Redirection vers Onlineguardian.net

Salut,

- Télécharge http://www.trendsecure.com/portal/fr/_download/HJTInstall.exe ton bureau.
- Double-clic sur HijackThis
- Génère un rapport en suivant ces indications :
- Exécute le et clique sur Do a scan and save log file.
- Le rapport s'ouvre sur le Bloc-Note
- Colle le rapport ici, pour cela :
- Menu Edition / Selectionner Tout
- Menu Edition / copier
- Ici dans un nouveau message : clic droit coper/coller le rapport stp

++

Tien voilà le rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:07:53, on 15/06/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [F.lux] "C:\Documents and Settings\Bilou\Local Settings\Apps\F.lux\flux.exe" /noshow
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B951A739-82BA-4BFD-A07F-B898DC9A6D7F}: NameServer = 192.168.1.1
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.33\bin\mysqld.exe

ok,

Télécharge ComboFix de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

tutoriel pour bien utiliser l'outil
http://www.bleepingcomputer.com/combofix/fr/comment-utiliser­-combofix

/!\ Déconnecte-toi du net et DESACTIVE TOUTES LES DEFENSES, antivirus et antispyware y compris /!\
---> Double-clique sur ComboFix.exe
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter
Surtout, accepte d'installer la console de récupération
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de figer ton PC

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

++

Avant de poster le rapport je voulais te dire que sur tout les pc connecté a ma LiveBox ça fait ça !

Bilou.

Peut etre, mais déjà il y a un fichier suspect relevé par hijackthis, on en saura plus avec combo.

++

Première partie :

ComboFix 10-06-14.03 - Bilou 15/06/2010 16:11:05.1.2 - x86 NETWORK
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2046.1694 [GMT 2:00]
Lancé depuis: c:\documents and settings\Bilou\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bilou\Application Data\chrtmp

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-05-15 au 2010-06-15 ))))))))))))))))))))))))))))))))))))
.

