash.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\windows\RtHDVCpl.exe
c:\program files\Mouse Driver\KMConfig.exe
c:\program files\Mouse Driver\KMProcess.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2010-01-15 00:59:41 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-14 23:59

Avant-CF: 38 807 375 872 octets libres
Après-CF: 38 576 246 784 octets libres

- - End Of File - - 6E4A470489B4588F2F4675AE92F26F0E

a priori ca a supprimé des fichier infectés (dont un portant le nom de antivirus plus (saloperie!) qui n'était pas détecté par d'autres programmes!)
bon courage!
Antoine

Voici le rapport! (par contre j'ai pas eu de page blanche moi Oo!)

List'em by g3n-h@ckm@n 1.1.8.3

Thx to El Desaparecido.....& CCM team

User : Daniela Ayala (Administrateurs)
Update on 14/01/2010 by g3n-h@ckm@n ::::: 18:30
Start at: 14:13:28 | 15/01/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz
Microsoft Windows 7 Édition Intégrale (6.1.7600 32-bit) #
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 126,96 Go (48,69 Go free) [HDD] | NTFS
D:\ -> Disque CD-ROM
F:\ -> Disque fixe local | 93,93 Go (59,83 Go free) [Stockage] | NTFS

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Mouse Driver\KMWDSrv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\system32\DRIVERS\o2flash.exe
C:\Windows\system32\IoctlSvc.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Mouse Driver\StartAutorun.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Mouse Driver\KMConfig.exe
C:\Program Files\Mouse Driver\KMProcess.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\StikyNot.exe
C:\Program Files\Java\jre6\bin\javaw.exe
c:\program files\windows defender\MpCmdRun.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Daniela Ayala\AppData\Local\temp\B9D1.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ehTray.exe REG_SZ C:\Windows\ehome\ehTray.exe
Google Update REG_SZ "C:\Users\Daniela Ayala\AppData\Local\Google\Update\GoogleUpdate.exe" /c
Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
RESTART_STICKY_NOTES REG_SZ C:\Windows\system32\StikyNot.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
RtHDVCpl REG_SZ RtHDVCpl.exe
KMCONFIG REG_SZ C:\Program Files\Mouse Driver\StartAutorun.exe KMConfig.exe
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
ConsentPromptBehaviorAdmin REG_DWORD 0 (0x0)
ConsentPromptBehaviorUser REG_DWORD 3 (0x3)
EnableInstallerDetection REG_DWORD 1 (0x1)
EnableLUA REG_DWORD 0 (0x0)
EnableSecureUIAPaths REG_DWORD 1 (0x1)
EnableUIADesktopToggle REG_DWORD 0 (0x0)
EnableVirtualization REG_DWORD 1 (0x1)
PromptOnSecureDesktop REG_DWORD 0 (0x0)
ValidateAdminCodeSignatures REG_DWORD 0 (0x0)
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
scforceoption REG_DWORD 0 (0x0)
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
FilterAdministratorToken REG_DWORD 0 (0x0)
legalnoticetext REG_SZ
DisableRegistryTools REG_DWORD 0 (0x0)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDrives REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
BindDirectlyToPropertySetStorage REG_DWORD 0 (0x0)
NoDrives REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
C:\Program Files\BitTorrent\bittorrent.exe REG_SZ C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{7517B462-F531-4B95-A517-C86FDBB3DAD3}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{25FFAAD0-F4A3-4164-95FF-4461E9F35D51}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{47B3BDBB-F2AE-4B55-95C8-921C25DB3B76}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{49C187D7-91E1-459E-9759-2925384BD397}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A604D2C-E968-429B-8327-62B5CE52126D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9793EDE2-499E-4A14-8220-523691D8F91B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A59B76D1-5E3B-4893-BB7F-AF69B2570A73}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BFA2E378-31D9-4595-AFA9-CA19E610DC0F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CE4BC71D-A88B-4943-BB3D-AF9C0E7D4387}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{FE600E50-2C69-46D5-ACAA-2B617006245C}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.duxot.com/

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.duxot.com/

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x3
Wlansvc : 0x2
SharedAccess : 0x2
windefend : 0x2
wuauserv : 0x2
wscsvc : 0x2

=========

=======
Drive :
=======

D‚fragmenteur de disque Microsoft
Copyright (c) 2007 Microsoft Corp.

Invocation de analyse sur HDD (C:)...



L'op‚ration a r‚ussi.

Post Defragmentation Report:


Informations sur le volumeÿ:
Taille du volume = 126,95 Go
Espace libre = 48,70 Go
Quantit‚ totale d'espace fragment‚ = 2%
Taille maximale d'espace libre = 5,87 Go

Remarqueÿ: les fragments de fichier de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.


