Trojan Spy.gen2

Salut kearny

On va vérifier cela, télécharge RSIT (de random/random) sur le bureau ici :
http://images.malwareremoval.com/random/RSIT.exe

- Double clique sur RSIT.exe qui est sur le bureau
- Clique sur Continue dans la fenêtre
- RSIT téléchargera HijackThis si il n’est pas présent où détecté, alors il faudra accepter la licence
- Poste le contenue des deux rapports, log.txt et info.txt(réduit dans la barre des tâches) à la fin de l’analyse

Les rapports sont dans le dossier ici C:\rsit

@++ :)

Merci dédé de t'occuper de mon cas :)

Le log :

Logfile of random's system information tool 1.06 (written by random/random)
Run by JEREMY at 2010-01-17 15:34:50
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 34 GB (68%) free of 50 GB
Total RAM: 383 MB (15% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:34:58, on 17/01/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ntvdm.exe
C:\OPLIMIT\ocrawr32.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\CSHelper.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\JEREMY\Local Settings\Temporary Internet Files\Content.IE5\OG8012CM\RSIT[1].exe
C:\Program Files\Trend Micro\HijackThis\JEREMY.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.noos.fr/abonnes.php
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OCRAWARE.lnk = C:\OPLIMIT\OCRAWARE.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1\bin\npjpi141.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1\bin\npjpi141.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game05.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} (YYGInstantPlay Control) - http://www.yoyogames.com/downloads/activex/YoYo.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/activex/virtools/CacheManager.CAB
O20 - AppInit_DLLs: winmm.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CopySafe Helper Service (CSHelper) - Unknown owner - C:\WINDOWS\system32\CSHelper.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
O23 - Service: XlashServ (XlashSrv) - Unknown owner - C:\WINDOWS\xlash.exe (file missing)

et "info"

info.txt logfile of random's system information tool 1.06 2010-01-17 15:35:01

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\WINDOWS\UNINST.EXE -f"C:\Program Files\Adobe\Photoshop 5.0\DeIsL1.isu" -c"C:\Program Files\Adobe\Photoshop 5.0\Uninst.dll"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Photoshop Album-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5F9E6AA-7075-49EC-992F-A6213C73607F}\apxp.ex_" -l0x40c
Adobe Reader 7.0.9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70900000002}
Adobe Shockwave Player 11.5-->"C:\WINDOWS\system32\Adobe\Shockwave 11\uninstaller.exe"
AI RoboForm (All Users)-->"C:\Program Files\Siber Systems\AI RoboForm\rfwipeout.exe"
Apple Software Update-->MsiExec.exe /I{55FA89BD-21D3-42F7-9249-C94C0094A83C}
ArtistScope Plugin IE-->"C:\Program Files\Internet Explorer\plugins\uninstall.exe" "/U:C:\Program Files\Internet Explorer\plugins\Uninstall\uninstall.xml"
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
AVG Anti-Spyware 7.5-->C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
CanoCraft CS-P-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Canon\CanoCraft CS-P\Uninst.isu" -c"C:\Program Files\Canon\CanoCraft CS-P\scuninst.dll"
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Digital Camera Driver-->C:\PROGRA~1\DIGITA~1\UNWISE.EXE C:\PROGRA~1\DIGITA~1\INSTALL.LOG
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Environnement d'exécution Java 2, Standard Edition v1.3.1_18-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{68249B78-B714-11D7-88E8-0050DA21757E}\Setup.exe" -uninst
ERUNT 1.1h-->"C:\Program Files\ERUNT\unins000.exe"
Family Feud (remove only)-->"C:\Program Files\Yahoo! Games\Family Feud\Uninstall.exe"
Heredis v.10-->"C:\Program Files\BSD Concept\Heredis 10\unins000.exe"
HijackThis 2.0.2-->"C:\DOCUME~1\JEREMY\LOCALS~1\Temp\Rar$EX01.324\HijackThis.exe" /uninstall
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Java 2 Runtime Environment, SE v1.4.1-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CD0159C9-17FB-11D6-A76A-00B0D079AF64}\setup.exe" Anytext
Java Web Start-->"C:\Program Files\Java Web Start\uninst-javaws.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Matizha Sublime 3.2-->"C:\Program Files\Matizha Sublime 3.0\unins000.exe"
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office XP Professional-->MsiExec.exe /I{9111040C-6000-11D3-8CFE-0050048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Panda ActiveScan-->C:\WINDOWS\system32\ASUninst.exe Panda ActiveScan
Panda NanoScan-->C:\Program Files\Panda Security\NanoScan\nanounst.exe
Panda TotalScan-->C:\Program Files\Panda Security\TotalScan\ascuninst.exe
PartyPokerNet-->"C:\Program Files\PartyGaming.Net\PartyPokerNet\Uninstall.exe" "C:\Program Files\PartyGaming.Net\PartyPokerNet\install.log"
QuickTime-->MsiExec.exe /I{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Scientific Atlanta WebSTAR 2000 series Cable Modem-->UNDPX2K.EXE
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
SpeechRedist-->MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
TuneUp Utilities-->C:\Program Files\TuneUp Utilities 2010\TUInstallHelper.exe --Trigger-Uninstall
Turbo Lister 2-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{69640730-B830-4C24-BB5C-222DA1260548}
Ulead iPhoto Express 1.1-->C:\WINDOWS\ULEAD.DAT\ULuninst.exe /f:ipe11f.inf
Ulead Photo Explorer 8.0 SE Basic-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D271DAE0-8D68-4C97-8356-A126D48A1D8C}\Setup.exe" -l0x40c
Ulead Photo Express 5 SE-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{31383A1D-FAE6-435A-9DBD-FDB61C7C8EC9}\Setup.exe" -l0x40c
Unreal Tournament 2004-->C:\UT2004\System\Setup.exe uninstall "UT2004"
Viewpoint Media Player (Remove Only)-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
Virtools 3D Life Player-->C:\Program Files\Virtools\3D Life Player\WebplayerConfig.exe -u
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}

======Security center information======

AV: Avira AntiVir PersonalEdition

======System event log======

Computer Name: JEREMY
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Compatibilité avec le Changement rapide d'utilisateur.

Record Number: 6212
Source Name: Service Control Manager
Time Written: 20091119213900.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: JEREMY
Event Code: 7036
Message: Le service Services Terminal Server est entré dans l'état : en cours d'exécution.