2010-06-15 14:07 . 2010-06-15 14:07 -------- d-----w- c:\program files\Trend Micro
2010-06-15 13:44 . 2010-06-15 13:44 -------- d-----w- c:\windows\system32\wbem\Repository
2010-06-15 12:19 . 2010-06-15 12:23 -------- d-----w- c:\documents and settings\All Users\Application Data\open-config
2010-06-13 17:57 . 2010-06-13 17:58 -------- d-----w- c:\documents and settings\All Users\Application Data\TrackMania
2010-06-12 14:48 . 1998-07-30 15:40 306688 ----a-w- c:\windows\IsUn040c.exe
2010-06-12 14:46 . 1998-07-30 10:51 305152 ----a-w- c:\windows\IsUninst.exe
2010-06-12 14:42 . 2010-06-12 14:42 -------- d-----w- c:\documents and settings\Bilou\WINDOWS
2010-06-12 13:38 . 2010-06-12 13:38 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-12 13:38 . 2010-06-12 14:38 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-06-12 13:37 . 2010-06-12 14:42 -------- d-----w- c:\documents and settings\Bilou\Application Data\DAEMON Tools Lite
2010-06-12 13:37 . 2010-06-12 13:37 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-06-12 12:36 . 2010-06-12 12:36 -------- d-----w- c:\documents and settings\All Users\Application Data\AutoClic
2010-06-12 12:36 . 2010-06-12 12:36 -------- d-----w- c:\documents and settings\Bilou\Local Settings\Application Data\WDSetup
2010-06-10 16:28 . 2010-06-10 16:30 -------- d-----w- c:\windows\system32\Adobe
2010-06-09 13:02 . 2010-06-09 13:03 -------- d-----w- c:\documents and settings\Bilou\Application Data\teamspeak2
2010-06-09 12:47 . 2010-06-09 12:47 -------- d-----w- c:\program files\Microsoft Games
2010-06-09 12:24 . 2010-06-09 12:24 -------- d-----w- c:\documents and settings\Bilou\Application Data\TeamViewer
2010-06-09 12:24 . 2010-06-09 12:24 -------- d-----w- c:\documents and settings\Bilou\temp
2010-06-09 12:10 . 2010-06-09 12:11 -------- d-----w- c:\documents and settings\Bilou\Local Settings\Application Data\Ahead
2010-06-09 12:08 . 2010-06-09 12:12 -------- d-----w- c:\documents and settings\Bilou\Application Data\Ahead
2010-06-09 12:06 . 2010-06-09 12:07 -------- d-----w- c:\program files\Fichiers communs\Ahead
2010-06-09 12:06 . 2010-06-09 12:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2010-06-09 12:06 . 2010-06-09 12:06 -------- d-----w- c:\program files\Nero
2010-06-08 16:44 . 2010-06-08 16:44 -------- d-----w- c:\documents and settings\Bilou\Local Settings\Application Data\Identities
2010-06-08 14:37 . 2010-06-08 14:37 -------- d-----w- c:\program files\Havij
2010-06-07 20:28 . 2010-06-07 20:28 -------- d-----w- c:\windows\Sun
2010-06-07 18:53 . 2010-06-07 18:53 1879004 ----a-w- c:\documents and settings\Bilou\Application Data\Havij 1.08.exe
2010-06-02 17:07 . 2010-06-02 17:07 -------- d-----w- c:\documents and settings\Bilou\.thumbnails
2010-06-02 11:22 . 2008-04-13 18:45 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2010-06-02 11:15 . 2010-06-12 12:10 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-06-01 19:11 . 2010-06-01 19:11 -------- d-----w- c:\documents and settings\Bilou\Local Settings\Application Data\Help
2010-06-01 18:53 . 2010-06-01 18:53 -------- d-----w- C:\MinGW
2010-06-01 18:52 . 2010-06-01 19:17 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-01 18:51 . 2010-06-01 18:51 -------- d-----w- c:\program files\Matrix Multimedia
2010-06-01 18:51 . 2010-06-01 18:51 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2010-06-01 18:45 . 2010-06-01 20:50 -------- d-----w- c:\documents and settings\Bilou\Application Data\Media Player Classic
2010-06-01 18:44 . 2010-06-01 18:44 -------- d-----w- c:\program files\CCleaner
2010-06-01 18:40 . 2010-06-06 17:41 -------- d-----w- C:\wamp
2010-06-01 18:39 . 2010-06-01 18:39 -------- d-----w- C:\Qt
2010-06-01 18:39 . 2010-06-01 18:54 -------- d-----w- c:\documents and settings\Bilou\Application Data\Notepad++
2010-06-01 18:39 . 2010-06-01 18:39 -------- d-----w- c:\program files\Notepad++
2010-06-01 18:39 . 2010-06-01 18:39 -------- d-----w- C:\Dev-Cpp
2010-06-01 14:39 . 2010-06-01 14:39 -------- d-----w- c:\windows\l2schemas
2010-06-01 14:39 . 2010-06-01 14:39 -------- d-----w- c:\windows\system32\fr
2010-06-01 14:39 . 2010-06-01 14:39 -------- d-----w- c:\windows\system32\bits
2010-06-01 13:47 . 2004-08-03 22:38 327168 ------w- c:\windows\system32\drivers\ati2mtaa.sys
2010-06-01 13:37 . 2010-06-03 19:01 -------- d-----w- c:\documents and settings\Bilou\Local Settings\Application Data\Adobe
2010-06-01 13:37 . 2010-06-01 13:37 -------- d-----w- c:\program files\Fichiers communs\Adobe
2010-06-01 13:24 . 2010-06-11 09:30 -------- d-----w- c:\windows\system32\fr-fr
2010-06-01 13:15 . 2008-04-14 02:33 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-06-01 13:15 . 2008-04-13 18:45 60032 ----a-w- c:\windows\system32\drivers\usbaudio.sys
2010-06-01 13:15 . 2008-04-14 02:33 4096 ----a-w- c:\windows\system32\ksuser.dll
2010-06-01 13:15 . 2008-04-13 19:19 146048 ----a-w- c:\windows\system32\drivers\portcls.sys
2010-06-01 13:15 . 2008-04-13 18:45 60160 ----a-w- c:\windows\system32\drivers\drmk.sys
2010-06-01 13:15 . 2010-06-01 13:15 -------- d-----w- c:\windows\SHELLNEW
2010-06-01 13:15 . 2010-06-01 13:15 -------- d-----w- c:\program files\Microsoft.NET
2010-06-01 13:15 . 2008-04-14 01:57 58752 ----a-w- c:\windows\system32\drivers\redbook.sys
2010-06-01 13:15 . 2001-08-17 21:46 6400 ----a-w- c:\windows\system32\drivers\enum1394.sys
2010-06-01 13:14 . 2008-04-14 02:33 77312 ----a-w- c:\windows\system32\usbui.dll
