UC Toujours à 100

salu

dans ton gestionnaire des taches donne nous le nom du processus qui est à 100 ou 90 d'utilisation dans la collonne processus.

Voila le rapport...

List'em by g3n-h@ckm@n 1.2.8.1

User : Administrateur (Administrateurs)
Update on 26/02/2010 by g3n-h@ckm@n ::::: 14.30
Start at: 05:23:25 | 27/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Intel(R) Celeron(R) M processor 1400MHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.11
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 4,87 Go (2,41 Go free) | FAT32
D:\ -> Disque fixe local | 27,95 Go (2,9 Go free) | NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible | 14,92 Go (14,58 Go free) [Lexar] | FAT32

Boot: Normal


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\ibmpmsvc.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir Desktop\sched.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
D:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\alg.exe
D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
D:\WINDOWS\system32\tp4mon.exe
D:\WINDOWS\Philips\SPC230NC\Monitor.exe
D:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
D:\Program Files\Google\Update\GoogleUpdate.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\List_Kill'em\List_Kill'em.scr
D:\WINDOWS\system32\cmd.exe
D:\WINDOWS\System32\wbem\wmiprvse.exe
D:\Documents and Settings\Administrateur\Local Settings\temp\AC.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ctfmon.exe REG_SZ D:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IntelZeroConfig REG_SZ "D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
IntelWireless REG_SZ "D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
TrackPointSrv REG_SZ tp4mon.exe
SPC_Monitor REG_SZ D:\WINDOWS\Philips\SPC230NC\Monitor.exe
SPC230NC_Monitor REG_SZ D:\WINDOWS\Philips\SPC230NC\Monitor.exe
Nikon Transfer Monitor REG_SZ D:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
avgnt REG_SZ "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
DisableRegistryTools REG_DWORD 0 (0x0)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDrives REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDrives REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ PORTABLE-MUCHO
DefaultUserName REG_SZ Administrateur
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ D:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Administrateur
AltDefaultDomainName REG_SZ PORTABLE-MUCHO
ChangePasswordUseKerberos REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
D:\Program Files\iTunes\iTunes.exe REG_SZ D:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
D:\Program Files\Vuze\Azureus.exe REG_SZ D:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus
D:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe REG_SZ D:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe
D:\Program Files\HP\Digital Imaging\bin\hposfx08.exe REG_SZ D:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe
D:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe REG_SZ D:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe
C:\drivers et setups Portable\Kwartz.exe REG_SZ C:\drivers et setups Portable\Kwartz.exe:*:Enabled:Kwartz
D:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ D:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
D:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ D:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
D:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ D:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
D:\Program Files\Skype\Phone\Skype.exe REG_SZ D:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
D:\Program Files\MSN Messenger\livecall.exe REG_SZ D:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
D:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ D:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
D:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ D:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
D:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ D:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{91D4B4D5-E368-40AB-8F53-A37FA634B471}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{71400AAA-9AD3-4697-8D45-0F74D2D99751}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{71400AAA-9AD3-4697-8D45-0F74D2D99751}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{71400AAA-9AD3-4697-8D45-0F74D2D99751}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.yougoo.fr/meteo

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: D:\Documents and Settings\Administrateur\Local Settings\temp\AC.tmp
## D:\> hashdeep.exe D:\WINDOWS\$NtServicePackUninstall$\atapi.sys
##
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,D:\WINDOWS\$NtServicePackUninstall$\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: D:\Documents and Settings\Administrateur\Local Settings\temp\AC.tmp
## D:\> hashdeep.exe D:\WINDOWS\ERDNT\cache\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,D:\WINDOWS\ERDNT\cache\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: D:\Documents and Settings\Administrateur\Local Settings\temp\AC.tmp
## D:\> hashdeep.exe D:\WINDOWS\ServicePackFiles\i386\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,D:\WINDOWS\ServicePackFiles\i386\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: D:\Documents and Settings\Administrateur\Local Settings\temp\AC.tmp
## D:\> hashdeep.exe D:\WINDOWS\system32\drivers\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,D:\WINDOWS\system32\drivers\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: D:\Documents and Settings\Administrateur\Local Settings\temp\AC.tmp
## D:\> hashdeep.exe D:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\i386\atapi.sys
##
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,D:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\i386\atapi.sys

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
27,95 Go total, 2,90 Go libre (10%), 9% fragment‚ (fragmentation du fichier 17%)

Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : D:\Program Files\Everest Poker
Present !! : D:\WINDOWS\System32\drivers\Cdaudio.sys
Present !! : D:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : D:\WINDOWS\System32\fjhdyfhsn.bat"
Present !! : D:\WINDOWS\System32\SET*.tmp