Record Number: 6211
Source Name: Service Control Manager
Time Written: 20091119213900.000000+060
Event Type: Informations
User:

Computer Name: JEREMY
Event Code: 7000
Message: Le service REGSpy n'a pas pu démarrer en raison de l'erreur :
Le fichier spécifié est introuvable.

Record Number: 6210
Source Name: Service Control Manager
Time Written: 20091119213859.000000+060
Event Type: erreur
User:

Computer Name: JEREMY
Event Code: 7000
Message: Le service FILESpy n'a pas pu démarrer en raison de l'erreur :
Le fichier spécifié est introuvable.

Record Number: 6209
Source Name: Service Control Manager
Time Written: 20091119213859.000000+060
Event Type: erreur
User:

Computer Name: JEREMY
Event Code: 17
Message: AVGNTFLT successfully loaded

Record Number: 6208
Source Name: avgntflt
Time Written: 20091119213844.000000+060
Event Type: Informations
User:

=====Application event log=====

Computer Name: JEREMY
Event Code: 100
Message: msnmsgr (1692) Le moteur de base de données 5.01.2600.2180 est démarré.

Record Number: 32710
Source Name: ESENT
Time Written: 20090703205921.000000+120
Event Type: Informations
User:

Computer Name: JEREMY
Event Code: 101
Message: msnmsgr (1692) Le moteur de base de données est arrêté.

Record Number: 32709
Source Name: ESENT
Time Written: 20090703205831.000000+120
Event Type: Informations
User:

Computer Name: JEREMY
Event Code: 103
Message: msnmsgr (1692) \\.\C:\Documents and Settings\JEREMY\Local Settings\Application Data\Microsoft\Messenger\jejenet@hotmail.com\SharingMetadata\Working\database_165C_C3A2_5CC3_7B4F\dfsr.db: Le moteur de base de données a arrêté une instance (0).

Record Number: 32708
Source Name: ESENT
Time Written: 20090703205831.000000+120
Event Type: Informations
User:

Computer Name: JEREMY
Event Code: 302
Message: msnmsgr (1692) \\.\C:\Documents and Settings\JEREMY\Local Settings\Application Data\Microsoft\Messenger\jejenet@hotmail.com\SharingMetadata\Working\database_165C_C3A2_5CC3_7B4F\dfsr.db: Le moteur de base de données a exécuté la procédure de récupération avec succès.

Record Number: 32707
Source Name: ESENT
Time Written: 20090703154905.000000+120
Event Type: Informations
User:

Computer Name: JEREMY
Event Code: 301
Message: msnmsgr (1692) \\.\C:\Documents and Settings\JEREMY\Local Settings\Application Data\Microsoft\Messenger\jejenet@hotmail.com\SharingMetadata\Working\database_165C_C3A2_5CC3_7B4F\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\JEREMY\Local Settings\Application Data\Microsoft\Messenger\jejenet@hotmail.com\SharingMetadata\Working\database_165C_C3A2_5CC3_7B4F\fsr.log.

Record Number: 32706
Source Name: ESENT
Time Written: 20090703154905.000000+120
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\Fichiers communs\Ulead Systems\DVD;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 8 Stepping 0, AuthenticAMD
"PROCESSOR_REVISION"=0800
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

et "info"

info.txt logfile of random's system information tool 1.06 2010-01-17 15:35:01

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\WINDOWS\UNINST.EXE -f"C:\Program Files\Adobe\Photoshop 5.0\DeIsL1.isu" -c"C:\Program Files\Adobe\Photoshop 5.0\Uninst.dll"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Photoshop Album-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5F9E6AA-7075-49EC-992F-A6213C73607F}\apxp.ex_" -l0x40c
Adobe Reader 7.0.9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70900000002}
Adobe Shockwave Player 11.5-->"C:\WINDOWS\system32\Adobe\Shockwave 11\uninstaller.exe"
AI RoboForm (All Users)-->"C:\Program Files\Siber Systems\AI RoboForm\rfwipeout.exe"
Apple Software Update-->MsiExec.exe /I{55FA89BD-21D3-42F7-9249-C94C0094A83C}
ArtistScope Plugin IE-->"C:\Program Files\Internet Explorer\plugins\uninstall.exe" "/U:C:\Program Files\Internet Explorer\plugins\Uninstall\uninstall.xml"
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
AVG Anti-Spyware 7.5-->C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
CanoCraft CS-P-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Canon\CanoCraft CS-P\Uninst.isu" -c"C:\Program Files\Canon\CanoCraft CS-P\scuninst.dll"
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Digital Camera Driver-->C:\PROGRA~1\DIGITA~1\UNWISE.EXE C:\PROGRA~1\DIGITA~1\INSTALL.LOG
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Environnement d'exécution Java 2, Standard Edition v1.3.1_18-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{68249B78-B714-11D7-88E8-0050DA21757E}\Setup.exe" -uninst
ERUNT 1.1h-->"C:\Program Files\ERUNT\unins000.exe"
Family Feud (remove only)-->"C:\Program Files\Yahoo! Games\Family Feud\Uninstall.exe"
Heredis v.10-->"C:\Program Files\BSD Concept\Heredis 10\unins000.exe"
HijackThis 2.0.2-->"C:\DOCUME~1\JEREMY\LOCALS~1\Temp\Rar$EX01.324\HijackThis.exe" /uninstall
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Java 2 Runtime Environment, SE v1.4.1-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CD0159C9-17FB-11D6-A76A-00B0D079AF64}\setup.exe" Anytext
Java Web Start-->"C:\Program Files\Java Web Start\uninst-javaws.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Matizha Sublime 3.2-->"C:\Program Files\Matizha Sublime 3.0\unins000.exe"
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office XP Professional-->MsiExec.exe /I{9111040C-6000-11D3-8CFE-0050048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Panda ActiveScan-->C:\WINDOWS\system32\ASUninst.exe Panda ActiveScan
Panda NanoScan-->C:\Program Files\Panda Security\NanoScan\nanounst.exe
Panda TotalScan-->C:\Program Files\Panda Security\TotalScan\ascuninst.exe
PartyPokerNet-->"C:\Program Files\PartyGaming.Net\PartyPokerNet\Uninstall.exe" "C:\Program Files\PartyGaming.Net\PartyPokerNet\install.log"
QuickTime-->MsiExec.exe /I{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Scientific Atlanta WebSTAR 2000 series Cable Modem-->UNDPX2K.EXE
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
SpeechRedist-->MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
TuneUp Utilities-->C:\Program Files\TuneUp Utilities 2010\TUInstallHelper.exe --Trigger-Uninstall
Turbo Lister 2-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{69640730-B830-4C24-BB5C-222DA1260548}
Ulead iPhoto Express 1.1-->C:\WINDOWS\ULEAD.DAT\ULuninst.exe /f:ipe11f.inf
Ulead Photo Explorer 8.0 SE Basic-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D271DAE0-8D68-4C97-8356-A126D48A1D8C}\Setup.exe" -l0x40c
Ulead Photo Express 5 SE-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{31383A1D-FAE6-435A-9DBD-FDB61C7C8EC9}\Setup.exe" -l0x40c
Unreal Tournament 2004-->C:\UT2004\System\Setup.exe uninstall "UT2004"
Viewpoint Media Player (Remove Only)-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
Virtools 3D Life Player-->C:\Program Files\Virtools\3D Life Player\WebplayerConfig.exe -u
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}

======Security center information======

AV: Avira AntiVir PersonalEdition

======System event log======

Computer Name: JEREMY
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Compatibilité avec le Changement rapide d'utilisateur.