2010-06-01 13:10 . 2010-06-15 14:10 -------- d-----w- c:\windows\system32\CatRoot2
2010-06-01 13:10 . 2010-06-11 09:35 -------- d-----w- c:\windows\system32\CatRoot
2010-06-01 13:10 . 2010-06-01 18:37 -------- d--h--w- c:\documents and settings\Default User
2010-06-01 13:10 . 2010-06-01 11:25 -------- d-----w- C:\Documents and Settings
2010-06-01 13:10 . 2010-06-01 11:21 -------- d-----w- c:\documents and settings\All Users
2010-06-01 13:05 . 2010-06-01 13:05 -------- d-----w- c:\program files\MSXML 6.0
2010-06-01 12:53 . 2010-06-01 12:53 -------- d-----w- c:\windows\Logs
2010-06-01 12:52 . 2010-06-01 12:52 15256 ----a-w- c:\documents and settings\Bilou\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
2010-06-01 12:52 . 2010-06-01 12:54 -------- d-----w- c:\program files\MSN Messenger
2010-06-01 12:50 . 2010-02-10 17:13 165376 ----a-w- c:\windows\system32\unrar.dll
2010-06-01 12:50 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-06-01 12:50 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2010-06-01 12:50 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2010-06-01 12:50 . 2010-03-10 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-06-01 12:49 . 2010-06-01 12:50 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-06-01 12:48 . 2010-06-01 12:48 -------- d-----w- c:\documents and settings\Bilou\Application Data\Malwarebytes
2010-06-01 12:48 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-01 12:48 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-01 12:48 . 2010-06-01 12:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-01 12:48 . 2010-06-01 12:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-01 12:46 . 2010-06-01 12:46 0 ----a-w- c:\windows\nsreg.dat
2010-06-01 12:46 . 2010-06-01 13:12 -------- d-----w- c:\program files\Java
2010-06-01 12:46 . 2010-06-01 12:46 -------- d-----w- c:\documents and settings\Bilou\Local Settings\Application Data\Mozilla
2010-06-01 12:46 . 2010-06-01 12:46 152576 ----a-w- c:\documents and settings\Bilou\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2010-06-01 12:46 . 2009-11-25 09:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-06-01 12:46 . 2009-03-30 07:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-06-01 12:46 . 2009-02-13 09:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-06-01 12:46 . 2009-02-13 09:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-06-01 12:46 . 2010-06-01 12:46 -------- d-----w- c:\program files\Avira
2010-06-01 12:46 . 2010-06-01 12:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-06-01 12:33 . 2010-06-01 12:33 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-06-01 12:31 . 2010-06-01 12:42 -------- d-----w- c:\program files\AlienGUIse
2010-06-01 12:31 . 2003-02-26 20:27 36864 ----a-w- c:\windows\system32\wbsys.dll
2010-06-01 12:18 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-06-01 12:17 . 2010-02-24 13:11 455680 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-06-01 12:16 . 2009-12-31 16:50 353792 -c----w- c:\windows\system32\dllcache\srv.sys
2010-06-01 12:15 . 2009-10-15 16:32 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-06-01 12:15 . 2009-10-15 16:32 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-06-01 12:15 . 2009-11-21 15:58 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-06-01 12:10 . 2009-08-25 09:18 354816 -c----w- c:\windows\system32\dllcache\winhttp.dll
2010-06-01 12:10 . 2010-02-17 12:07 2192000 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-06-01 12:10 . 2009-03-06 14:20 286720 -c----w- c:\windows\system32\dllcache\pdh.dll
2010-06-01 12:10 . 2009-02-09 11:23 111104 -c----w- c:\windows\system32\dllcache\services.exe
2010-06-01 12:10 . 2009-02-09 10:53 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2010-06-01 12:10 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2010-06-01 12:10 . 2009-06-25 08:26 736768 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2010-06-01 12:10 . 2009-02-09 10:53 739840 -c----w- c:\windows\system32\dllcache\ntdll.dll
2010-06-01 12:10 . 2009-02-09 10:53 685568 -c----w- c:\windows\system32\dllcache\advapi32.dll
2010-06-01 12:10 . 2009-02-09 10:53 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2010-06-01 12:10 . 2009-02-09 10:53 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-06-01 12:09 . 2010-02-16 19:06 2148352 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-06-01 12:09 . 2010-02-16 19:06 2026496 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-06-01 12:09 . 2008-04-21 21:15 219136 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-06-01 12:07 . 2008-10-15 16:35 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-06-01 12:05 . 2010-06-01 12:05 -------- d-----w- c:\documents and settings\Bilou\Local Settings\Application Data\Logitech
2010-06-01 12:05 . 2010-06-01 12:05 -------- d-----w- c:\program files\Fichiers communs\Logitech
2010-06-01 12:05 . 2010-06-01 12:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech
2010-06-01 12:05 . 2010-06-01 12:05 -------- d-----w- c:\program files\Logitech
2010-06-01 12:04 . 2008-06-14 17:33 272768 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-06-01 12:04 . 2008-06-14 17:33 272768 ------w- c:\windows\system32\drivers\bthport.sys
2010-06-01 12:03 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-06-01 12:00 . 2010-06-11 09:35 -------- d--h--w- c:\windows\$hf_mig$