Il n'est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\Program Files\RegistryDoktor 4.1
C:\Windows\mbr.exe
C:\Windows\System32\~.tmp
C:\Windows\System32\EZUPBH~1.DLL

¤¤¤¤¤¤¤¤¤¤ Keys :

HKCR\ezUPBHook.ShellObj
HKCR\ezUPBHook.ShellObj.1
HKCR\TypeLib\{478CAB91-9E28-11D4-97FF-0050047D51FB}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4}
HKLM\Software\Classes\Interface\{01009AEC-AFAA-4982-9F2B-6411C5C27E77}
HKLM\Software\Dealio

================
Other infections
================

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-15 14:27:01
Windows 6.1.7600 NTFS

detected NTDLL code modification:
ZwEnumerateKey 0 != 116, ZwQueryKey 0 != 244, ZwOpenKey 0 != 182, ZwClose 0 != 50, ZwEnumerateValueKey 0 != 119, ZwQueryValueKey 0 != 266, ZwOpenFile 0 != 179, ZwQueryDirectoryFile 0 != 223, ZwQuerySystemInformation 0 != 261Initialization error


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

==========
Programs
==========

7-Zip
Acro Software
Adobe
AGEIA Technologies
Alwil Software
Apple Software Update
ATI
ATI Technologies
Avira
AVS4YOU
Bonjour
Camera Assistant Software Lite
CCleaner
Common Files
desktop.ini
DivX
DNA
DVD Maker
EASEUS
Electronic Arts
Fichiers communs
GanttProject
GPLGS
HDReg
InstallShield Installation Information
Intel
Internet Explorer
iPod
iTunes
Java
JDownloader
League of Legends
List_Kill'em
Malwarebytes' Anti-Malware
MediaInfo
Microsoft
Microsoft Analysis Services
Microsoft Games
Microsoft Games for Windows - LIVE
Microsoft Office
Microsoft Office Outlook Connector
Microsoft Office Suite Activation Assistant
Microsoft Silverlight
Microsoft SQL Server Compact Edition
Microsoft Visual Studio
Microsoft Windows 7 Upgrade Advisor
Microsoft Works
Microsoft Xbox 360 Accessories
Microsoft.NET
Mouse Driver
Mozilla Firefox
MSBuild
MSXML 4.0
Nero
NeroInstall.bak
Nokia
O2Micro Flash Memory Card Driver
Packard Bell
PC Connectivity Solution
PowerISO
QuickTime
Realtek
Reference Assemblies
RegistryDoktor 4.1
Satsuki Decoder Pack
Seagate
Skype
Stardock
SwarmPlayer
Synaptics
Teamspeak2_RC2
TuneUp Utilities 2009
Uninstall Information
Utherverse Digital Inc
uTorrent
VideoLAN
Windows Calendar
Windows Collaboration
Windows Defender
Windows Journal
Windows Live
Windows Live SkyDrive
Windows Mail
Windows Media Player
Windows NT
Windows Photo Gallery
Windows Photo Viewer
Windows Portable Devices
Windows Sidebar
WowCartographe

============
Lecteur C:
============

$INPLACE.~TR
$RECYCLE.BIN
$WINDOWS.~Q
32788R22FWJFW
ATI
autoexec.bat
Boonty
boot
bootmgr
BOOTSECT.BAK
ComboFix.txt
config.sys
Documents and Settings
drivers
files.crc
grldr
hiberfil.sys
Intel
Kill'em
List'em.txt
MSOCache
pagefile.sys
PerfLogs
Program Files
ProgramData
Qoobox
Recovery
System Volume Information
ToolBar SD
UsbFix
UsbFix.txt
Users
Windows

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

C:\Program Files\Adobe\Photoshop 7.0\Modules externes\Effets\Patchwork.8bf
C:\Program Files\Adobe\Photoshop Elements 6.0\LMResources\SerializationWF.exv
C:\ProgramData\Adobe\Photoshop Elements\6.0\Locale\fr_FR\Photo Creations Metadata\filters\Patchwork.xml
C:\ProgramData\Adobe\Photoshop Elements\6.0\Photo Creations\filters\Patchwork.atn
C:\ProgramData\Adobe\Photoshop Elements\6.0\Photo Creations\filters\Patchwork.png
C:\ProgramData\VirtualizedApplications\Patch_ready
C:\ProgramData\VirtualizedApplications\Patch_working
C:\Users\All Users\Adobe\Photoshop Elements\6.0\Locale\fr_FR\Photo Creations Metadata\filters\Patchwork.xml
C:\Users\All Users\Adobe\Photoshop Elements\6.0\Photo Creations\filters\Patchwork.atn
C:\Users\All Users\Adobe\Photoshop Elements\6.0\Photo Creations\filters\Patchwork.png
C:\Users\All Users\VirtualizedApplications\Patch_ready
C:\Users\All Users\VirtualizedApplications\Patch_working
C:\Users\Daniela Ayala\Documents\WoW\World of Warcraft\Patch.html
C:\Users\Daniela Ayala\Documents\WoW\World of Warcraft\Patch.txt