Record Number: 6212
Source Name: Service Control Manager
Time Written: 20091119213900.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: JEREMY
Event Code: 7036
Message: Le service Services Terminal Server est entré dans l'état : en cours d'exécution.

Record Number: 6211
Source Name: Service Control Manager
Time Written: 20091119213900.000000+060
Event Type: Informations
User:

Computer Name: JEREMY
Event Code: 7000
Message: Le service REGSpy n'a pas pu démarrer en raison de l'erreur :
Le fichier spécifié est introuvable.

Record Number: 6210
Source Name: Service Control Manager
Time Written: 20091119213859.000000+060
Event Type: erreur
User:

Computer Name: JEREMY
Event Code: 7000
Message: Le service FILESpy n'a pas pu démarrer en raison de l'erreur :
Le fichier spécifié est introuvable.

Record Number: 6209
Source Name: Service Control Manager
Time Written: 20091119213859.000000+060
Event Type: erreur
User:

Computer Name: JEREMY
Event Code: 17
Message: AVGNTFLT successfully loaded

Record Number: 6208
Source Name: avgntflt
Time Written: 20091119213844.000000+060
Event Type: Informations
User:

=====Application event log=====

Computer Name: JEREMY
Event Code: 100
Message: msnmsgr (1692) Le moteur de base de données 5.01.2600.2180 est démarré.

Record Number: 32710
Source Name: ESENT
Time Written: 20090703205921.000000+120
Event Type: Informations
User:

Computer Name: JEREMY
Event Code: 101
Message: msnmsgr (1692) Le moteur de base de données est arrêté.

Record Number: 32709
Source Name: ESENT
Time Written: 20090703205831.000000+120
Event Type: Informations
User:

Computer Name: JEREMY
Event Code: 103
Message: msnmsgr (1692) \\.\C:\Documents and Settings\JEREMY\Local Settings\Application Data\Microsoft\Messenger\jejenet@hotmail.com\SharingMetadata\Working\database_165C_C3A2_5CC3_7B4F\dfsr.db: Le moteur de base de données a arrêté une instance (0).

Record Number: 32708
Source Name: ESENT
Time Written: 20090703205831.000000+120
Event Type: Informations
User:

Computer Name: JEREMY
Event Code: 302
Message: msnmsgr (1692) \\.\C:\Documents and Settings\JEREMY\Local Settings\Application Data\Microsoft\Messenger\jejenet@hotmail.com\SharingMetadata\Working\database_165C_C3A2_5CC3_7B4F\dfsr.db: Le moteur de base de données a exécuté la procédure de récupération avec succès.

Record Number: 32707
Source Name: ESENT
Time Written: 20090703154905.000000+120
Event Type: Informations
User:

Computer Name: JEREMY
Event Code: 301
Message: msnmsgr (1692) \\.\C:\Documents and Settings\JEREMY\Local Settings\Application Data\Microsoft\Messenger\jejenet@hotmail.com\SharingMetadata\Working\database_165C_C3A2_5CC3_7B4F\dfsr.db: Le moteur de base de données commence la relecture du fichier journal \\.\C:\Documents and Settings\JEREMY\Local Settings\Application Data\Microsoft\Messenger\jejenet@hotmail.com\SharingMetadata\Working\database_165C_C3A2_5CC3_7B4F\fsr.log.

Record Number: 32706
Source Name: ESENT
Time Written: 20090703154905.000000+120
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\Fichiers communs\Ulead Systems\DVD;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 8 Stepping 0, AuthenticAMD
"PROCESSOR_REVISION"=0800
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

Salut kearny

Télécharge OTM (de Old_Timer) sur le bureau :

http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/

Double-clique sur OTM.exe sur le bureau

- Copie le texte qui se trouve en gras ci-dessous et colle le dans le cadre de gauche de OTM nommé Paste Instructions for Items to be Moved

:services
XlashSrv

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

:files
C:\Windows\Tasks\At?.job
C:\Windows\Tasks\At??.job

:commands
[purity]
[emptytemp]
[reboot]

- Clique sur MoveIt! pour lancer la suppression.
- Ferme OTM

Ton PC va redémarrer pour finir la suppression, si il ne le fais pas lui-même, redémarre le.

Poste le rapport de OTMoveIt qui se trouve dans C:\_OTM\MovedFiles.

@++ :)

Voila le rapport (l'alerte Antivir apparait tjrs) :

