Problème dans les processus

J'ai oublié de préciser que c'est impossible de jouer à mes jeux pc habituel étant donné que mon pc bloque toutes les 30 secondes. :(

salut

sauvegarde tes document importants par mesure de securité


/!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\

__________________________________________________________
>Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.<
>>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<<
=====================================================

▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" avant qu'il soit enregistré sur ton disque dur

Telecharge ici : Combofix

Avant d'utiliser ComboFix :

Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement :

▶ Télécharge Defogger (de jpshortstuff) sur ton Bureau

▶ Lance le

Une fenêtre apparait : clique sur "Disable"

▶ Fais redémarrer l'ordinateur si l'outil te le demande

Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"

________________________________________________________
>> referme les fenêtres de tous les programmes en cours.
>> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
>>la protection en temps réel de ton Antivirus et de tes Antispywares,
>>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur combofix renommé

▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!

▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

ComboFix 10-08-24.0C - Ilyes 25/08/2010 19:01:40.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1033.18.1015.617 [GMT 2:00]
Lancé depuis: c:\documents and settings\Ilyes\My Documents\Téléchargements\Ilyes.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Ilyes\Application Data\PriceGong
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Ilyes\Application Data\PriceGong\Data\z.xml

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-07-25 au 2010-08-25 ))))))))))))))))))))))))))))))))))))
.

2010-08-25 16:26 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-08-25 16:26 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-08-25 16:26 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-08-25 16:26 . 2010-08-25 16:26 -------- d-----w- c:\program files\Avira
2010-08-25 16:26 . 2010-08-25 16:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-08-24 20:14 . 2010-08-24 20:18 -------- d-----w- C:\ToolBar SD
2010-08-23 18:30 . 2010-08-23 18:30 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Messenger_Plus_Live_France
2010-08-23 18:30 . 2010-08-23 18:30 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2010-08-23 16:48 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-23 16:48 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-20 13:06 . 2010-08-20 13:06 -------- d-----w- c:\program files\Guitar Pro 5
2010-08-19 13:32 . 2010-08-19 13:33 -------- d-----w- c:\program files\QuickTime
2010-08-19 13:32 . 2010-08-19 13:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-08-19 13:28 . 2010-08-19 13:28 -------- d-----w- c:\program files\Common Files\Apple
2010-08-19 13:27 . 2010-08-19 13:27 -------- d-----w- c:\program files\Apple Software Update
2010-08-19 13:27 . 2010-08-19 13:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-08-17 10:08 . 2010-08-17 10:08 -------- d-----w- c:\documents and settings\Ilyes\Application Data\Malwarebytes
2010-08-17 10:08 . 2010-08-23 16:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-17 10:08 . 2010-08-17 10:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-15 18:35 . 2010-08-15 18:35 -------- d-----w- c:\program files\Activision
2010-08-13 17:03 . 2010-08-13 17:03 -------- d-----w- c:\documents and settings\Ilyes\Application Data\A6F82CDD9BD8B415A84E39FDE206B488
2010-08-10 17:40 . 2010-08-15 18:28 -------- d-----w- c:\documents and settings\Ilyes\Application Data\Guitar Pro 6
2010-08-10 17:40 . 2010-08-10 17:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Guitar Pro 6
2010-08-09 17:17 . 2010-08-09 17:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Grisoft
2010-08-09 16:55 . 2010-08-15 18:28 -------- d-----w- c:\program files\Guitar Pro 6
2010-08-02 19:25 . 2010-08-02 19:30 -------- d-----w- c:\documents and settings\Ilyes\P5JavaClientSettings