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

et voici le rapport
Kill'em by g3n-h@ckm@n 1.1.8.3

User : Daniela Ayala (Administrateurs)
Update on 14/01/2010 by g3n-h@ckm@n ::::: 18:30
Start at: 17:33:05 | 15/01/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz
Microsoft Windows 7 Édition Intégrale (6.1.7600 32-bit) #
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 126,96 Go (47,57 Go free) [HDD] | NTFS
D:\ -> Disque CD-ROM
F:\ -> Disque fixe local | 93,93 Go (59,83 Go free) [Stockage] | NTFS


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Mouse Driver\KMWDSrv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\system32\DRIVERS\o2flash.exe
C:\Windows\system32\IoctlSvc.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Mouse Driver\StartAutorun.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Mouse Driver\KMConfig.exe
C:\Program Files\Mouse Driver\KMProcess.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\svchost.exe
C:\Windows\explorer.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Daniela Ayala\AppData\Local\temp\4D8B.tmp\pv.exe

Detections :
==========


¤¤¤¤¤¤¤¤¤¤ Files/folders Deleted :

"C:\Program Files\RegistryDoktor 4.1"
"C:\Windows\mbr.exe"
C:\Windows\system32\~.tmp
"C:\Windows\SYSTEM32\EZUPBH~1.DLL"
==============
host file OK !
==============

========
Registry
========
Deleted : HKCR\ezUPBHook.ShellObj
Deleted : HKCR\ezUPBHook.ShellObj.1
Deleted : HKCR\TypeLib\{478CAB91-9E28-11D4-97FF-0050047D51FB}
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4}
Deleted : HKLM\Software\Classes\Interface\{01009AEC-AFAA-4982-9F2B-6411C5C27E77}
Deleted : HKLM\Software\Dealio

============
Disk Cleaned
============

================
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

heu^^
Quel fichier combofix? tu peu préciser stp?
celui la?
http://www.cijoint.fr/cjlink.php?file=cj200912/cijrhf1tyT.zip
ou celui la?
http://ww38.toofiles.com/fr/oip/documents/exe/reader_sl.html
ou enfin celui la?
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Voila le rapport, tout s'est déroulé sans pb!
ComboFix 10-01-15.01 - Daniela Ayala 15/01/2010 18:55:23.2.2 - x86
Microsoft Windows 7 Édition Intégrale 6.1.7600.0.1252.33.1036.18.3067.1852 [GMT 1:00]
Lancé depuis: c:\users\Daniela Ayala\Desktop\antoine.exe
Commutateurs utilisés :: c:\users\Daniela Ayala\Desktop\CFScript.txt
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\S3A171BBB.tmp

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-12-15 au 2010-01-15 ))))))))))))))))))))))))))))))))))))
.