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
Present !! : HKEY_USERS\S-1-5-21-1801674531-1563985344-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
Present !! : "HKCU\Software\Grand Virtual"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker"
Present !! : "HKLM\software\Poker 770"

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-27 06:33:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00004b04

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

==========
Programs
==========

Adobe
Alwil Software
Apple Software Update
ArcSoft
Avira
AvRack
BitComet
BlueSquad
Common Files
ComPlus Applications
eMule
everest
Everest Poker
Fichiers communs
GOA
Google
HP
Infogrames
InstallShield Installation Information
Intel
Intel Desktop Boards
Internet Explorer
iPod
iTunes
Java
JkDefrag
Lavasoft
List_Kill'em
ma-config.com
Malwarebytes' Anti-Malware
Messenger
Messenger Plus! Live
Microsoft
microsoft frontpage
Microsoft Money 2005
Microsoft Office
Microsoft Office Outlook Connector
Microsoft Research
Microsoft Silverlight
Microsoft SQL Server Compact Edition
Microsoft Visual Studio
Microsoft Works
Movie Maker
Mozilla Firefox
MSECache
MSN
MSN Gaming Zone
MSN Messenger
MSXML 4.0
Nero
NetMeeting
Nikon
Ontrack
Outlook Express
PDFCreator
Philips
PowerISO
QuickTime
Realtek AC97
Realtek Sound Manager
RegCleaner
Services en ligne
Skype
Snapshot Viewer
Sony Ericsson
Sunbelt Software
trend micro
TrendMicro
TuneUp Utilities 2007
Uninstall Information
VideoLAN
VirtualDJ
Vuze
Windows Live
Windows Live Safety Center
Windows Live SkyDrive
Windows Media Connect 2
Windows Media Player
Windows NT
WindowsUpdate
WinRAR
xerox

============
Drive D:
============

autorun.inf
ComboFix.txt
Config.Msi
Documents and Settings
hiberfil.sys
Intel
Kill'em
List'em.txt
MSOCache
pagefile.sys
Program Files
Qoobox
RECYCLER
rsit
sqmdata00.sqm
sqmdata01.sqm
sqmdata02.sqm
sqmdata03.sqm
sqmdata04.sqm
sqmdata05.sqm
sqmdata06.sqm
sqmdata07.sqm
sqmdata08.sqm
sqmdata09.sqm
sqmdata10.sqm
sqmdata11.sqm
sqmdata12.sqm
sqmdata13.sqm
sqmdata14.sqm
sqmdata15.sqm
sqmdata16.sqm
sqmdata17.sqm
sqmdata18.sqm
sqmdata19.sqm
sqmnoopt00.sqm
sqmnoopt01.sqm
sqmnoopt02.sqm
sqmnoopt03.sqm
sqmnoopt04.sqm
sqmnoopt05.sqm
sqmnoopt06.sqm
sqmnoopt07.sqm
sqmnoopt08.sqm
sqmnoopt09.sqm
sqmnoopt10.sqm
sqmnoopt11.sqm
sqmnoopt12.sqm
sqmnoopt13.sqm
sqmnoopt14.sqm
sqmnoopt15.sqm
sqmnoopt16.sqm
sqmnoopt17.sqm
sqmnoopt18.sqm
sqmnoopt19.sqm
System Volume Information
WINDOWS

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials





¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 6:51:48,44

t'as raison c'est svochost.exe, il y en a plusieurs processus comme ça.c'est sur c'est windows, ça voudrait dire quoi?

svchost.exe

Ok, je dois aussi retirer antivirus et pare feu

ces test sont très long, par exemple j'en suis a la moitié du test de suppression, alors que j'ai commencé a 13h...donc suite de l'épisode ce soir.

voici le rapport combofix
ComboFix 10-02-25.02 - Administrateur 26/02/2010 17:08:44.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1270.860 [GMT -5:00]
Lancé depuis: d:\documents and settings\Administrateur\Mes documents\Téléchargements\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100225-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\documents and settings\Administrateur\Application Data\Dossier de téléchargement Share-to-Web
d:\windows\srchasst\nls302en.lex
d:\windows\system32\AutoRun.inf
d:\windows\system32\reboot.txt

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-01-26 au 2010-02-26 ))))))))))))))))))))))))))))))))))))
.