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-25 15:37 . 2010-04-02 17:30 -------- d-----w- c:\program files\Warcraft III
2010-08-25 10:49 . 2010-07-24 19:42 -------- d-----w- c:\program files\Call of Duty
2010-08-25 10:40 . 2009-11-01 10:35 138376 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-08-25 10:40 . 2009-11-01 10:35 202448 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-08-22 11:19 . 2009-09-13 10:09 -------- d-----w- c:\program files\Messenger Plus! Live
2010-08-19 13:20 . 2009-10-17 12:52 -------- d-----w- c:\documents and settings\Ilyes\Application Data\vlc
2010-08-17 14:27 . 2009-11-03 21:00 -------- d-----w- c:\documents and settings\Ilyes\Application Data\dvdcss
2010-08-16 15:15 . 2009-04-16 11:43 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-13 10:15 . 2009-05-17 08:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-08 21:35 . 2009-07-18 19:15 -------- d-----w- c:\program files\Windows Live
2010-08-08 21:34 . 2010-02-17 18:22 -------- d-----w- c:\program files\HP
2010-08-08 21:31 . 2009-05-20 18:07 -------- d-----w- c:\program files\Google
2010-07-04 13:06 . 2010-05-23 11:31 -------- d-----w- c:\program files\Messenger_Plus_Live_France
2010-06-30 12:31 . 2005-08-30 09:19 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-27 12:11 . 2009-10-31 16:32 -------- d-----w- c:\program files\eMule
2010-06-27 12:09 . 2010-03-27 12:51 -------- d-----w- c:\documents and settings\Ilyes\Application Data\eMule
2010-06-27 09:56 . 2010-06-10 20:43 -------- d-----w- c:\documents and settings\Ilyes\Application Data\FissaSearch
2010-06-24 12:22 . 2005-08-30 09:20 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2005-08-30 09:20 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2005-08-30 09:19 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2005-08-30 09:16 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2009-04-16 10:54 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2005-08-30 09:18 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-03 11:41 . 2010-06-03 11:41 6656 ----a-w- c:\documents and settings\Ilyes\Application Data\FissaSearch\FissaUninstaller.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{59994074-c06d-4a75-9768-49e5a8c21264}"= "c:\program files\Messenger_Plus_Live_France\tbMes1.dll" [2010-07-04 2734688]

[HKEY_CLASSES_ROOT\clsid\{59994074-c06d-4a75-9768-49e5a8c21264}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59994074-c06d-4a75-9768-49e5a8c21264}]
2010-07-04 13:07 2734688 ----a-w- c:\program files\Messenger_Plus_Live_France\tbMes1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{59994074-c06d-4a75-9768-49e5a8c21264}"= "c:\program files\Messenger_Plus_Live_France\tbMes1.dll" [2010-07-04 2734688]

[HKEY_CLASSES_ROOT\clsid\{59994074-c06d-4a75-9768-49e5a8c21264}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{59994074-C06D-4A75-9768-49E5A8C21264}"= "c:\program files\Messenger_Plus_Live_France\tbMes1.dll" [2010-07-04 2734688]

[HKEY_CLASSES_ROOT\clsid\{59994074-c06d-4a75-9768-49e5a8c21264}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-09-15 118784]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan.lnk
backup=c:\windows\pss\McAfee Security Scan.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 16:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-01 11:28 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\aMSN\\bin\\wish.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Call of Duty\\CoDMP.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Documents and Settings\\Ilyes\\My Documents\\Téléchargements\\Downloader_Warcraft3_Reign_of_Chaos_frFR.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Documents and Settings\\Ilyes\\My Documents\\Téléchargements\\Downloader_Warcraft3_The_Frozen_Throne_frFR.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"9676:TCP"= 9676:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"7552:TCP"= 7552:TCP:Services
"7553:TCP"= 7553:TCP:Services
"6112:TCP"= 6112:TCP:Warcraft
"3848:TCP"= 3848:TCP:Services
"6196:TCP"= 6196:TCP:Services

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [25/08/2010 18:26 108289]
S2 gupdate1c9d975ffa97e0e;Service Google Update (gupdate1c9d975ffa97e0e);c:\program files\Google\Update\GoogleUpdate.exe [20/05/2009 20:08 133104]
S3 BzSpIDer;BzSpIDer;\??\g:\opiron\BzSpIDer.sys --> g:\opiron\BzSpIDer.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [31/10/2009 16:31 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'

2010-08-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-20 18:08]

2010-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-20 18:08]

2010-06-29 c:\windows\Tasks\WebReg HP Deskjet F4500 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2009-05-21 19:40]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://google.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
mWindow Title =
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
Trusted Zone: chat-land.org
TCP: {2384CED7-F43E-4701-9FA9-686F220F0882} = 212.27.40.241,212.27.40.240
FF - ProfilePath - c:\documents and settings\Ilyes\Application Data\Mozilla\Firefox\Profiles\6gqsk421.Ilyes\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\Ilyes\Application Data\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
- - - - ORPHELINS SUPPRIMES - - - -