All processes killed
========== SERVICES/DRIVERS ==========
Service XlashSrv stopped successfully!
Service XlashSrv deleted successfully!
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi­on\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
========== FILES ==========
C:\Windows\Tasks\At1.job moved successfully.
C:\Windows\Tasks\At2.job moved successfully.
C:\Windows\Tasks\At3.job moved successfully.
C:\Windows\Tasks\At4.job moved successfully.
C:\Windows\Tasks\At5.job moved successfully.
C:\Windows\Tasks\At6.job moved successfully.
C:\Windows\Tasks\At7.job moved successfully.
C:\Windows\Tasks\At8.job moved successfully.
C:\Windows\Tasks\At9.job moved successfully.
C:\Windows\Tasks\At10.job moved successfully.
C:\Windows\Tasks\At11.job moved successfully.
C:\Windows\Tasks\At12.job moved successfully.
C:\Windows\Tasks\At13.job moved successfully.
C:\Windows\Tasks\At14.job moved successfully.
C:\Windows\Tasks\At15.job moved successfully.
C:\Windows\Tasks\At16.job moved successfully.
C:\Windows\Tasks\At17.job moved successfully.
C:\Windows\Tasks\At18.job moved successfully.
C:\Windows\Tasks\At19.job moved successfully.
C:\Windows\Tasks\At20.job moved successfully.
C:\Windows\Tasks\At21.job moved successfully.
C:\Windows\Tasks\At22.job moved successfully.
C:\Windows\Tasks\At23.job moved successfully.
C:\Windows\Tasks\At24.job moved successfully.
C:\Windows\Tasks\At25.job moved successfully.
C:\Windows\Tasks\At26.job moved successfully.
C:\Windows\Tasks\At27.job moved successfully.
C:\Windows\Tasks\At28.job moved successfully.
C:\Windows\Tasks\At29.job moved successfully.
C:\Windows\Tasks\At30.job moved successfully.
C:\Windows\Tasks\At31.job moved successfully.
C:\Windows\Tasks\At32.job moved successfully.
C:\Windows\Tasks\At33.job moved successfully.
C:\Windows\Tasks\At34.job moved successfully.
C:\Windows\Tasks\At35.job moved successfully.
C:\Windows\Tasks\At36.job moved successfully.
C:\Windows\Tasks\At37.job moved successfully.
C:\Windows\Tasks\At38.job moved successfully.
C:\Windows\Tasks\At39.job moved successfully.
C:\Windows\Tasks\At40.job moved successfully.
C:\Windows\Tasks\At41.job moved successfully.
C:\Windows\Tasks\At42.job moved successfully.
C:\Windows\Tasks\At43.job moved successfully.
C:\Windows\Tasks\At44.job moved successfully.
C:\Windows\Tasks\At45.job moved successfully.
C:\Windows\Tasks\At46.job moved successfully.
C:\Windows\Tasks\At47.job moved successfully.
C:\Windows\Tasks\At48.job moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: JEREMY
->Temp folder emptied: 2677962 bytes
->Temporary Internet Files folder emptied: 52795076 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 5324776 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 407016 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2114937 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 157922 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 61,00 mb

OTM by OldTimer - Version 3.1.6.0 log created on 01172010_162201

Files moved on Reboot...

Registry entries deleted on Reboot...

Salut kearny

Important Désactive ton Antivirus et antispyware avant le scan avec DiagHelp :
https://forum.pcastuces.com/default.asp

Télécharge DiagHelp sur le bureau ici :

http://www.malekal.com/download/DiagHelp.zip

Lire et suivre attentivement le tutoriel ici :

http://www.malekal.com/DiagHelp/DiagHelp.php

- Choisi l'option 1 (Lister Fichiers), enregistre-le sur le bureau.

---

Utilise ensuite cjoint.com pour poster en lien ton rapport :
https://www.cjoint.com/

- Clique sur Parcourir pour aller chercher le rapport
- Clique sur Ouvrir ensuite sur Créer le lien Cjoint

- Fais un copier/coller du lien qui est devant Le lien a été créé: dans ta prochaine réponse.

@++ :)

https://www.cjoint.com/?brsQ1W5jAv

Salut kearny

Télécharge SDFix par AndyManchesta sur le Bureau :

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Double clic sur sdfix.exe sur le bureau et clic sur Install , un dossier sera créer a la racine du disque C:\SDFix

Redémarre ton PC en mode sans échec :

Au redémarrage de ton PC tapote sur la touche F8 ou F5, sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur.

Ouvre le dossier SDFix et double clique sur RunThis.bat, appuie sur Y pour lancer le nettoyage.

Il y aura redémarrage, quand Finished s’affichera appuie sur un touche pour terminer.

Poste le rapport qui se trouve dans le dossier SDFix sous le nom de Report.txt dans ta prochaine réponse.

@++ :)

J'ai lancé runthis en mode sans échec, je l'ai laissé faire jusqu'au redémarrage automatique.
A partir de là, sur le mode normal, il a bloqué pdt 1h (j'avais replacé antivir - alors je l'ai désactivé à nouveau)
et ca s'est débloqué et le report est le suivant :

[b]SDFix: Version 1.240 [/b]
Run by JEREMY on 17/01/2010 at 19:34

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

No Trojan Files Found

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-17 20:37:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\InstantTouch\\bin\\CmCenterV2.exe"="C:\\Program Files\\InstantTouch\\bin\\CmCenterV2.exe:*:Enabled:CmCenter Module"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\Program Files\\PeerTV\\PeerCast.exe"="C:\\Program Files\\PeerTV\\PeerCast.exe:*:Enabled:PeerCast"
"C:\\Program Files\\PeerCast\\PeerCast.exe"="C:\\Program Files\\PeerCast\\PeerCast.exe:*:Enabled:PeerCast"
"C:\\UT2004\\System\\UT2004.exe"="C:\\UT2004\\System\\UT2004.exe:*:Enabled:UT2004"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[b]Remaining Files [/b]:

[b]Files with Hidden Attributes [/b]:

Thu 7 Dec 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 7 Dec 2006 4,348 A..H. --- "C:\Documents and Settings\JEREMY\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Wed 4 Apr 2007 20 A..H. --- "C:\Documents and Settings\JEREMY\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Thu 7 Dec 2006 9,655 A.SH. --- "C:\Documents and Settings\JEREMY\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Sat 28 Mar 2009 112,703,975 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c7335f2b91892ece82339556ae30331d\download\BIT35.tmp"

[b]Finished![/b]

Tu y vois un peu plus clair ? :)

Salut kearny

Télécharge Gmer et enregistre-le sur ton bureau.
http://www2.gmer.net/download.php

Note : l'application portera un nom aléatoire. Indique-le moi dans ton prochain message.

- Déconnecte toi d'internet si possible et ferme tous les programmes, puis lance l'outil.
- Clique sur le bouton "Scan" sur la droite.

- Lorsque le scan est terminé, clic sur "Copy".
- Ouvre le bloc-note et clic sur le Menu Edition / Coller
- Le rapport doit alors apparaître.

- Enregistre le fichier sur ton bureau et copie/colle le contenu ici.

@++ :)

Le scan commence, mais à la moitié du scan, l'application se ferme.
J'ai essayé toutes les situations, avec ou sans internet, avec ou sans antivirus, à chaque fois, l'application se ferme sans avertissement.