2010-02-26 06:13 . 2008-04-14 01:40 8192 -c--a-w- d:\windows\system32\dllcache\changer.sys
2010-02-26 06:13 . 2008-04-14 01:40 8192 ----a-w- d:\windows\system32\drivers\changer.sys
2010-02-25 21:58 . 2010-02-25 21:58 -------- d-----w- d:\documents and settings\Administrateur\Application Data\Malwarebytes
2010-02-25 21:58 . 2010-01-07 21:07 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 21:58 . 2010-02-25 21:58 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-25 21:58 . 2010-01-07 21:07 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-02-25 21:58 . 2010-02-25 21:58 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2010-02-25 21:52 . 2010-02-25 21:52 -------- d-----w- d:\program files\trend micro
2010-02-25 21:52 . 2010-02-25 21:53 -------- d-----w- D:\rsit
2010-02-25 21:32 . 2010-02-26 06:17 116 ----a-w- d:\windows\system32\fjhdyfhsn.bat
2010-02-13 11:36 . 2010-02-13 11:37 -------- d-----w- d:\program files\Ontrack

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-25 21:39 . 2009-05-23 11:44 -------- d-----w- d:\documents and settings\Administrateur\Application Data\Skype
2010-02-25 21:32 . 2010-02-25 21:32 16 ----a-w- d:\documents and settings\NetworkService.AUTORITE NT\Application Data\rbuwzv.dat
2010-02-13 11:37 . 2007-12-30 23:07 -------- d--h--w- d:\program files\InstallShield Installation Information
2010-02-06 13:52 . 2009-02-08 20:36 -------- d-----w- d:\program files\Google
2010-01-31 10:01 . 2008-07-05 10:35 -------- d-----w- d:\documents and settings\Administrateur\Application Data\dvdcss
2010-01-31 09:39 . 2009-03-01 13:45 -------- d-----w- d:\documents and settings\Administrateur\Application Data\Azureus
2010-01-10 21:01 . 2009-07-08 00:48 -------- d-----w- d:\program files\Windows Live Safety Center
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="d:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="d:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"TrackPointSrv"="tp4mon.exe" [2008-04-14 82944]
"SPC_Monitor"="d:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SPC230NC_Monitor"="d:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"Nikon Transfer Monitor"="d:\program files\Fichiers communs\Nikon\Monitor\NkMonitor.exe" [2009-02-24 479232]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=d:\windows\system32\ctfmon.exe
"Sony Ericsson PC Suite"="d:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
"Skype"="d:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HPDJ Taskbar Utility"=d:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe
"igfxhkcmd"=d:\windows\system32\hkcmd.exe
"igfxtray"=d:\windows\system32\igfxtray.exe
"PWRISOVM.EXE"=d:\program files\PowerISO\PWRISOVM.EXE
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" -atboottime
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe"
"NeroFilterCheck"=d:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe
"SunJavaUpdateSched"="d:\program files\Java\jre1.6.0_07\bin\jusched.exe"
"SPC230NC_Monitor"=d:\windows\Philips\SPC230NC\Monitor.exe
"SPC_Monitor"=d:\windows\Philips\SPC230NC\Monitor.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Vuze\\Azureus.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\drivers et setups Portable\\Kwartz.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11192:TCP"= 11192:TCP:BitComet 11192 TCP
"11192:UDP"= 11192:UDP:BitComet 11192 UDP

R1 aswSP;avast! Self Protection;d:\windows\system32\drivers\aswSP.sys [04/04/2008 15:21 114768]
R2 aswFsBlk;aswFsBlk;d:\windows\system32\drivers\aswFsBlk.sys [04/04/2008 15:21 20560]
R2 fssfltr;FssFltr;d:\windows\system32\drivers\fssfltr_tdi.sys [15/09/2009 23:24 54752]
S2 gupdate1c98a2dcab73a0;Google Update Service (gupdate1c98a2dcab73a0);d:\program files\Google\Update\GoogleUpdate.exe [08/02/2009 15:37 133104]
S3 fsssvc;Service Windows Live Contrôle parental;d:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
S3 PAEAFLT.sys;USB Composite Device;d:\windows\system32\drivers\PAEAFLT.sys [04/06/2009 13:22 8576]
S3 s3017bus;Sony Ericsson Device 3017 driver (WDM);d:\windows\system32\drivers\s3017bus.sys [01/03/2009 10:42 83880]
S3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;d:\windows\system32\drivers\s3017mdfl.sys [01/03/2009 10:42 15016]
S3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;d:\windows\system32\drivers\s3017mdm.sys [01/03/2009 10:42 110632]
S3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);d:\windows\system32\drivers\s3017mgmt.sys [01/03/2009 10:42 104616]
S3 s3017nd5;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS);d:\windows\system32\drivers\s3017nd5.sys [01/03/2009 10:42 25512]
S3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;d:\windows\system32\drivers\s3017obex.sys [01/03/2009 10:42 100648]
S3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);d:\windows\system32\drivers\s3017unic.sys [01/03/2009 10:43 110120]
S3 SPC230NC;Philips SPC230NC Webcam;d:\windows\system32\drivers\SPC230NC.SYS [04/06/2009 13:22 461056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2010-02-26 d:\windows\Tasks\1-Click Maintenance.job
- d:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 15:53]