Toolbar-{168A8E70-AD69-421A-92BB-896EF6DF68EB} - (no file)
WebBrowser-{168A8E70-AD69-421A-92BB-896EF6DF68EB} - (no file)
MSConfigStartUp-McAfeeUpdaterUI - c:\program files\McAfee\Common Framework\UdaterUI.exe
MSConfigStartUp-ShStatEXE - c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-25 19:10
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x85FCA78A]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf768bf28
\Driver\ACPI -> ACPI.sys @ 0xf751ecb8
\Driver\atapi -> ntkrnlpa.exe @ 0x8057c2df
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579014
ParseProcedure -> ntkrnlpa.exe @ 0x80577c76
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579014
ParseProcedure -> ntkrnlpa.exe @ 0x80577c76
NDIS: Intel(R) PRO/Wireless 2200BG Network Connection -> SendCompleteHandler -> 0x86030b60
PacketIndicateHandler -> NDIS.sys @ 0xf73d1a21
SendHandler -> NDIS.sys @ 0xf73af87b
copy of MBR has been found in sector 0x06FC78B3
malicious code @ sector 0x06FC78B6 !
PE file found in sector at 0x06FC78CC !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,0d,59,ac,22,50,a0,59,4e,87,49,2e,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,0d,59,ac,22,50,a0,59,4e,87,49,2e,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(900)
c:\windows\system32\igfxdev.dll
.
Heure de fin: 2010-08-25 19:13:07
ComboFix-quarantined-files.txt 2010-08-25 17:13

Avant-CF: 9 903 321 088 bytes free
Après-CF: 9 963 528 192 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 8B95B484F1ACB6D2B0824B74A7D49F05

__________________________________________________
=>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=
----------------------------------------------------------------------------

Toujours avec toutes les protections désactivées, fais ceci :

▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------
KillAll::

MBR::

------------------------------------------------------------------

▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes

▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix

▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

Euh j'ai peur de faire une connerie:
"Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix "

C'est quel fichier combofix?

l'icone drouge et blanc que tu as lancé au prealable et que tu as renommé "Ilyes.exe"

ComboFix 10-08-24.0C - Ilyes 25/08/2010 19:53:19.2.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1033.18.1015.624 [GMT 2:00]
Lancé depuis: c:\documents and settings\Ilyes\My Documents\Téléchargements\Ilyes.exe
Commutateurs utilisés :: c:\documents and settings\Ilyes\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-07-25 au 2010-08-25 ))))))))))))))))))))))))))))))))))))
.

2010-08-25 16:26 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-08-25 16:26 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-08-25 16:26 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-08-25 16:26 . 2010-08-25 16:26 -------- d-----w- c:\program files\Avira
2010-08-25 16:26 . 2010-08-25 16:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-08-24 20:14 . 2010-08-24 20:18 -------- d-----w- C:\ToolBar SD
2010-08-23 18:30 . 2010-08-23 18:30 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Messenger_Plus_Live_France
2010-08-23 18:30 . 2010-08-23 18:30 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2010-08-23 16:48 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-23 16:48 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-20 13:06 . 2010-08-20 13:06 -------- d-----w- c:\program files\Guitar Pro 5
2010-08-19 13:32 . 2010-08-19 13:33 -------- d-----w- c:\program files\QuickTime
2010-08-19 13:32 . 2010-08-19 13:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-08-19 13:28 . 2010-08-19 13:28 -------- d-----w- c:\program files\Common Files\Apple
2010-08-19 13:27 . 2010-08-19 13:27 -------- d-----w- c:\program files\Apple Software Update
2010-08-19 13:27 . 2010-08-19 13:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-08-17 10:08 . 2010-08-17 10:08 -------- d-----w- c:\documents and settings\Ilyes\Application Data\Malwarebytes
2010-08-17 10:08 . 2010-08-23 16:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-17 10:08 . 2010-08-17 10:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-15 18:35 . 2010-08-15 18:35 -------- d-----w- c:\program files\Activision
2010-08-13 17:03 . 2010-08-13 17:03 -------- d-----w- c:\documents and settings\Ilyes\Application Data\A6F82CDD9BD8B415A84E39FDE206B488
2010-08-10 17:40 . 2010-08-15 18:28 -------- d-----w- c:\documents and settings\Ilyes\Application Data\Guitar Pro 6
2010-08-10 17:40 . 2010-08-10 17:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Guitar Pro 6
2010-08-09 17:17 . 2010-08-09 17:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Grisoft
2010-08-09 16:55 . 2010-08-15 18:28 -------- d-----w- c:\program files\Guitar Pro 6
2010-08-02 19:25 . 2010-08-02 19:30 -------- d-----w- c:\documents and settings\Ilyes\P5JavaClientSettings