Salut kearny

Voir en mode sans échec :

Au redémarrage de ton PC tapote sur la touche F8 ou F5, sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur

@++ :)

ah oui ! pas bête :)

le rapport :

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-17 23:48:02
Windows 5.1.2600 Service Pack 2
Running: 2cb649ee.exe; Driver: C:\DOCUME~1\JEREMY\LOCALS~1\Temp\awtdypow.sys

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\winlogon.exe[208] ntdll.dll!NtOpenKey 7C91DD3C 5 Bytes JMP 10003DF0
.text C:\WINDOWS\system32\winlogon.exe[208] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 10003C38
.text C:\WINDOWS\system32\winlogon.exe[208] kernel32.dll!ExitProcess 7C81CAA2 5 Bytes JMP 10003E74
.text C:\WINDOWS\system32\winlogon.exe[208] WS2_32.dll!connect 719F406A 5 Bytes JMP 10003AEC
.text C:\WINDOWS\system32\winlogon.exe[208] WS2_32.dll!send 719F428A 5 Bytes JMP 10003260
.text C:\WINDOWS\system32\winlogon.exe[208] WS2_32.dll!WSARecv 719F4318 5 Bytes JMP 100027F4
.text C:\WINDOWS\system32\winlogon.exe[208] WS2_32.dll!recv 719F615A 5 Bytes JMP 10002788
.text C:\WINDOWS\system32\winlogon.exe[208] WS2_32.dll!WSASend 719F6233 5 Bytes JMP 10003A98
.text C:\WINDOWS\system32\services.exe[256] ntdll.dll!NtOpenKey 7C91DD3C 5 Bytes JMP 10003DF0
.text C:\WINDOWS\system32\services.exe[256] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 10003C38
.text C:\WINDOWS\system32\services.exe[256] kernel32.dll!ExitProcess 7C81CAA2 5 Bytes JMP 10003E74
.text C:\WINDOWS\system32\services.exe[256] ws2_32.dll!connect 719F406A 5 Bytes JMP 10003AEC
.text C:\WINDOWS\system32\services.exe[256] ws2_32.dll!send 719F428A 5 Bytes JMP 10003260
.text C:\WINDOWS\system32\services.exe[256] ws2_32.dll!WSARecv 719F4318 5 Bytes JMP 100027F4
.text C:\WINDOWS\system32\services.exe[256] ws2_32.dll!recv 719F615A 5 Bytes JMP 10002788
.text C:\WINDOWS\system32\services.exe[256] ws2_32.dll!WSASend 719F6233 5 Bytes JMP 10003A98
.text C:\WINDOWS\system32\lsass.exe[268] ntdll.dll!NtOpenKey 7C91DD3C 5 Bytes JMP 10003DF0
.text C:\WINDOWS\system32\lsass.exe[268] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 10003C38
.text C:\WINDOWS\system32\lsass.exe[268] kernel32.dll!ExitProcess 7C81CAA2 5 Bytes JMP 10003E74
.text C:\WINDOWS\system32\lsass.exe[268] WS2_32.dll!connect 719F406A 5 Bytes JMP 10003AEC
.text C:\WINDOWS\system32\lsass.exe[268] WS2_32.dll!send 719F428A 5 Bytes JMP 10003260
.text C:\WINDOWS\system32\lsass.exe[268] WS2_32.dll!WSARecv 719F4318 5 Bytes JMP 100027F4
.text C:\WINDOWS\system32\lsass.exe[268] WS2_32.dll!recv 719F615A 5 Bytes JMP 10002788
.text C:\WINDOWS\system32\lsass.exe[268] WS2_32.dll!WSASend 719F6233 5 Bytes JMP 10003A98
.text C:\WINDOWS\system32\svchost.exe[428] ntdll.dll!NtOpenKey 7C91DD3C 5 Bytes JMP 10003DF0
.text C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 10003C38
.text C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!ExitProcess 7C81CAA2 5 Bytes JMP 10003E74
.text C:\WINDOWS\system32\svchost.exe[428] ws2_32.dll!connect 719F406A 5 Bytes JMP 10003AEC
.text C:\WINDOWS\system32\svchost.exe[428] ws2_32.dll!send 719F428A 5 Bytes JMP 10003260
.text C:\WINDOWS\system32\svchost.exe[428] ws2_32.dll!WSARecv 719F4318 5 Bytes JMP 100027F4
.text C:\WINDOWS\system32\svchost.exe[428] ws2_32.dll!recv 719F615A 5 Bytes JMP 10002788
.text C:\WINDOWS\system32\svchost.exe[428] ws2_32.dll!WSASend 719F6233 5 Bytes JMP 10003A98
.text C:\WINDOWS\system32\svchost.exe[496] ntdll.dll!NtOpenKey 7C91DD3C 5 Bytes JMP 10003DF0
.text C:\WINDOWS\system32\svchost.exe[496] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 10003C38
.text C:\WINDOWS\system32\svchost.exe[496] kernel32.dll!ExitProcess 7C81CAA2 5 Bytes JMP 10003E74
.text C:\WINDOWS\system32\svchost.exe[496] ws2_32.dll!connect 719F406A 5 Bytes JMP 10003AEC
.text C:\WINDOWS\system32\svchost.exe[496] ws2_32.dll!send 719F428A 5 Bytes JMP 10003260
.text C:\WINDOWS\system32\svchost.exe[496] ws2_32.dll!WSARecv 719F4318 5 Bytes JMP 100027F4
.text C:\WINDOWS\system32\svchost.exe[496] ws2_32.dll!recv 719F615A 5 Bytes JMP 10002788
.text C:\WINDOWS\system32\svchost.exe[496] ws2_32.dll!WSASend 719F6233 5 Bytes JMP 10003A98
.text C:\WINDOWS\system32\svchost.exe[556] ntdll.dll!NtOpenKey 7C91DD3C 5 Bytes JMP 10003DF0
.text C:\WINDOWS\system32\svchost.exe[556] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 10003C38
.text C:\WINDOWS\system32\svchost.exe[556] kernel32.dll!ExitProcess 7C81CAA2 5 Bytes JMP 10003E74
.text C:\WINDOWS\system32\svchost.exe[556] ws2_32.dll!connect 719F406A 5 Bytes JMP 10003AEC
.text C:\WINDOWS\system32\svchost.exe[556] ws2_32.dll!send 719F428A 5 Bytes JMP 10003260
.text C:\WINDOWS\system32\svchost.exe[556] ws2_32.dll!WSARecv 719F4318 5 Bytes JMP 100027F4
.text C:\WINDOWS\system32\svchost.exe[556] ws2_32.dll!recv 719F615A 5 Bytes JMP 10002788
.text C:\WINDOWS\system32\svchost.exe[556] ws2_32.dll!WSASend 719F6233 5 Bytes JMP 10003A98
.text C:\WINDOWS\Explorer.EXE[780] ntdll.dll!NtOpenKey 7C91DD3C 5 Bytes JMP 10003DF0
.text C:\WINDOWS\Explorer.EXE[780] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 10003C38
.text C:\WINDOWS\Explorer.EXE[780] kernel32.dll!ExitProcess 7C81CAA2 5 Bytes JMP 10003E74
.text C:\WINDOWS\Explorer.EXE[780] ws2_32.dll!connect 719F406A 5 Bytes JMP 10003AEC
.text C:\WINDOWS\Explorer.EXE[780] ws2_32.dll!send 719F428A 5 Bytes JMP 10003260
.text C:\WINDOWS\Explorer.EXE[780] ws2_32.dll!WSARecv 719F4318 5 Bytes JMP 100027F4
.text C:\WINDOWS\Explorer.EXE[780] ws2_32.dll!recv 719F615A 5 Bytes JMP 10002788
.text C:\WINDOWS\Explorer.EXE[780] ws2_32.dll!WSASend 719F6233 5 Bytes JMP 10003A98