2010-02-26 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 20:37]

2010-02-26 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 20:37]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.yougoo.fr/meteo
IE: E&xporter vers Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - d:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\he341b53.default\
FF - plugin: d:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: d:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: d:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: d:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\npagent.dll
FF - plugin: d:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.switch.threshold - 1000000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-26 17:18
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(3640)
d:\windows\system32\eappprxy.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\ibmpmsvc.exe
d:\program files\Intel\Wireless\Bin\EvtEng.exe
d:\program files\Intel\Wireless\Bin\S24EvMon.exe
d:\program files\Alwil Software\Avast4\aswUpdSv.exe
d:\program files\Alwil Software\Avast4\ashServ.exe
d:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
d:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\program files\Intel\Wireless\Bin\RegSrvc.exe
d:\windows\system32\tp4mon.exe
d:\program files\Alwil Software\Avast4\ashMaiSv.exe
d:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Heure de fin: 2010-02-26 17:25:51 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-02-26 22:25

Avant-CF: 3 303 067 648 octets libres
Après-CF: 3 253 469 184 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professionnel" /fastdetect /NoExecute=OptIn

- - End Of File - - 86C14E7DA021D78632875EF5E9C70087

Voici le rapport de supression

Kill'em by g3n-h@ckm@n 1.2.8.1

User : Administrateur (Administrateurs)
Update on 26/02/2010 by g3n-h@ckm@n ::::: 14.30
Start at: 07:38:49 | 27/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Intel(R) Celeron(R) M processor 1400MHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.11
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 4,87 Go (2,41 Go free) | FAT32
D:\ -> Disque fixe local | 27,95 Go (2,89 Go free) | NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible | 14,92 Go (14,58 Go free) [Lexar] | FAT32


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\ibmpmsvc.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir Desktop\sched.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
D:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\alg.exe
D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
D:\WINDOWS\system32\tp4mon.exe
D:\WINDOWS\Philips\SPC230NC\Monitor.exe
D:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\wbem\wmiprvse.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\List_Kill'em\List_Kill'em.scr
D:\WINDOWS\system32\cmd.exe
D:\Documents and Settings\Administrateur\Local Settings\temp\E6.tmp\ERUNT.EXE
D:\Documents and Settings\Administrateur\Local Settings\temp\E6.tmp\pv.exe

Detections :
==========


¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : D:\Program Files\Everest Poker

Quarantined & Deleted !! : D:\WINDOWS\System32\drivers\Cdaudio.sys
Quarantined & Deleted !! : D:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : D:\WINDOWS\System32\fjhdyfhsn.bat
Quarantined & Deleted !! : D:\WINDOWS\System32\SET3A.tmp
Quarantined & Deleted !! : D:\WINDOWS\System32\SET3F.tmp

==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
Deleted : "HKCU\Software\Grand Virtual"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker"
Deleted : "HKLM\software\Poker 770"
========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
============

=================
anti-ver blaster : OK !!
=================

================
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤



puis le rapport MBR

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

je sais pas trop quoi faire de tout ça, j'éspère que ça t'aidera a diagnostiquer. Je te remercie de ton aide

oui je l'ai toujours...Alors, une petite idée de ce qu'il se passe?mon UC est toujours à fond

voila les différents rapports que tu m'as demandé, par contre il n'as pas proposé deux choix, le scan s'est lancé tout seul

Rapport Combofix

ComboFix 10-02-25.02 - Administrateur 28/02/2010 8:41.2.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1270.637 [GMT -5:00]
Lancé depuis: d:\documents and settings\Administrateur\Mes documents\Téléchargements\ComboFix.exe
Commutateurs utilisés :: d:\documents and settings\Administrateur\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"d:\documents and settings\NetworkService.AUTORITE NT\Application Data\rbuwzv.dat"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\documents and settings\NetworkService.AUTORITE NT\Application Data\rbuwzv.dat

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-01-28 au 2010-02-28 ))))))))))))))))))))))))))))))))))))
.