2010-01-15 18:21 . 2010-01-15 18:21 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-01-15 18:21 . 2010-01-15 18:21 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2010-01-15 18:21 . 2010-01-15 18:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-15 18:21 . 2010-01-15 18:21 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-01-15 17:45 . 2010-01-15 17:45 -------- d-----w- C:\32788R22FWJFW
2010-01-15 16:32 . 2010-01-15 16:33 -------- d-----w- C:\Kill'em
2010-01-15 13:13 . 2010-01-15 13:13 -------- d-----w- c:\program files\List_Kill'em
2010-01-15 10:57 . 2010-01-15 10:57 -------- d-----w- c:\windows\BIC LIGHTERS FLOWERS Uninstaller
2010-01-15 10:57 . 2008-02-20 15:50 903680 ----a-w- c:\windows\BIC LIGHTERS FLOWERS.scr
2010-01-15 10:57 . 2008-02-20 15:49 495104 ----a-w- c:\windows\BIC LIGHTERS FLOWERS.exe
2010-01-15 09:03 . 2009-11-25 10:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-15 09:03 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-01-15 09:03 . 2010-01-15 09:03 -------- d-----w- c:\program files\Avira
2010-01-15 02:07 . 2010-01-15 02:06 336656 ----a-w- c:\windows\system32\prfi0816.dat
2010-01-15 02:07 . 2010-01-15 02:07 697104 ----a-w- c:\windows\system32\prfh0816.dat
2010-01-15 02:07 . 2010-01-15 02:07 142208 ----a-w- c:\windows\system32\prfc0816.dat
2010-01-15 02:07 . 2010-01-15 02:06 40548 ----a-w- c:\windows\system32\prfd0816.dat
2010-01-15 02:06 . 2010-01-15 02:06 -------- d-----w- c:\windows\pt-PT
2010-01-15 02:06 . 2010-01-15 02:06 -------- d-----w- c:\windows\system32\drivers\pt-PT
2010-01-15 02:06 . 2010-01-15 02:06 -------- d-----w- c:\windows\system32\Spool\prtprocs\w32x86\pt-PT
2010-01-15 02:06 . 2010-01-15 02:06 -------- d-----w- c:\windows\system32\wbem\pt-PT
2010-01-15 02:06 . 2010-01-15 02:06 -------- d-----w- c:\windows\system32\pt
2010-01-14 23:34 . 2010-01-15 19:00 -------- d-----w- c:\users\Daniela Ayala\AppData\Local\temp
2010-01-14 16:23 . 2010-01-14 16:23 -------- d-----w- c:\users\Daniela Ayala\DoctorWeb
2010-01-14 13:41 . 2010-01-14 13:50 -------- d-----w- C:\UsbFix
2010-01-14 13:39 . 2010-01-14 13:39 -------- d-----w- C:\ToolBar SD
2010-01-14 13:28 . 2010-01-14 13:29 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\Apple Computer
2010-01-14 13:28 . 2010-01-14 13:29 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\Apple Computer
2010-01-14 10:56 . 2010-01-14 10:56 111896 ----a-w- c:\windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-14 10:53 . 2010-01-14 10:53 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\Mozilla
2010-01-14 10:34 . 2010-01-15 09:03 -------- d-----w- c:\programdata\Avira
2010-01-14 09:21 . 2010-01-14 09:41 -------- d-----w- c:\programdata\AVP 2009
2010-01-13 18:40 . 2010-01-13 18:40 -------- d-----w- c:\programdata\ReviverSoft
2010-01-13 18:04 . 2009-10-19 14:10 108544 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 18:04 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-01-13 09:18 . 2010-01-13 17:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-10 18:33 . 2010-01-10 18:33 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\WindSolutions
2010-01-08 09:52 . 2010-01-08 09:52 -------- d-----w- c:\users\Daniela Ayala\AppData\Local\CutePDF Writer
2010-01-08 09:51 . 2010-01-08 09:51 -------- d-----w- c:\program files\GPLGS
2010-01-08 09:43 . 2009-11-05 07:39 87552 ----a-w- c:\windows\system32\cpwmon2k.dll
2010-01-08 09:43 . 2010-01-08 09:43 -------- d-----w- c:\program files\Acro Software
2010-01-08 09:43 . 2010-01-08 09:43 -------- d-----w- c:\users\Daniela Ayala\AppData\Local\ApplicationHistory
2010-01-08 09:43 . 2010-01-08 09:43 101 ----a-w- c:\users\Daniela Ayala\AppData\Local\fusioncache.dat
2010-01-01 20:12 . 2010-01-01 20:34 -------- d-----w- c:\programdata\Blizzard Entertainment
2010-01-01 16:58 . 2010-01-01 16:58 -------- d-----w- c:\programdata\Blizzard
2010-01-01 16:21 . 2010-01-01 16:21 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\teamspeak2
2010-01-01 16:21 . 2010-01-01 16:21 -------- d-----w- c:\program files\Teamspeak2_RC2
2009-12-26 01:46 . 2009-12-26 01:46 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\AVS4YOU
2009-12-26 01:45 . 2009-12-26 01:45 -------- d-----w- c:\programdata\AVS4YOU
2009-12-26 01:45 . 2009-12-26 01:45 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-12-26 01:45 . 2008-08-13 09:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-12-26 01:45 . 2008-08-13 09:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2009-12-26 01:45 . 2008-08-13 09:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-12-26 01:45 . 2009-12-26 01:45 -------- d-----w- c:\program files\AVS4YOU
2009-12-19 19:47 . 2009-12-19 19:47 144388 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-16 23:28 . 2009-12-16 23:28 -------- d-----w- c:\program files\Windows Live SkyDrive