---- EOF - GMER 1.0.15 ----

Salut kearny

Télécharge combofix.exe (de sUBs) sur le bureau :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

Important Désactive ton Antivirus, antispyware et Pare feu avant le scan avec Combofix :
https://forum.pcastuces.com/default.asp
https://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/

==> Sauvegarde ton travail et ferme toutes les fenêtres actives, il peut y avoir un redémarrage du PC. Ne lance aucun programme tant que Combofix n’est pas fini. <==

Double clique sur combofix.exe, clique sur OUI et valide par Entrée

Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Combofix est détecté par certains antivirus comme une infection, ne pas en tenir compte, il s'agit d'un faux positif, continue la procédure

@++ :)

Cette dernière intervention me semble pas mal.
Voila le rapport de l'opération :

ComboFix 10-01-16.04 - JEREMY 18/01/2010 0:56.1.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.383.152 [GMT 1:00]
Lancé depuis: c:\documents and settings\JEREMY\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2397974594-337539203-1138793434-1001
C:\bold.log
c:\docume~1\JEREMY\LOCALS~1\irdimar.bak

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-12-18 au 2010-01-18 ))))))))))))))))))))))))))))))))))))
.

2010-01-17 21:55 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-01-17 21:55 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-01-17 18:31 . 2010-01-17 18:31 -------- d-----w- c:\windows\ERUNT
2010-01-17 18:26 . 2010-01-17 19:38 -------- d-----w- C:\SDFix
2010-01-17 15:22 . 2010-01-17 15:22 -------- d-----w- C:\_OTM
2010-01-17 14:34 . 2010-01-17 14:35 -------- d-----w- C:\rsit
2010-01-17 13:16 . 2010-01-17 13:16 -------- d-----w- c:\program files\Trend Micro
2010-01-17 11:46 . 2009-12-17 20:03 30536 ----a-w- c:\windows\system32\TURegOpt.exe
2010-01-17 11:46 . 2009-12-17 19:56 30024 ----a-w- c:\windows\system32\uxtuneup.dll
2010-01-17 11:46 . 2010-01-17 11:46 -------- d-----w- c:\documents and settings\JEREMY\Application Data\TuneUp Software
2010-01-17 11:46 . 2010-01-17 11:46 -------- d-----w- c:\program files\TuneUp Utilities 2010
2010-01-17 11:45 . 2010-01-17 11:46 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2010-01-17 11:45 . 2010-01-17 11:45 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-01-17 01:46 . 2010-01-17 01:46 -------- d-----w- c:\documents and settings\JEREMY\Application Data\Malwarebytes
2010-01-17 01:46 . 2010-01-17 01:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-17 01:46 . 2010-01-17 18:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-03 23:28 . 2010-01-03 23:28 -------- d-----w- c:\documents and settings\JEREMY\Application Data\Mozilla-Cache
1601-01-01 00:00 . 1601-01-01 00:00 -------- d-----w- c:\windows\LastGood.Tmp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-17 23:43 . 2007-09-23 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\AntiVir PersonalEdition Classic
2010-01-17 23:32 . 2006-11-28 01:44 -------- d-----w- c:\program files\InstantTouch
2010-01-03 23:28 . 2006-12-20 21:37 -------- d-----w- c:\program files\PartyGaming.Net
2009-10-25 04:53 . 2004-08-05 12:00 48856 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-25 04:53 . 2004-08-05 12:00 368076 ----a-w- c:\windows\system32\perfh00C.dat
.

------- Sigcheck -------

[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\SoftwareDistribution\Download\7b6e084e897a416dad6204fec54d1e00\sp3qfe\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\SoftwareDistribution\Download\7b6e084e897a416dad6204fec54d1e00\sp3gdr\tcpip.sys
[-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\SoftwareDistribution\Download\7b6e084e897a416dad6204fec54d1e00\sp2gdr\tcpip.sys
[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\SoftwareDistribution\Download\7b6e084e897a416dad6204fec54d1e00\sp2qfe\tcpip.sys
[-] 2006-11-30 . 6A603809F598332DBEDD535BDBCE313E . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\TCPIP.SYS
[-] 2006-11-30 . 6A603809F598332DBEDD535BDBCE313E . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\TCPIP.SYS
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\JEREMY\Menu D‚marrer\Programmes\D‚marrage\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-3-6 36864]
OCRAWARE.lnk - c:\oplimit\OCRAWARE.EXE [2006-11-30 51360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.exe.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2009-6-30 108544]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi9"=c:\docume~1\JEREMY\LOCALS~1\irdimar.bak 2yKAHJNFFL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\InstantTouch\\bin\\CmCenterV2.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\PeerTV\\PeerCast.exe"=
"c:\\UT2004\\System\\UT2004.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4662:TCP"= 4662:TCP:eMule TCP
"4672:UDP"= 4672:UDP:eMule UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)