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-25 15:37 . 2010-04-02 17:30 -------- d-----w- c:\program files\Warcraft III
2010-08-25 10:49 . 2010-07-24 19:42 -------- d-----w- c:\program files\Call of Duty
2010-08-25 10:40 . 2009-11-01 10:35 138376 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-08-25 10:40 . 2009-11-01 10:35 202448 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-08-22 11:19 . 2009-09-13 10:09 -------- d-----w- c:\program files\Messenger Plus! Live
2010-08-19 13:20 . 2009-10-17 12:52 -------- d-----w- c:\documents and settings\Ilyes\Application Data\vlc
2010-08-17 14:27 . 2009-11-03 21:00 -------- d-----w- c:\documents and settings\Ilyes\Application Data\dvdcss
2010-08-16 15:15 . 2009-04-16 11:43 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-13 10:15 . 2009-05-17 08:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-08 21:35 . 2009-07-18 19:15 -------- d-----w- c:\program files\Windows Live
2010-08-08 21:34 . 2010-02-17 18:22 -------- d-----w- c:\program files\HP
2010-08-08 21:31 . 2009-05-20 18:07 -------- d-----w- c:\program files\Google
2010-07-04 13:06 . 2010-05-23 11:31 -------- d-----w- c:\program files\Messenger_Plus_Live_France
2010-06-30 12:31 . 2005-08-30 09:19 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-27 12:11 . 2009-10-31 16:32 -------- d-----w- c:\program files\eMule
2010-06-27 12:09 . 2010-03-27 12:51 -------- d-----w- c:\documents and settings\Ilyes\Application Data\eMule
2010-06-27 09:56 . 2010-06-10 20:43 -------- d-----w- c:\documents and settings\Ilyes\Application Data\FissaSearch
2010-06-24 12:22 . 2005-08-30 09:20 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2005-08-30 09:20 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2005-08-30 09:19 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2005-08-30 09:16 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2009-04-16 10:54 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2005-08-30 09:18 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-03 11:41 . 2010-06-03 11:41 6656 ----a-w- c:\documents and settings\Ilyes\Application Data\FissaSearch\FissaUninstaller.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{59994074-c06d-4a75-9768-49e5a8c21264}"= "c:\program files\Messenger_Plus_Live_France\tbMes1.dll" [2010-07-04 2734688]

[HKEY_CLASSES_ROOT\clsid\{59994074-c06d-4a75-9768-49e5a8c21264}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59994074-c06d-4a75-9768-49e5a8c21264}]
2010-07-04 13:07 2734688 ----a-w- c:\program files\Messenger_Plus_Live_France\tbMes1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{59994074-c06d-4a75-9768-49e5a8c21264}"= "c:\program files\Messenger_Plus_Live_France\tbMes1.dll" [2010-07-04 2734688]

[HKEY_CLASSES_ROOT\clsid\{59994074-c06d-4a75-9768-49e5a8c21264}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{59994074-C06D-4A75-9768-49E5A8C21264}"= "c:\program files\Messenger_Plus_Live_France\tbMes1.dll" [2010-07-04 2734688]

[HKEY_CLASSES_ROOT\clsid\{59994074-c06d-4a75-9768-49e5a8c21264}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-09-15 118784]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan.lnk
backup=c:\windows\pss\McAfee Security Scan.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 16:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-01 11:28 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\aMSN\\bin\\wish.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Call of Duty\\CoDMP.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Documents and Settings\\Ilyes\\My Documents\\Téléchargements\\Downloader_Warcraft3_Reign_of_Chaos_frFR.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Documents and Settings\\Ilyes\\My Documents\\Téléchargements\\Downloader_Warcraft3_The_Frozen_Throne_frFR.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"9676:TCP"= 9676:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"7552:TCP"= 7552:TCP:Services
"7553:TCP"= 7553:TCP:Services
"6112:TCP"= 6112:TCP:Warcraft
"3848:TCP"= 3848:TCP:Services
"6196:TCP"= 6196:TCP:Services
"5335:TCP"= 5335:TCP:Services
"9170:TCP"= 9170:TCP:Services

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [25/08/2010 18:26 108289]
S2 gupdate1c9d975ffa97e0e;Service Google Update (gupdate1c9d975ffa97e0e);c:\program files\Google\Update\GoogleUpdate.exe [20/05/2009 20:08 133104]
S3 BzSpIDer;BzSpIDer;\??\g:\opiron\BzSpIDer.sys --> g:\opiron\BzSpIDer.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [31/10/2009 16:31 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'

2010-08-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-20 18:08]

2010-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-20 18:08]

2010-06-29 c:\windows\Tasks\WebReg HP Deskjet F4500 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2009-05-21 19:40]
.
.