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-15 14:28 . 2009-11-26 09:48 -------- d-----w- c:\program files\JDownloader
2010-01-15 02:06 . 2009-07-14 04:52 -------- d-----w- c:\program files\Windows Sidebar
2010-01-15 02:06 . 2009-07-14 02:37 -------- d-----w- c:\program files\Windows Mail
2010-01-15 02:06 . 2009-07-14 09:01 -------- d-----w- c:\program files\Windows Journal
2010-01-15 02:06 . 2009-07-14 04:52 -------- d-----w- c:\program files\Windows Photo Viewer
2010-01-15 02:06 . 2009-07-14 04:52 -------- d-----w- c:\program files\Windows Defender
2010-01-15 02:06 . 2009-07-14 04:52 -------- d-----w- c:\program files\DVD Maker
2010-01-14 13:36 . 2009-07-27 22:37 -------- d-----w- c:\program files\DivX
2010-01-14 13:16 . 2009-05-27 00:31 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-01-14 13:16 . 2009-11-07 13:10 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-01-14 08:29 . 2009-12-06 14:29 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\SoftGrid Client
2010-01-14 08:28 . 2009-12-06 14:30 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\SoftGrid Client
2010-01-13 20:26 . 2009-07-13 23:11 21584 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-01-13 18:48 . 2008-09-05 14:24 -------- d-----w- c:\programdata\Microsoft Help
2010-01-13 18:47 . 2008-12-07 16:52 -------- d-----w- c:\program files\Nokia
2010-01-13 18:45 . 2008-09-05 13:59 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-13 18:45 . 2009-01-04 11:40 -------- d-----w- c:\program files\Electronic Arts
2010-01-13 18:44 . 2009-10-31 09:14 -------- d-----w- c:\program files\League of Legends
2010-01-13 18:44 . 2009-01-04 11:42 3058 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-01-13 18:40 . 2008-12-05 13:55 -------- d-----w- c:\program files\CCleaner
2010-01-12 22:57 . 2009-09-18 14:10 111896 ----a-w- c:\users\Daniela Ayala\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-09 10:01 . 2009-04-27 19:04 1366 ----a-w- c:\users\Daniela Ayala\errorlog.tmp
2010-01-01 20:47 . 2009-08-28 00:36 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\vlc
2010-01-01 18:00 . 2009-12-08 17:07 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-12-21 18:16 . 2009-12-06 16:40 -------- d-----w- c:\programdata\VirtualizedApplications
2009-12-16 23:31 . 2008-12-05 15:28 -------- d-----w- c:\program files\Windows Live
2009-12-16 23:28 . 2008-12-22 18:38 -------- d-----w- c:\program files\Microsoft
2009-12-15 07:36 . 2009-12-14 18:24 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-12-15 07:36 . 2009-07-14 22:37 -------- d-----w- c:\program files\WowCartographe
2009-12-15 07:36 . 2009-01-12 21:56 -------- d-----w- c:\program files\Mouse Driver
2009-12-15 07:36 . 2008-12-09 10:24 -------- d-----w- c:\program files\7-Zip
2009-12-14 18:23 . 2009-12-14 18:23 -------- d-----w- c:\program files\Microsoft Analysis Services
2009-12-06 14:30 . 2009-12-06 14:30 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\NVD
2009-12-06 14:30 . 2009-12-06 14:28 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\TP
2009-11-30 17:02 . 2009-11-30 17:02 171144 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-30 17:02 . 2009-11-30 17:02 72840 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-11-29 15:16 . 2009-01-18 15:18 -------- d-----w- c:\users\Daniela Ayala\AppData\Roaming\uTorrent
2009-11-07 13:34 . 2009-11-07 13:34 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-06 09:59 . 2009-11-06 09:59 15406728 ----a-w- c:\windows\system32\xlive.dll
2009-11-06 09:59 . 2009-11-06 09:59 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2009-11-02 19:42 . 2009-10-03 06:51 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-31 09:18 . 2009-10-31 09:18 38208 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-10-29 07:22 . 2009-11-25 10:12 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-20 01:47 . 2009-10-20 06:58 43068 ----a-w- c:\windows\system32\perfd013.dat
2009-10-20 01:47 . 2009-10-20 06:58 341322 ----a-w- c:\windows\system32\perfi013.dat
2009-10-20 01:34 . 2009-10-20 06:58 39236 ----a-w- c:\windows\system32\perfd006.dat
2009-10-20 01:34 . 2009-10-20 06:58 306636 ----a-w- c:\windows\system32\perfi006.dat
2009-10-20 01:24 . 2009-10-20 06:58 294764 ----a-w- c:\windows\system32\perfi01D.dat
2009-10-20 01:24 . 2009-10-20 06:58 37052 ----a-w- c:\windows\system32\perfd01D.dat
2009-10-20 01:07 . 2009-10-20 06:58 42056 ----a-w- c:\windows\system32\perfd001.dat
2009-10-20 01:07 . 2009-10-20 06:58 289060 ----a-w- c:\windows\system32\perfi001.dat
2009-10-20 00:51 . 2009-10-20 06:58 38710 ----a-w- c:\windows\system32\perfd015.dat
2009-10-20 00:51 . 2009-10-20 06:58 337158 ----a-w- c:\windows\system32\perfi015.dat
2009-10-20 00:45 . 2009-10-20 06:58 323154 ----a-w- c:\windows\system32\prfi0416.dat
2009-10-20 00:45 . 2009-10-20 06:58 38536 ----a-w- c:\windows\system32\prfd0416.dat
2009-10-20 00:37 . 2009-10-20 00:38 39446 ----a-w- c:\windows\system32\perfd019.dat
2009-10-20 00:37 . 2009-10-20 00:38 336704 ----a-w- c:\windows\system32\perfi019.dat
2009-10-20 00:28 . 2009-10-20 00:29 341432 ----a-w- c:\windows\system32\perfi00A.dat
2009-10-20 00:28 . 2009-10-20 00:29 41390 ----a-w- c:\windows\system32\perfd00A.dat
2009-10-20 00:12 . 2009-10-20 00:14 32166 ----a-w- c:\windows\system32\perfd00D.dat
2009-10-20 00:12 . 2009-10-20 00:14 229316 ----a-w- c:\windows\system32\perfi00D.dat
2009-10-19 23:52 . 2009-10-19 23:54 37534 ----a-w- c:\windows\system32\perfd010.dat
2009-10-19 23:52 . 2009-10-19 23:54 335478 ----a-w- c:\windows\system32\perfi010.dat
2009-10-19 23:39 . 2009-10-19 23:40 117840 ----a-w- c:\windows\system32\prfi0404.dat
2009-10-19 23:39 . 2009-10-19 23:40 31548 ----a-w- c:\windows\system32\prfd0404.dat
2009-10-19 23:31 . 2009-10-19 23:32 157694 ----a-w- c:\windows\system32\perfi012.dat
2009-10-19 23:31 . 2009-10-19 23:32 31548 ----a-w- c:\windows\system32\perfd012.dat
2009-10-19 23:24 . 2009-10-19 23:25 292004 ----a-w- c:\windows\system32\perfi005.dat
2009-10-19 23:24 . 2009-10-19 23:25 36232 ----a-w- c:\windows\system32\perfd005.dat
2009-10-19 23:17 . 2009-10-19 23:19 38258 ----a-w- c:\windows\system32\perfd00B.dat
2009-10-19 23:17 . 2009-10-19 23:19 279790 ----a-w- c:\windows\system32\perfi00B.dat
2009-10-19 23:10 . 2009-10-19 23:12 111310 ----a-w- c:\windows\system32\prfi0804.dat
2009-10-19 23:10 . 2009-10-19 23:12 31548 ----a-w- c:\windows\system32\prfd0804.dat
2009-10-19 22:42 . 2009-10-19 22:44 36156 ----a-w- c:\windows\system32\perfd014.dat
2009-10-19 22:42 . 2009-10-19 22:44 298300 ----a-w- c:\windows\system32\perfi014.dat
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-07-14 144384]
"Google Update"="c:\users\Daniela Ayala\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-11-23 135664]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 894512]
"RtHDVCpl"="RtHDVCpl.exe" [2008-09-18 6294048]
"KMCONFIG"="c:\program files\Mouse Driver\StartAutorun.exe" [2008-05-30 212992]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