2010-02-27 14:39 . 2010-02-27 14:39 -------- d-----w- D:\Kill'em
2010-02-27 14:13 . 2010-02-27 14:13 -------- d-----w- d:\windows\LastGood
2010-02-27 10:22 . 2010-02-27 10:22 -------- d-----w- d:\program files\List_Kill'em
2010-02-27 09:33 . 2010-02-27 09:33 388096 ----a-r- d:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-02-27 09:33 . 2010-02-27 09:33 -------- d-----w- d:\program files\TrendMicro
2010-02-26 22:54 . 2009-11-25 16:19 56816 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-02-26 22:54 . 2009-03-30 14:32 96104 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-02-26 22:54 . 2009-02-13 16:28 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-02-26 22:54 . 2009-02-13 16:17 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-02-26 22:54 . 2010-02-26 22:54 -------- d-----w- d:\program files\Avira
2010-02-26 06:13 . 2008-04-14 01:40 8192 -c--a-w- d:\windows\system32\dllcache\changer.sys
2010-02-26 06:13 . 2008-04-14 01:40 8192 ----a-w- d:\windows\system32\drivers\changer.sys
2010-02-25 21:58 . 2010-02-25 21:58 -------- d-----w- d:\documents and settings\Administrateur\Application Data\Malwarebytes
2010-02-25 21:58 . 2010-01-07 21:07 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 21:58 . 2010-02-25 21:58 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-25 21:58 . 2010-01-07 21:07 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-02-25 21:58 . 2010-02-25 21:58 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2010-02-25 21:52 . 2010-02-27 09:49 -------- d-----w- d:\program files\trend micro
2010-02-25 21:52 . 2010-02-25 21:53 -------- d-----w- D:\rsit
2010-02-13 11:36 . 2010-02-13 11:37 -------- d-----w- d:\program files\Ontrack

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-27 14:14 . 2001-08-28 12:00 72912 ----a-w- d:\windows\system32\perfc00C.dat
2010-02-27 14:14 . 2001-08-28 12:00 461974 ----a-w- d:\windows\system32\perfh00C.dat
2010-02-26 22:54 . 2007-12-30 23:17 -------- d-----w- d:\documents and settings\All Users\Application Data\Avira
2010-02-25 21:39 . 2009-05-23 11:44 -------- d-----w- d:\documents and settings\Administrateur\Application Data\Skype
2010-02-13 11:37 . 2007-12-30 23:07 -------- d--h--w- d:\program files\InstallShield Installation Information
2010-02-06 13:52 . 2009-02-08 20:36 -------- d-----w- d:\program files\Google
2010-01-31 10:01 . 2008-07-05 10:35 -------- d-----w- d:\documents and settings\Administrateur\Application Data\dvdcss
2010-01-31 09:39 . 2009-03-01 13:45 -------- d-----w- d:\documents and settings\Administrateur\Application Data\Azureus
2010-01-10 21:01 . 2009-07-08 00:48 -------- d-----w- d:\program files\Windows Live Safety Center
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="d:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="d:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"TrackPointSrv"="tp4mon.exe" [2008-04-14 82944]
"SPC_Monitor"="d:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SPC230NC_Monitor"="d:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"Nikon Transfer Monitor"="d:\program files\Fichiers communs\Nikon\Monitor\NkMonitor.exe" [2009-02-24 479232]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=d:\windows\system32\ctfmon.exe
"Sony Ericsson PC Suite"="d:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
"Skype"="d:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HPDJ Taskbar Utility"=d:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe
"igfxhkcmd"=d:\windows\system32\hkcmd.exe
"igfxtray"=d:\windows\system32\igfxtray.exe
"PWRISOVM.EXE"=d:\program files\PowerISO\PWRISOVM.EXE
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" -atboottime
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe"
"NeroFilterCheck"=d:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe
"SunJavaUpdateSched"="d:\program files\Java\jre1.6.0_07\bin\jusched.exe"
"SPC230NC_Monitor"=d:\windows\Philips\SPC230NC\Monitor.exe
"SPC_Monitor"=d:\windows\Philips\SPC230NC\Monitor.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Vuze\\Azureus.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\drivers et setups Portable\\Kwartz.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11192:TCP"= 11192:TCP:BitComet 11192 TCP
"11192:UDP"= 11192:UDP:BitComet 11192 UDP

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [26/02/2010 17:54 108289]
R2 fssfltr;FssFltr;d:\windows\system32\drivers\fssfltr_tdi.sys [15/09/2009 23:24 54752]
S2 gupdate1c98a2dcab73a0;Google Update Service (gupdate1c98a2dcab73a0);d:\program files\Google\Update\GoogleUpdate.exe [08/02/2009 15:37 133104]
S3 fsssvc;Service Windows Live Contrôle parental;d:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
S3 PAEAFLT.sys;USB Composite Device;d:\windows\system32\drivers\PAEAFLT.sys [04/06/2009 13:22 8576]
S3 s3017bus;Sony Ericsson Device 3017 driver (WDM);d:\windows\system32\drivers\s3017bus.sys [01/03/2009 10:42 83880]
S3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;d:\windows\system32\drivers\s3017mdfl.sys [01/03/2009 10:42 15016]
S3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;d:\windows\system32\drivers\s3017mdm.sys [01/03/2009 10:42 110632]
S3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);d:\windows\system32\drivers\s3017mgmt.sys [01/03/2009 10:42 104616]
S3 s3017nd5;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS);d:\windows\system32\drivers\s3017nd5.sys [01/03/2009 10:42 25512]
S3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;d:\windows\system32\drivers\s3017obex.sys [01/03/2009 10:42 100648]
S3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);d:\windows\system32\drivers\s3017unic.sys [01/03/2009 10:43 110120]
S3 SPC230NC;Philips SPC230NC Webcam;d:\windows\system32\drivers\SPC230NC.SYS [04/06/2009 13:22 461056]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - EAPHOST
*NewlyCreated* - IP6FW