------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://google.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
mWindow Title =
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
Trusted Zone: chat-land.org
TCP: {2384CED7-F43E-4701-9FA9-686F220F0882} = 212.27.40.241,212.27.40.240
FF - ProfilePath - c:\documents and settings\Ilyes\Application Data\Mozilla\Firefox\Profiles\6gqsk421.Ilyes\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\Ilyes\Application Data\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-25 20:03
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,0d,59,ac,22,50,a0,59,4e,87,49,2e,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,0d,59,ac,22,50,a0,59,4e,87,49,2e,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(204)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Heure de fin: 2010-08-25 20:10:43 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-08-25 18:10
ComboFix2.txt 2010-08-25 17:13

Avant-CF: 9 988 857 856 bytes free
Après-CF: 9 980 469 248 octets libres

- - End Of File - - 927D661A21F644FE4B57B6E7AEFEA778

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

▶ Télécharge ici :List_Kill'em

et enregistre le sur ton bureau

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur le raccourci sur ton bureau pour lancer l'installation

Laisse coché :

♦ Executer List_Kill'em

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis l'option Search

▶ laisse travailler l'outil

il se peut qu'une boite de dialogue s'ouvre , dans ce cas clique sur "ok" ou "Agree"

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal ,c'est une recherche supplementaire de fichiers cachés , le programme n'est pas bloqué.

▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

▶▶▶ NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier C:\List'em.txt

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=265368/cijSKAP5fU.txt

est ajouté dans la page.

▶ Copie ce lien dans ta réponse.

▶ Fais de même avec more.txt qui se trouve sur ton bureau

http://www.cijoint.fr/cjlink.php?file=cj201008/cijtB13uUV.txt

http://www.cijoint.fr/cjlink.php?file=cj201008/cij1QXp3XM.txt

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

* * Colle directement le chemin des fichiers , un par un , dans l'espace "Parcourir" apres chaque analyse :

c:\windows\system32\drivers\del5422.cty
C:\WINDOWS\System32\ct32.dll
C:\WINDOWS\System32\stac97co.dll


* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée colle le lien de(s)( la) page(s) dans ta prochaine réponse.

ensuite :

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

▶ Relance List_Kill'em,avec le raccourci sur ton bureau.

mais cette fois-ci :

▶ choisis l'Option Clean

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

▶ colle le contenu dans ta reponse

http://www.virustotal.com/file-scan/reanalysis.html?id=ea2243fdf25cf3bc14a58c5e7e8ac3ecb9908fd46bce263e20034d6a7cb4be25-1282772336

http://www.virustotal.com/file-scan/reanalysis.html?id=9ba67640f18b81b9da0646f211457dac8fc624e7940ad35170cb3111f5b3b81d-1282772393

http://www.virustotal.com/file-scan/reanalysis.html?id=7d25bdee6e59e827b702eab534bebb009ba3d28f7035c45623a1feb6ada6de1e-1282772425

¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.0.0 ¤¤¤¤¤¤¤¤¤¤

User : Ilyes (Users)
Update on 24/08/2010 by g3n-h@ckm@n ::::: 23.20
Start at: 23:49:29 | 25/08/2010

Intel(R) Pentium(R) M processor 1.73GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 55,89 Go (9,33 Go free) | NTFS
D:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ------- Memory(Ko)