c:\users\Daniela Ayala\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2009-01-17 12:27 342848 ----a-w- c:\users\Daniela Ayala\Program Files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-10-28 19:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2009-07-27 02:37 180224 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-04 23:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-12-06 18:47 136600 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\toolbar_eula_launcher]
2007-02-20 16:20 28672 ----a-w- c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
2007-09-26 17:05 734264 ----a-w- c:\program files\Microsoft Xbox 360 Accessories\XBoxStat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [15/01/2010 10:03 108289]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files\Mouse Driver\KMWDSrv.exe [30/05/2008 01:22 208896]
R3 netw5v32;Pilote de carte de liaison WiFi sans fil Intel(R) 5000 Series pour Windows Vista 32 bits;c:\windows\System32\drivers\netw5v32.sys [10/06/2009 22:18 4231168]
R3 O2MDRDR;O2MDRDR;c:\windows\System32\drivers\o2media.sys [05/12/2008 19:49 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\System32\drivers\o2sd.sys [13/05/2008 02:48 43736]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [08/12/2008 10:05 721904]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [14/07/2009 00:19 20992]
S2 qayymxwz;Performance Counters for Windows Support;c:\windows\System32\svchost.exe -k netsvcs [14/07/2009 00:19 20992]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - SSMDRV
*Deregistered* - aswFsBlk
*Deregistered* - aswMonFlt
*Deregistered* - aswRdr
*Deregistered* - aswSP
*Deregistered* - aswTdi