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2010-02-27 d:\windows\Tasks\1-Click Maintenance.job
- d:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 15:53]

2010-02-27 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 20:37]

2010-02-28 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 20:37]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.yougoo.fr/meteo
IE: E&xporter vers Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - d:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\he341b53.default\
FF - plugin: d:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: d:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: d:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: d:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\npagent.dll
FF - plugin: d:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.switch.threshold - 1000000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-28 08:57
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(864)
d:\windows\system32\igfxdev.dll
.
Heure de fin: 2010-02-28 09:02:42
ComboFix-quarantined-files.txt 2010-02-28 14:02

Avant-CF: 3 907 153 920 octets libres
Après-CF: 3 956 260 864 octets libres

- - End Of File - - 85ED8919560E5DC5A6EB7B8D42142A53

puis le rapport HIJACKTHIS

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 09:11:06, on 28/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\ibmpmsvc.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir Desktop\sched.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
D:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\alg.exe
D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
D:\WINDOWS\system32\tp4mon.exe
D:\WINDOWS\Philips\SPC230NC\Monitor.exe
D:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\notepad.exe
D:\WINDOWS\explorer.exe
D:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
D:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yougoo.fr/meteo
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [SPC_Monitor] D:\WINDOWS\Philips\SPC230NC\Monitor.exe
O4 - HKLM\..\Run: [SPC230NC_Monitor] D:\WINDOWS\Philips\SPC230NC\Monitor.exe
O4 - HKLM\..\Run: [Nikon Transfer Monitor] D:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: winesm32.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: winesm32.exe (User 'Default user')
O4 - Startup: winesm32.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - D:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - D:\WINDOWS\system32\services.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Update Service (gupdate1c98a2dcab73a0) (gupdate1c98a2dcab73a0) - Unknown owner - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - D:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - D:\WINDOWS\system32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - D:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - D:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - D:\WINDOWS\system32\sessmgr.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - D:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - D:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet (TlntSvr) - Unknown owner - D:\WINDOWS\System32\tlntsvr.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - D:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - D:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - D:\Program Files\Windows Media Player\WMPNetwk.exe

rapport combofix

ComboFix 10-02-25.02 - Administrateur 28/02/2010 10:25:03.3.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1270.720 [GMT -5:00]
Lancé depuis: d:\documents and settings\Administrateur\Mes documents\Téléchargements\ComboFix.exe
Commutateurs utilisés :: d:\documents and settings\Administrateur\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EAPHOST
-------\Legacy_IP6FW
-------\Service_EapHost
-------\Service_ip6fw


((((((((((((((((((((((((((((( Fichiers créés du 2010-01-28 au 2010-02-28 ))))))))))))))))))))))))))))))))))))
.

2010-02-27 14:39 . 2010-02-27 14:39 -------- d-----w- D:\Kill'em
2010-02-27 10:22 . 2010-02-27 10:22 -------- d-----w- d:\program files\List_Kill'em
2010-02-27 09:33 . 2010-02-27 09:33 388096 ----a-r- d:\documents and settings\Administrateur\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-02-27 09:33 . 2010-02-27 09:33 -------- d-----w- d:\program files\TrendMicro
2010-02-26 22:54 . 2009-11-25 16:19 56816 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-02-26 22:54 . 2009-03-30 14:32 96104 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-02-26 22:54 . 2009-02-13 16:28 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-02-26 22:54 . 2009-02-13 16:17 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-02-26 22:54 . 2010-02-26 22:54 -------- d-----w- d:\program files\Avira
2010-02-26 06:13 . 2008-04-14 01:40 8192 -c--a-w- d:\windows\system32\dllcache\changer.sys
2010-02-26 06:13 . 2008-04-14 01:40 8192 ----a-w- d:\windows\system32\drivers\changer.sys
2010-02-25 21:58 . 2010-02-25 21:58 -------- d-----w- d:\documents and settings\Administrateur\Application Data\Malwarebytes
2010-02-25 21:58 . 2010-01-07 21:07 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 21:58 . 2010-02-25 21:58 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-25 21:58 . 2010-01-07 21:07 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-02-25 21:58 . 2010-02-25 21:58 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2010-02-25 21:52 . 2010-02-27 09:49 -------- d-----w- d:\program files\trend micro
2010-02-25 21:52 . 2010-02-25 21:53 -------- d-----w- D:\rsit
2010-02-13 11:36 . 2010-02-13 11:37 -------- d-----w- d:\program files\Ontrack