R2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [17/03/2009 11:40 266240]
R2 ScFBPNT;CanoScan FBP Port Driver;c:\windows\system32\drivers\SCFBPNT.SYS [30/11/2006 16:31 16288]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [17/12/2009 21:00 1044808]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14/10/2009 07:24 10064]
S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys --> c:\program files\Softwin\BitDefender9\filespy.sys [?]
S3 ADM8511;Convertisseur USB vers Fast Ethernet ADMtek ADM8511/AN986;c:\windows\system32\drivers\ADM8511.SYS [22/11/2006 12:32 20160]
S3 DCamUSBDigitalCamera;Digital Camera;c:\windows\system32\drivers\MPIXVID.SYS [23/12/2006 04:47 104593]
S3 v800bus;Sony Ericsson V800-Vodafone 802SE driver (WDM);c:\windows\system32\drivers\v800bus.sys [04/09/2007 14:41 52416]
S3 v800mdfl;Sony Ericsson V800-Vodafone 802SE USB WMC Modem Filter;c:\windows\system32\drivers\v800mdfl.sys [04/09/2007 14:41 6160]
S3 v800mdm;Sony Ericsson V800-Vodafone 802SE USB WMC Modem Driver;c:\windows\system32\drivers\v800mdm.sys [04/09/2007 14:41 84544]
S3 v800mgmt;Sony Ericsson V800-Vodafone 802SE USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\v800mgmt.sys [04/09/2007 14:48 77760]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2010-01-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 13:21]

2010-01-18 c:\windows\Tasks\Recherche de problèmes automatique.job
- c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-12-17 20:07]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.noos.fr/abonnes.php
uInternet Connection Wizard,ShellNext = iexplore
IE: Barre RoboForm - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Enregistrer le formulaire - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Personnaliser le menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Remplir le formulaire - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} - hxxp://data.jeuxclassiques.com/npwwg.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game05.zylom.com/activex/zylomgamesplayer.cab
DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} - hxxp://www.yoyogames.com/downloads/activex/YoYo.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

SafeBoot-AVG Anti-Spyware Driver
AddRemove-HijackThis - c:\docume~1\JEREMY\LOCALS~1\Temp\Rar$EX01.324\HijackThis.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-18 01:04
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(2616)
c:\oplimit\oahook32.dll
c:\windows\system32\msi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\wdfmgr.exe
c:\oplimit\ocrawr32.exe
c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2010-01-18 01:09:22 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-18 00:09

Avant-CF: 34 511 286 272 octets libres
Après-CF: 34 620 452 864 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 1BD03498FEA729D2CD0312ED1EE699D1

Salut kearny

- Clique sur le menu démarrer/Exécuter, tape notepad à l’invite de commande et OK.

- Copie/colle ce qui est en gras ci-dessous dans le Bloc-Notes :

KillAll::

File::
c:\windows\system32\perfc00C.dat
c:\windows\system32\perfh00C.dat

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi9"=-

- Enregistre ce fichier sur le bureau (Impératif)

-Nom du fichier : CFScript.txt
-Type du fichier : tous les fichiers

- Clique sur Enregistrer et quitte le Bloc Notes

Important Désactive ton Antivirus et antispyware avant de faire le glisser/déposer

- Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe sur le bureau, comme sur cette capture (l’icône est un lion) :

http://free0.hiboox.com/images/2409/9126d3b136f7db9ab6242ad715b44296.gif

* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

-----

Télécharge DaonolFix sur le bureau ici :

http://jpshortstuff.247fixes.com/beta/DaonolFix.exe

Double clique sur DaonolFix.exe qui est sur le bureau pour l'exécuter
Choisir l'option 1. Find Daonol
Laisse le scan se dérouler et poste le contenu du rapport qui est sur le bureau DaonolFix.txt

@++ :)

ComboFix 10-01-16.04 - JEREMY 18/01/2010 10:49:25.2.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.383.231 [GMT 1:00]
Lancé depuis: c:\documents and settings\JEREMY\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\JEREMY\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\system32\perfc00C.dat"
"c:\windows\system32\perfh00C.dat"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\perfc00C.dat
c:\windows\system32\perfh00C.dat

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-12-18 au 2010-01-18 ))))))))))))))))))))))))))))))))))))
.

2010-01-18 09:25 . 2010-01-18 09:25 -------- d-----w- c:\windows\system32\fr-fr
2010-01-18 09:25 . 2010-01-18 09:25 -------- d-----w- c:\windows\l2schemas
2010-01-18 09:24 . 2010-01-18 09:24 -------- d-----w- c:\windows\system32\fr
2010-01-18 09:24 . 2010-01-18 09:24 -------- d-----w- c:\windows\system32\bits
2010-01-18 09:14 . 2010-01-18 09:14 -------- d-----w- c:\windows\EHome
2010-01-18 00:29 . 2008-04-13 18:36 44672 ------w- c:\windows\system32\drivers\uagp35.sys
2010-01-18 00:28 . 2008-04-14 02:33 4274816 ------w- c:\windows\system32\nv4_disp.dll
2010-01-18 00:27 . 2008-04-14 02:33 37376 ------w- c:\windows\system32\l2gpstore.dll
2010-01-18 00:26 . 2008-04-14 02:33 9216 ------w- c:\windows\system32\dot3dlg.dll
2010-01-18 00:21 . 2010-01-18 09:21 -------- d-----w- c:\windows\ServicePackFiles
2010-01-17 23:35 . 2008-06-14 17:33 272768 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-17 23:35 . 2008-06-14 17:33 272768 ------w- c:\windows\system32\drivers\bthport.sys
2010-01-17 23:34 . 2009-11-21 15:58 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-17 23:27 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-01-17 23:27 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-17 23:27 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2010-01-17 23:10 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-17 23:09 . 2008-04-11 19:05 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-17 23:07 . 2008-12-16 12:31 354304 -c----w- c:\windows\system32\dllcache\winhttp.dll
2010-01-17 23:07 . 2008-10-15 16:35 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-01-17 23:06 . 2008-04-21 21:15 219136 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-01-17 21:55 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-01-17 21:55 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-01-17 18:31 . 2010-01-17 18:31 -------- d-----w- c:\windows\ERUNT
2010-01-17 18:26 . 2010-01-17 19:38 -------- d-----w- C:\SDFix
2010-01-17 15:22 . 2010-01-17 15:22 -------- d-----w- C:\_OTM
2010-01-17 14:34 . 2010-01-17 14:35 -------- d-----w- C:\rsit
2010-01-17 13:16 . 2010-01-17 13:16 -------- d-----w- c:\program files\Trend Micro
2010-01-17 11:46 . 2009-12-17 20:03 30536 ----a-w- c:\windows\system32\TURegOpt.exe
2010-01-17 11:46 . 2009-12-17 19:56 30024 ----a-w- c:\windows\system32\uxtuneup.dll
2010-01-17 11:46 . 2010-01-17 11:46 -------- d-----w- c:\documents and settings\JEREMY\Application Data\TuneUp Software
2010-01-17 11:46 . 2010-01-17 11:46 -------- d-----w- c:\program files\TuneUp Utilities 2010
2010-01-17 11:45 . 2010-01-17 11:46 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2010-01-17 11:45 . 2010-01-17 11:45 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-01-17 01:46 . 2010-01-17 01:46 -------- d-----w- c:\documents and settings\JEREMY\Application Data\Malwarebytes
2010-01-17 01:46 . 2010-01-17 01:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-17 01:46 . 2010-01-17 18:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-03 23:28 . 2010-01-03 23:28 -------- d-----w- c:\documents and settings\JEREMY\Application Data\Mozilla-Cache