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
qayymxwz
.
Contenu du dossier 'Tâches planifiées'

2010-01-15 c:\windows\Tasks\Extension de garantie-Daniela Ayala.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2008-09-05 10:13]

2010-01-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3891736519-3149782466-2473709533-1000Core.job
- c:\users\Daniela Ayala\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-23 14:39]

2010-01-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3891736519-3149782466-2473709533-1000UA.job
- c:\users\Daniela Ayala\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-23 14:39]

2010-01-15 c:\windows\Tasks\Recovery DVD Creator-Daniela Ayala.job
- c:\program files\Packard Bell\SetupMyPc\MCDCheck.exe [2008-09-05 10:13]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.duxot.com/
mStart Page = hxxp://www.duxot.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: chat-land.org
FF - ProfilePath - c:\users\Daniela Ayala\AppData\Roaming\Mozilla\Firefox\Profiles\kuqa04q7.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MOAWA1&q=
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Daniela Ayala\AppData\Local\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\users\Daniela Ayala\Program Files\DNA\plugins\npbtdna.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x868CB841]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
IoDeviceObjectType -> DumpProcedure -> 0xd46a624f
SecurityProcedure -> 0x85bb4810
QueryNameProcedure -> 0x85bb49a0
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-3891736519-3149782466-2473709533-1000\Software\SecuROM\License information*]
"datasecu"=hex:ac,c8,24,30,8c,08,c9,72,6e,21,2c,22,00,76,46,ee,34,8d,90,ed,92,
38,19,a4,eb,c4,18,00,aa,2d,de,06,96,7d,5d,cb,22,37,73,85,14,5a,83,40,c2,cd,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\DRIVERS\o2flash.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\RtHDVCpl.exe
c:\program files\Mouse Driver\KMConfig.exe
c:\program files\Mouse Driver\KMProcess.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\WerFault.exe
c:\windows\BICLIG~1.scr
.
**************************************************************************
.
Heure de fin: 2010-01-15 20:09:35 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-15 19:09
ComboFix2.txt 2010-01-14 23:59

Avant-CF: 50 558 881 792 octets libres
Après-CF: 50 480 058 368 octets libres

- - End Of File - - E9037E1CB3C879BE5A0EFB6CACCD8CA7

Voici les liens des rapports!
Merci encore!
http://www.cijoint.fr/cjlink.php?file=cj201001/cijKPEd8wa.txt
http://www.cijoint.fr/cjlink.php?file=cj201001/cijBnxGJUg.txt

Le rapport! (c'était long comme scan, c'est normal?)
.
======= RAPPORT D'AD-REMOVER 1.1.4.6_H | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 15.01.2010 à 20:01
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 20:50:38, 15/01/2010 | Mode Normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\
Système d'exploitation: Microsoft® Windows 7™ Ultimate Service Pack 2 v6.1.7600
Nom du PC: ANTOINE | Utilisateur actuel: Daniela Ayala

.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.

C:\Users\DANIEL~1\AppData\Roaming\Search Settings

(!) -- Fichiers temporaires supprimés.

.
HKCU\software\Search Settings
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.7 [fr] *
.
Nom du profil: kuqa04q7.default (Daniela Ayala)
.
(DANIEL~1, prefs.js) Browser.download.dir, C:\Users\Daniela Ayala\Desktop
(DANIEL~1, prefs.js) Browser.download.lastDir, C:\Users\Daniela Ayala\Desktop
(DANIEL~1, prefs.js) Browser.startup.homepage, hxxp://www.google.fr/
(DANIEL~1, prefs.js) Extensions.enabledItems, {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.5,{b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.5,illimitux@illimitux.net:3.5,{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11,{e345a394-f15d-b233-ff46-8935c3e56474}:4.6.6.2,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.7
(DANIEL~1, prefs.js) Keyword.URL, hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MOAWA1&q=
.
.
* Internet Explorer Version 8.0.7600.16385 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: no
Start Page Redirect Cache: hxxp://fr.msn.com/?ocid=iehp
Start Page Redirect Cache_TIMESTAMP: 007fb4186164ca01
Start Page Redirect Cache AcceptLangs: fr
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Local Page: C:\Windows\System32\blank.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Start Page: hxxp://fr.msn.com/
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Users\Daniela Ayala\Documents\WoW\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-frFR-patch.exe
C:\Users\Daniela Ayala\Documents\WoW\World of Warcraft\WoW-3.2.0-frFR-patch.exe
C:\Users\Daniela Ayala\Documents\WoW\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-frFR-patch.exe
.
===================================
.
3026 Octet(s) - C:\Ad-Report-CLEAN[1].log
.
4 Fichier(s) - C:\Users\DANIEL~1\AppData\Local\Temp
3 Fichier(s) - C:\Windows\Temp
10 Fichier(s) - C:\Windows\Prefetch
.
20 Fichier(s) - C:\Ad-Remover\BACKUP
1 Fichier(s) - C:\Ad-Remover\QUARANTINE
.
Fin à: 21:12:31 | 15/01/2010 - CLEAN[1]
.
============== E.O.F ==============
.