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-27 14:14 . 2001-08-28 12:00 72912 ----a-w- d:\windows\system32\perfc00C.dat
2010-02-27 14:14 . 2001-08-28 12:00 461974 ----a-w- d:\windows\system32\perfh00C.dat
2010-02-26 22:54 . 2007-12-30 23:17 -------- d-----w- d:\documents and settings\All Users\Application Data\Avira
2010-02-25 21:39 . 2009-05-23 11:44 -------- d-----w- d:\documents and settings\Administrateur\Application Data\Skype
2010-02-13 11:37 . 2007-12-30 23:07 -------- d--h--w- d:\program files\InstallShield Installation Information
2010-02-06 13:52 . 2009-02-08 20:36 -------- d-----w- d:\program files\Google
2010-01-31 10:01 . 2008-07-05 10:35 -------- d-----w- d:\documents and settings\Administrateur\Application Data\dvdcss
2010-01-31 09:39 . 2009-03-01 13:45 -------- d-----w- d:\documents and settings\Administrateur\Application Data\Azureus
2010-01-10 21:01 . 2009-07-08 00:48 -------- d-----w- d:\program files\Windows Live Safety Center
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="d:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="d:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"TrackPointSrv"="tp4mon.exe" [2008-04-14 82944]
"SPC_Monitor"="d:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SPC230NC_Monitor"="d:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"Nikon Transfer Monitor"="d:\program files\Fichiers communs\Nikon\Monitor\NkMonitor.exe" [2009-02-24 479232]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

d:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
winesm32.exe [2008-4-13 29184]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=d:\windows\system32\ctfmon.exe
"Sony Ericsson PC Suite"="d:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
"Skype"="d:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HPDJ Taskbar Utility"=d:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe
"igfxhkcmd"=d:\windows\system32\hkcmd.exe
"igfxtray"=d:\windows\system32\igfxtray.exe
"PWRISOVM.EXE"=d:\program files\PowerISO\PWRISOVM.EXE
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" -atboottime
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe"
"NeroFilterCheck"=d:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe
"SunJavaUpdateSched"="d:\program files\Java\jre1.6.0_07\bin\jusched.exe"
"SPC230NC_Monitor"=d:\windows\Philips\SPC230NC\Monitor.exe
"SPC_Monitor"=d:\windows\Philips\SPC230NC\Monitor.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Vuze\\Azureus.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\drivers et setups Portable\\Kwartz.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11192:TCP"= 11192:TCP:BitComet 11192 TCP
"11192:UDP"= 11192:UDP:BitComet 11192 UDP

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [26/02/2010 17:54 108289]
R2 fssfltr;FssFltr;d:\windows\system32\drivers\fssfltr_tdi.sys [15/09/2009 23:24 54752]
S2 gupdate1c98a2dcab73a0;Google Update Service (gupdate1c98a2dcab73a0);d:\program files\Google\Update\GoogleUpdate.exe [08/02/2009 15:37 133104]
S3 fsssvc;Service Windows Live Contrôle parental;d:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
S3 PAEAFLT.sys;USB Composite Device;d:\windows\system32\drivers\PAEAFLT.sys [04/06/2009 13:22 8576]
S3 s3017bus;Sony Ericsson Device 3017 driver (WDM);d:\windows\system32\drivers\s3017bus.sys [01/03/2009 10:42 83880]
S3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;d:\windows\system32\drivers\s3017mdfl.sys [01/03/2009 10:42 15016]
S3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;d:\windows\system32\drivers\s3017mdm.sys [01/03/2009 10:42 110632]
S3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);d:\windows\system32\drivers\s3017mgmt.sys [01/03/2009 10:42 104616]
S3 s3017nd5;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS);d:\windows\system32\drivers\s3017nd5.sys [01/03/2009 10:42 25512]
S3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;d:\windows\system32\drivers\s3017obex.sys [01/03/2009 10:42 100648]
S3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);d:\windows\system32\drivers\s3017unic.sys [01/03/2009 10:43 110120]
S3 SPC230NC;Philips SPC230NC Webcam;d:\windows\system32\drivers\SPC230NC.SYS [04/06/2009 13:22 461056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2010-02-27 d:\windows\Tasks\1-Click Maintenance.job
- d:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 15:53]