C:\WINDOWS\System32\smss.exe ----432 Ko
C:\WINDOWS\system32\csrss.exe ----2680 Ko
C:\WINDOWS\system32\winlogon.exe ----2948 Ko
C:\WINDOWS\system32\services.exe ----3624 Ko
C:\WINDOWS\system32\lsass.exe ----7148 Ko
C:\WINDOWS\system32\svchost.exe ----5592 Ko
C:\WINDOWS\system32\svchost.exe ----4600 Ko
C:\WINDOWS\System32\svchost.exe ----31176 Ko
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe ----12320 Ko
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe ----12352 Ko
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe ----13400 Ko
C:\WINDOWS\system32\svchost.exe ----4204 Ko
C:\WINDOWS\system32\svchost.exe ----4108 Ko
C:\WINDOWS\system32\spoolsv.exe ----6020 Ko
C:\WINDOWS\System32\SCardSvr.exe ----2728 Ko
C:\Program Files\Avira\AntiVir Desktop\sched.exe ----932 Ko
C:\WINDOWS\system32\svchost.exe ----3896 Ko
C:\Program Files\Avira\AntiVir Desktop\avguard.exe ----1764 Ko
C:\WINDOWS\system32\svchost.exe ----6176 Ko
C:\WINDOWS\system32\svchost.exe ----7544 Ko
C:\Program Files\Java\jre6\bin\jqs.exe ----1484 Ko
C:\WINDOWS\System32\svchost.exe ----3008 Ko
C:\WINDOWS\System32\svchost.exe ----2988 Ko
C:\WINDOWS\system32\PnkBstrA.exe ----2548 Ko
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe ----3132 Ko
C:\WINDOWS\system32\svchost.exe ----4432 Ko
C:\WINDOWS\System32\alg.exe ----3636 Ko
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe ----13884 Ko
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe ----15212 Ko
C:\WINDOWS\system32\hkcmd.exe ----2940 Ko
C:\WINDOWS\system32\igfxpers.exe ----2980 Ko
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe ----1556 Ko
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe ----15036 Ko
C:\WINDOWS\system32\ctfmon.exe ----3964 Ko
C:\WINDOWS\explorer.exe ----27316 Ko
C:\WINDOWS\system32\wscntfy.exe ----2480 Ko
C:\WINDOWS\system32\cmd.exe ----2976 Ko
C:\WINDOWS\system32\wbem\wmiprvse.exe ----6932 Ko
C:\Program Files\List_Kill'em\ERUNT.EXE ----3612 Ko
C:\Program Files\List_Kill'em\pv.exe ----2816 Ko

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\WINDOWS\003096_.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET1C.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET1F.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET2B.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET3.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET4.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET8.tmp

Quarantined & Deleted !! : C:\WINDOWS\system32\AbaleZip.dll
Quarantined & Deleted !! : C:\Documents and Settings\Ilyes\Application Data\PriceGong

¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤

127.0.0.1 localhost

¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤

Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar : {59994074-c06d-4a75-9768-49e5a8c21264}
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {59994074-C06D-4A75-9768-49E5A8C21264}
Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks : {59994074-c06d-4a75-9768-49e5a8c21264}
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59994074-c06d-4a75-9768-49e5a8c21264}"
Deleted : HKCU\Software\Conduit
Deleted : HKLM\Software\Conduit

¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr/?ocid=iehp
Local Page = C:\WINDOWS\system32\blank.htm
Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.google.com/?gws_rd=ssl
Local Page = C:\WINDOWS\system32\blank.htm
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled = 1 ()
AntiVirusDisableNotify = 0 (0x0)
FirewallDisableNotify = 0 (0x0)
UpdatesDisableNotify = 0 (0x0)
AntiVirusOverride = 1 ()
FirewallOverride = 1 ()

¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

FEATURE_BROWSER_EMULATION | svchost :
====================================

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys prosync1.sys hal.dll sfsync02.sys atapi.sys intelide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x06FC78B3
malicious code @ sector 0x06FC78B6 !
PE file found in sector at 0x06FC78CC !

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

tu peux faire reanalyser les fichiers , mais cette fois-ci tu fais reanalyser si tu tombes sur une des pages precedentes ?

Ahem, j'ai pas très bien compris le truc.

tu refais la partie virus total de ce post : https://forums.commentcamarche.net/forum/affich-18963964-probleme-dans-les-processus#16

mais si ca te dit ca :

File already submitted:

tu clic sur reanalyser

http://www.virustotal.com/file-scan/report.html?id=ea2243fdf25cf3bc14a58c5e7e8ac3ecb9908fd46bce263e20034d6a7cb4be25-1282858103

http://www.virustotal.com/file-scan/report.html?id=9ba67640f18b81b9da0646f211457dac8fc624e7940ad35170cb3111f5b3b81d-1282858120

http://www.virustotal.com/file-scan/report.html?id=7d25bdee6e59e827b702eab534bebb009ba3d28f7035c45623a1feb6ada6de1e-1282858135