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-18 09:58 . 2010-01-18 09:58 356120 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-01-18 09:26 . 2006-11-22 09:22 76507 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-18 08:54 . 2009-09-16 07:37 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-18 00:12 . 2007-09-23 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\AntiVir PersonalEdition Classic
2010-01-17 23:32 . 2006-11-28 01:44 -------- d-----w- c:\program files\InstantTouch
2010-01-03 23:28 . 2006-12-20 21:37 -------- d-----w- c:\program files\PartyGaming.Net
2009-11-21 15:58 . 2004-08-05 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-10-29 05:25 . 2004-08-05 12:00 671232 ----a-w- c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\JEREMY\Menu D‚marrer\Programmes\D‚marrage\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-3-6 36864]
OCRAWARE.lnk - c:\oplimit\OCRAWARE.EXE [2006-11-30 51360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.exe.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2009-6-30 108544]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\InstantTouch\\bin\\CmCenterV2.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\PeerTV\\PeerCast.exe"=
"c:\\UT2004\\System\\UT2004.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4662:TCP"= 4662:TCP:eMule TCP
"4672:UDP"= 4672:UDP:eMule UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)

R2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [17/03/2009 11:40 266240]
R2 ScFBPNT;CanoScan FBP Port Driver;c:\windows\system32\drivers\SCFBPNT.SYS [30/11/2006 16:31 16288]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [17/12/2009 21:00 1044808]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14/10/2009 07:24 10064]
S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys --> c:\program files\Softwin\BitDefender9\filespy.sys [?]
S3 ADM8511;Convertisseur USB vers Fast Ethernet ADMtek ADM8511/AN986;c:\windows\system32\drivers\ADM8511.SYS [22/11/2006 12:32 20160]
S3 DCamUSBDigitalCamera;Digital Camera;c:\windows\system32\drivers\MPIXVID.SYS [23/12/2006 04:47 104593]
S3 v800bus;Sony Ericsson V800-Vodafone 802SE driver (WDM);c:\windows\system32\drivers\v800bus.sys [04/09/2007 14:41 52416]
S3 v800mdfl;Sony Ericsson V800-Vodafone 802SE USB WMC Modem Filter;c:\windows\system32\drivers\v800mdfl.sys [04/09/2007 14:41 6160]
S3 v800mdm;Sony Ericsson V800-Vodafone 802SE USB WMC Modem Driver;c:\windows\system32\drivers\v800mdm.sys [04/09/2007 14:41 84544]
S3 v800mgmt;Sony Ericsson V800-Vodafone 802SE USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\v800mgmt.sys [04/09/2007 14:48 77760]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2010-01-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 13:21]

2010-01-18 c:\windows\Tasks\Recherche de problèmes automatique.job
- c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-12-17 20:07]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.noos.fr/abonnes.php
uInternet Connection Wizard,ShellNext = iexplore
IE: Barre RoboForm - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Enregistrer le formulaire - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Personnaliser le menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Remplir le formulaire - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} - hxxp://data.jeuxclassiques.com/npwwg.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game05.zylom.com/activex/zylomgamesplayer.cab
DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} - hxxp://www.yoyogames.com/downloads/activex/YoYo.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-18 10:56
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

c:\windows\system32\PerfStringBackup.TMP 356120 bytes

Scan terminé avec succès
Fichiers cachés: 1

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(3612)
c:\oplimit\oahook32.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\wdfmgr.exe
c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
c:\oplimit\ocrawr32.exe
.
**************************************************************************
.
Heure de fin: 2010-01-18 11:01:45 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-18 10:01
ComboFix2.txt 2010-01-18 00:09

Avant-CF: 32 529 289 216 octets libres
Après-CF: 32 510 435 328 octets libres

- - End Of File - - AA9FBE6B5D736A7100EFB420322ADCD5

DaonolFix (15.04.09) by jpshortstuff
Log created at 11:21 on 18/01/2010 by JEREMY
Running from C:\Documents and Settings\JEREMY\Bureau\DaonolFix.exe

=====Find Daonol=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midi"="wdmaud.drv"
"midi1"="wdmaud.drv"
"midimapper"="midimap.dll"
"mixer"="wdmaud.drv"
"msacm.iac2"="C:\WINDOWS\system32\iac25_32.ax"
"msacm.imaadpcm"="imaadp32.acm"
"msacm.l3acm"="C:\WINDOWS\system32\l3codeca.acm"
"msacm.msadpcm"="msadp32.acm"
"msacm.msaudio1"="msaud32.acm"
"msacm.msg711"="msg711.acm"
"msacm.msg723"="msg723.acm"
"msacm.msgsm610"="msgsm32.acm"
"msacm.siren"="sirenacm.dll"
"msacm.sl_anet"="sl_anet.acm"
"msacm.trspch"="tssoft32.acm"
"MSVideo8"="VfWWDM32.dll"
"vidc.cvid"="iccvid.dll"
"vidc.DIVX"="DivX.dll"
"VIDC.I420"="msh263.drv"
"vidc.iv31"="ir32_32.dll"
"vidc.iv32"="ir32_32.dll"
"vidc.iv41"="ir41_32.ax"
"vidc.iv50"="ir50_32.dll"
"VIDC.IYUV"="iyuv_32.dll"
"vidc.M261"="msh261.drv"
"vidc.M263"="msh263.drv"
"vidc.mrle"="msrle32.dll"
"vidc.msvc"="msvidc32.dll"
"VIDC.UYVY"="msyuv.dll"
"VIDC.YUY2"="msyuv.dll"
"vidc.yv12"="DivX.dll"
"VIDC.YVU9"="tsbyuv.dll"
"VIDC.YVYU"="msyuv.dll"
"wave"="wdmaud.drv"
"wavemapper"="msacm32.drv"

-=Daonol Files=-
(none found)

-=End Of File=-

Salut kearny

Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :

https://www.eset.com/int/home/online-scanner/

(coche toutes les cases à chaque fois)
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt

@++ :)