2010-02-28 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 20:37]

2010-02-28 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 20:37]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.yougoo.fr/meteo
IE: E&xporter vers Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - d:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\he341b53.default\
FF - plugin: d:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: d:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: d:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: d:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\npagent.dll
FF - plugin: d:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.switch.threshold - 1000000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-28 10:47
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(1860)
d:\windows\system32\eappprxy.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\ibmpmsvc.exe
d:\program files\Intel\Wireless\Bin\EvtEng.exe
d:\program files\Intel\Wireless\Bin\S24EvMon.exe
d:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
d:\program files\Avira\AntiVir Desktop\avguard.exe
d:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\program files\Intel\Wireless\Bin\RegSrvc.exe
d:\windows\system32\wscntfy.exe
d:\windows\system32\tp4mon.exe
.
**************************************************************************
.
Heure de fin: 2010-02-28 10:53:36 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-02-28 15:53
ComboFix2.txt 2010-02-28 14:02

Avant-CF: 3 978 858 496 octets libres
Après-CF: 3 866 091 520 octets libres

- - End Of File - - 1000C4BE8C3C2A340FB881CC948FEE65

Rapport Hijackthis

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 11:07:06, on 28/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\ibmpmsvc.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir Desktop\sched.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
D:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
D:\WINDOWS\system32\tp4mon.exe
D:\WINDOWS\Philips\SPC230NC\Monitor.exe
D:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
D:\WINDOWS\explorer.exe
D:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yougoo.fr/meteo
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [SPC_Monitor] D:\WINDOWS\Philips\SPC230NC\Monitor.exe
O4 - HKLM\..\Run: [SPC230NC_Monitor] D:\WINDOWS\Philips\SPC230NC\Monitor.exe
O4 - HKLM\..\Run: [Nikon Transfer Monitor] D:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: winesm32.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: winesm32.exe (User 'Default user')
O4 - Startup: winesm32.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - D:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - D:\WINDOWS\system32\services.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Update Service (gupdate1c98a2dcab73a0) (gupdate1c98a2dcab73a0) - Unknown owner - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - D:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - D:\WINDOWS\system32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - D:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - D:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - D:\WINDOWS\system32\sessmgr.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - D:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - D:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet (TlntSvr) - Unknown owner - D:\WINDOWS\System32\tlntsvr.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - D:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - D:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - D:\Program Files\Windows Media Player\WMPNetwk.exe

[b]SDFix: Version 1.240 [/b]
Run by Administrateur on 28/02/2010 at 14:42

Microsoft Windows XP [version 5.1.2600]
Running From: D:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-28 14:52:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\iTunes\\iTunes.exe"="D:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\\Program Files\\Vuze\\Azureus.exe"="D:\\Program Files\\Vuze\\Azureus.exe:*:Enabled:Azureus"
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"D:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\drivers et setups Portable\\Kwartz.exe"="C:\\drivers et setups Portable\\Kwartz.exe:*:Enabled:Kwartz"
"D:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="D:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="D:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"
"D:\\Program Files\\Skype\\Phone\\Skype.exe"="D:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\\Program Files\\MSN Messenger\\livecall.exe"="D:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="D:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="D:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Wed 2 Jan 2008 4,348 A.SH. --- "D:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 29 Jan 2008 0 A.SH. --- "D:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Sat 27 Feb 2010 0 A..H. --- "D:\Documents and Settings\Administrateur\Local Settings\Application Data\Temp\BIT2D.tmp"

[b]Finished![/b]

J'ai lancé Gmer et il n'a pas trouvé d'infections...j'ai toujours mon processeur qui fonctionne à 100%, je pense que je vais formater le pc pour voir, tu as une autre solution?merci de ton aide

Voici le rapport.
Depuis quelques jours, le processeur marche mieux, j'ai pu arreter le processus qui prenait 95% de l'UC

############################## | UsbFix V6.098 |

User : Administrateur (Administrateurs) # PORTABLE-MUCHO
Update on 03/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 12:32:18 | 07/03/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Celeron(R) M processor 1400MHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.11
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Disque fixe local # 4,87 Go (1,67 Go free) # FAT32
D:\ -> Disque fixe local # 27,95 Go (4,51 Go free) # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 14,92 Go (12,09 Go free) [Lexar] # FAT32
G:\ -> Disque fixe local # 298,02 Go (112,62 Go free) [MUCHO] # FAT32

################## | Elements infectieux |


################## | Registre |

[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

################## | Mountpoints2 |


################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné !

################## | ! Fin du rapport # UsbFix V6.098 ! |