Bonjour!
Je t'ai posté le rapport ODT et les extras sur les liens suivants!
http://www.cijoint.fr/cjlink.php?file=cj201001/cijEQnSQPZ.txt
http://www.cijoint.fr/cjlink.php?file=cj201001/cijk0n3Udk.txt

Voici le rapport!
Petite question: Le script que tu viens de me donner c un truc générique ou tu l'a fait en fonction de ce que je t'avais envoyé précédemment?

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3891736519-3149782466-2473709533-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KMCONFIG deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3891736519-3149782466-2473709533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
========== FILES ==========
C:\32788R22FWJFW\EN-US folder moved successfully.
C:\32788R22FWJFW folder moved successfully.
C:\ProgramData\AVP 2009 folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Daniela Ayala
->Temp folder emptied: 1654 bytes
->Temporary Internet Files folder emptied: 587281 bytes
->Java cache emptied: 18804668 bytes
->FireFox cache emptied: 34904854 bytes
->Google Chrome cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 24780 bytes
RecycleBin emptied: 5078220 bytes

Total Files Cleaned = 57,00 mb


OTL by OldTimer - Version 3.1.25.0 log created on 01172010_173952

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

non je connais pas ce programme!
ca sert a quoi?restaurer le registre?
le rapport que je t'ai envoyé t'a été utile?

j'ai plus aucun soucis, juste quelques onglet de pubs qui s'ouvrent kan je suis sur firefox, mais c bizarre ca le faisait pas avant...
Je suis plus sur avast maintenant, je suis passé à Antivir, ca marche nikel!

Voici le rapport Findykill!
Merci d'avance!

############################## | FindyKill V5.024 |

# User : Daniela Ayala (Administrateurs) # ANTOINE
# Update on 09/01/2010 by El Desaparecido
# Start at: 18:59:50 | 18/01/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz
# Microsoft Windows 7 Édition Intégrale (6.1.7600 32-bit) #
# Internet Explorer 8.0.7600.16385
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 126,96 Go (63,74 Go free) [HDD] # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque fixe local # 93,93 Go (41,75 Go free) [Stockage] # NTFS

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Mouse Driver\KMWDSrv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\system32\DRIVERS\o2flash.exe
C:\Windows\system32\IoctlSvc.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\msiexec.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\Windows |


################## | C:\Windows\Prefetch |


################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\Daniela Ayala\AppData\Roaming |


################## | Temporary Internet Files |


################## | Registre |


################## | Etat |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# (!) Uac = 0x0

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# windefend -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )


################## | Cracks > Keygens > Serials |


################## | ! Fin du rapport # FindyKill V5.024 ! |

Voici le rapport:

############################## | FindyKill V5.024 |

# User : Daniela Ayala (Administrateurs) # ANTOINE
# Update on 09/01/2010 by El Desaparecido
# Start at: 23:49:11 | 18/01/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz
# Microsoft Windows 7 Édition Intégrale (6.1.7600 32-bit) #
# Internet Explorer 8.0.7600.16385
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 126,96 Go (63,63 Go free) [HDD] # NTFS
# D:\ # Disque CD-ROM
# F:\ # Disque fixe local # 93,93 Go (41,75 Go free) [Stockage] # NTFS

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Mouse Driver\KMWDSrv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\system32\DRIVERS\o2flash.exe
C:\Windows\system32\IoctlSvc.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\runonce.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\Windows |


################## | C:\Windows\Prefetch |

Supprimé ! C:\Windows\Prefetch\WINUPGRO.EXE-B9E72D89.pf

################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\Daniela Ayala\AppData\Roaming |


################## | Autres suppressions ... |

################## | Temporary Internet Files |


################## | Registre |


################## | Etat |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Uac : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# windefend -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | PEH |


################## | Cracks > Keygens > Serials |


################## | ! Fin du rapport # FindyKill V5.024 ! |

Salut!
Rien de détecté...d'où peu venir mon problème d'internet?si je réinstalle Firefox ca pourrai changer qqch?

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3599
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

19/01/2010 23:31:17
mbam-log-2010-01-19 (23-31-17).txt

Type de recherche: Examen complet (C:\|F:\|)
Eléments examinés: 526736
Temps écoulé: 2 hour(s), 27 minute(s), 17 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)