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-15 13:56 . 2004-08-05 12:00 80508 ----a-w- c:\windows\system32\perfc00C.dat
2010-06-15 13:56 . 2004-08-05 12:00 500482 ----a-w- c:\windows\system32\perfh00C.dat
2010-06-15 13:45 . 2010-06-01 11:27 16608 ----a-w- c:\windows\gdrv.sys
2010-06-09 18:31 . 2010-06-01 11:49 20376 ----a-w- c:\documents and settings\Bilou\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-01 14:41 . 2010-06-01 11:21 86331 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-06-01 13:13 . 2010-06-01 13:13 -------- d-----w- c:\program files\Fichiers communs\Java
2010-06-01 13:13 . 2010-06-01 13:13 503808 ----a-w- c:\documents and settings\Bilou\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-22b25420-n\msvcp71.dll
2010-06-01 13:13 . 2010-06-01 13:13 499712 ----a-w- c:\documents and settings\Bilou\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-22b25420-n\jmc.dll
2010-06-01 13:13 . 2010-06-01 13:13 348160 ----a-w- c:\documents and settings\Bilou\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-22b25420-n\msvcr71.dll
2010-06-01 13:13 . 2010-06-01 13:13 61440 ----a-w- c:\documents and settings\Bilou\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-29369ed3-n\decora-sse.dll
2010-06-01 13:13 . 2010-06-01 13:13 12800 ----a-w- c:\documents and settings\Bilou\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-29369ed3-n\decora-d3d.dll
2010-06-01 13:07 . 2010-06-01 13:07 -------- d-----w- c:\program files\MSBuild
2010-06-01 13:07 . 2010-06-01 13:07 -------- d-----w- c:\program files\Reference Assemblies
2010-06-01 13:03 . 2010-06-01 13:03 -------- d-----w- c:\program files\Free Video Converter
2010-06-01 13:03 . 2010-06-01 13:03 -------- d-----w- c:\program files\Free Audio Pack
2010-06-01 13:03 . 2010-06-01 13:03 -------- d-----w- c:\program files\GIMP-2.0
2010-06-01 11:57 . 2010-06-01 11:57 -------- d-----w- c:\documents and settings\Bilou\Application Data\ATI
2010-06-01 11:57 . 2010-06-01 11:57 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-06-01 11:55 . 2010-06-01 11:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-01 11:53 . 2010-06-01 11:50 -------- d-----w- c:\program files\ATI Technologies
2010-06-01 11:51 . 2010-06-01 11:28 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2010-06-01 11:51 . 2010-06-01 11:51 9158 ----a-r- c:\documents and settings\Bilou\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2010-06-01 11:51 . 2010-06-01 11:51 -------- d-----w- c:\program files\Fichiers communs\ATI Technologies
2010-06-01 11:34 . 2010-06-01 11:32 -------- d-----w- c:\program files\Realtek
2010-06-01 11:34 . 2010-06-01 11:34 -------- d-----w- c:\documents and settings\Bilou\Application Data\InstallShield
2010-06-01 11:31 . 2010-06-01 11:31 315392 ----a-w- c:\windows\HideWin.exe
2010-06-01 11:28 . 2010-06-01 11:28 -------- d-----w- c:\program files\Intel
2010-06-01 11:28 . 2010-06-01 11:28 -------- d-----w- c:\program files\GIGABYTE
2010-06-01 11:22 . 2010-06-01 11:22 -------- d-----w- c:\program files\microsoft frontpage
2010-06-01 11:21 . 2010-06-01 11:21 -------- d-----w- c:\program files\Services en ligne
2010-06-01 11:19 . 2010-06-01 11:19 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2010-05-04 17:17 . 2004-08-05 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 17:17 . 2004-08-05 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-05-04 17:17 . 2004-08-05 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2010-05-02 08:08 . 2004-08-05 12:00 1851392 ----a-w- c:\windows\system32\win32k.sys
2010-04-29 09:47 . 2010-04-29 09:47 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-04-20 05:30 . 2004-08-05 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-12 15:29 . 2010-06-01 13:12 411368 ----a-w- c:\windows\system32\deployJava1.dll
.

Deuxième partie:

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F.lux"="c:\documents and settings\Bilou\Local Settings\Apps\F.lux\flux.exe" [2009-02-25 962560]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"Launch LGDCore"="c:\program files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" [2006-11-09 1126400]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GEST]
m'|\ü [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-05-07 07:39 16862208 ------r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/06/2010 15:38 691696]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [01/06/2010 14:46 108289]
S2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [01/06/2010 13:28 80392]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [01/06/2010 14:48 304464]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [01/06/2010 14:48 20952]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {B951A739-82BA-4BFD-A07F-B898DC9A6D7F} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Bilou\Application Data\Mozilla\Firefox\Profiles\ox37t5he.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: capability.policy.policynames - localfilelinks
FF - user.js: capability.policy.localfilelinks.sites - hxxp://s1.travian.fr https://www.travian.com/fr https://www.travian.com/fr https://www.travian.com/fr https://www.travian.com/fr https://www.travian.com/fr https://www.travian.com/fr https://www.travian.com/fr https://www.travian.com/fr https://www.travian.com/fr https://www.travian.com/fr http://s1.travian3.fr http://s2.travian3.fr http://s3.travian3.fr http://s4.travian3.fr http://s5.travian3.fr http://s6.travian3.fr http://s7.travian3.fr http://s8.travian3.fr http://s9.travian3.fr http://s10.travian3.fr http://speed.travian3.fr http://s1.travian3.fr http://s2.travian3.fr http://s3.travian3.fr http://s4.travian3.fr http://s5.travian3.fr http://s6.travian3.fr http://s7.travian3.fr http://s8.travian3.fr http://s9.travian3.fr http://s10.travian3.fr http://speed.travian3.fr http://s1.travian3.fr http://s2.travian3.fr http://s3.travian3.fr http://s4.travian3.fr http://s5.travian3.fr http://s6.travian3.fr http://s7.travian3.fr http://s8.travian3.fr http://s9.travian3.fr http://s10.travian3.fr http://speed.travian3.fr
FF - user.js: capability.policy.localfilelinks.checkloaduri.enabled - allAccess

FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHELINS SUPPRIMES - - - -

AddRemove-Usbfix - c:\usbfix\Un-Usbfix.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-15 16:13
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-842925246-1417001333-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(764)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-06-15 16:14:25
ComboFix-quarantined-files.txt 2010-06-15 14:14

Avant-CF: 64 267 210 752 octets libres
Après-CF: 65 823 174 656 octets libres

- - End Of File - - F9268860DDE5134982CEE8F80FA777A5

Rien de méchant apparemment, tu connais F.lux ? c'est toi qui l'as installé ?

Dés que tu lances internet, tu tombes sur cette page c'est ça ??

++

F.lux est un logiciel qui règle la luminosité du moniteur en fonction du l'heure.
Et de tant en tant quand je vais sur des site comme celui-ci je tombe sur le site de Onlineguardian.net qui me dit :
Onlineguardian a banni " downcool.forumotion.com " hébergé sur le service forumactif.com pour cause de non respect des conditions générales d'utilisation.

Mais ça me le fait sur tout les PC connecté a ma Livebox je pense donc la réinitialiser !

Bilou.

Ok, dis moi quoi

@+