Problème avec services.exe

Merci de ta réponse,
j'ai fait une mise à jour d'avast en début de journée déjà, et j'ai fait un peu de ménage déjà.
voilà le rapport:


SmitFraudFix v2.130

Rapport fait à 16:13:23,23, 15/12/2006
Executé à partir de C:\Documents and Settings\Haykon\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Haykon


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Haykon\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Haykon\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="MsgPlusLoader.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

ce fut long mais bon ;o)
voilà le rapport.
Par contre ça dot faire 2 ou 3h que que je n'ai plus le message d'erreur et que le pc ne redemarre pas...

AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 17:48:02 15/12/2006

+ Résultat de l'analyse:



C:\WINDOWS\Downloaded Program Files\CONFLICT.10\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.11\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.12\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.13\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.4\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.5\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.6\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.7\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.8\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\WINDOWS\Downloaded Program Files\CONFLICT.9\HDPlugin1019.dll -> Adware.Gator : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113378.dll -> Adware.NaviPromo : Ignoré.
HKLM\SOFTWARE\Classes\NaviPromo.EGNaviScoring -> Adware.NaviPromo : Ignoré.
HKLM\SOFTWARE\Classes\NaviPromo.EGNaviScoring.1 -> Adware.NaviPromo : Ignoré.
HKLM\SOFTWARE\Classes\NaviPromo.EGNaviScoring\CLSID -> Adware.NaviPromo : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113365.dll -> Dialer.EGroup.s : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113375.dll -> Dialer.EGroup.s : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113379.dll -> Dialer.EGroup.u : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113369.dll -> Dialer.EgroupDial.v : Ignoré.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Instant Access -> Dialer.Generic : Ignoré.
C:\WINDOWS\system32\syswbsvc32.dll -> Dialer.InstantAccess.e : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113371.dll -> Dialer.InstantAccess.f : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113372.dll -> Dialer.InstantAccess.f : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113373.dll -> Dialer.InstantAccess.f : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113374.dll -> Dialer.InstantAccess.f : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113370.dll -> Dialer.InstantAccess.m : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@247realmedia[1].txt -> TrackingCookie.247realmedia : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@2o7[2].txt -> TrackingCookie.2o7 : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@adtech[2].txt -> TrackingCookie.Adtech : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@bluestreak[1].txt -> TrackingCookie.Bluestreak : Ignoré.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@bluestreak[2].txt -> TrackingCookie.Bluestreak : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@estat[1].txt -> TrackingCookie.Estat : Ignoré.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@estat[1].txt -> TrackingCookie.Estat : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@data3.perf.overture[1].txt -> TrackingCookie.Overture : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@perf.overture[1].txt -> TrackingCookie.Overture : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@edge.ru4[1].txt -> TrackingCookie.Ru4 : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@serving-sys[1].txt -> TrackingCookie.Serving-sys : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Ignoré.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Ignoré.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@valueclick[1].txt -> TrackingCookie.Valueclick : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@weborama[2].txt -> TrackingCookie.Weborama : Ignoré.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@weborama[1].txt -> TrackingCookie.Weborama : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Ignoré.
C:\Documents and Settings\Haykon\Cookies\haykon@zedo[2].txt -> TrackingCookie.Zedo : Ignoré.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@zedo[2].txt -> TrackingCookie.Zedo : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113368.dll -> Trojan.Dialer.pc : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113367.dll -> Trojan.P2E.cl : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113377.dll -> Trojan.P2E.cl : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113366.dll -> Trojan.P2E.cm : Ignoré.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113376.dll -> Trojan.P2E.cm : Ignoré.


Fin du rapport

rapport apres suppression:
VG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 17:52:26 15/12/2006

+ Résultat de l'analyse:



C:\WINDOWS\Downloaded Program Files\CONFLICT.10\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.11\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.12\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.13\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.4\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.5\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.6\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.7\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.8\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\WINDOWS\Downloaded Program Files\CONFLICT.9\HDPlugin1019.dll -> Adware.Gator : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113378.dll -> Adware.NaviPromo : Nettoyé.
HKLM\SOFTWARE\Classes\NaviPromo.EGNaviScoring -> Adware.NaviPromo : Nettoyé.
HKLM\SOFTWARE\Classes\NaviPromo.EGNaviScoring.1 -> Adware.NaviPromo : Nettoyé.
HKLM\SOFTWARE\Classes\NaviPromo.EGNaviScoring\CLSID -> Adware.NaviPromo : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113365.dll -> Dialer.EGroup.s : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113375.dll -> Dialer.EGroup.s : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113379.dll -> Dialer.EGroup.u : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113369.dll -> Dialer.EgroupDial.v : Nettoyé.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Instant Access -> Dialer.Generic : Nettoyé.
C:\WINDOWS\system32\syswbsvc32.dll -> Dialer.InstantAccess.e : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113371.dll -> Dialer.InstantAccess.f : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113372.dll -> Dialer.InstantAccess.f : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113373.dll -> Dialer.InstantAccess.f : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113374.dll -> Dialer.InstantAccess.f : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113370.dll -> Dialer.InstantAccess.m : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@data3.perf.overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@perf.overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@edge.ru4[1].txt -> TrackingCookie.Ru4 : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Nettoyé.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@valueclick[1].txt -> TrackingCookie.Valueclick : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\Haykon\Cookies\haykon@zedo[2].txt -> TrackingCookie.Zedo : Nettoyé.
C:\Documents and Settings\Haykon\Local Settings\Temp\Cookies\haykon@zedo[2].txt -> TrackingCookie.Zedo : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113368.dll -> Trojan.Dialer.pc : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113367.dll -> Trojan.P2E.cl : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113377.dll -> Trojan.P2E.cl : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113366.dll -> Trojan.P2E.cm : Nettoyé.
C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113376.dll -> Trojan.P2E.cm : Nettoyé.


Fin du rapport

voilà le rapport...

Logfile of HijackThis v1.99.1
Scan saved at 18:54:40, on 15/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.cdiscount.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ie/defaults/sb/ymsgr6/fr/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4FFA3E0A-9F16-25B2-8507-64550DA92417} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [WindowsRegKey update] 16winupdate32.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] winupdt.exe
O4 - HKLM\..\Run: [Microsoft IT Update] IEserv.exe
O4 - HKLM\..\Run: [Microsoft Update] muamgrd.exe
O4 - HKLM\..\Run: [Process Session Manager] pidserv.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [WindowsRegKey update] 16winupdate32.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] winupdt.exe
O4 - HKLM\..\RunServices: [Microsoft IT Update] IEserv.exe
O4 - HKLM\..\RunServices: [Microsoft Update] muamgrd.exe
O4 - HKLM\..\RunServices: [Process Session Manager] pidserv.exe
O4 - HKCU\..\Run: [WindowsRegKey update] 16winupdate32.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] winupdt.exe
O4 - HKCU\..\Run: [Microsoft IT Update] IEserv.exe
O4 - HKCU\..\Run: [Process Session Manager] pidserv.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM95\aim.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_old.exe
O16 - DPF: {0E79192A-C52C-4260-920F-639AC2296203} - https://www.afternic.com/domains/downloadv3.com
O16 - DPF: {31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} - https://www.afternic.com/domains/downloadv3.com
O16 - DPF: {39EA2F6F-3F50-4F58-9C63-4B3D53B0926E} - https://www.afternic.com/domains/downloadv3.com
O16 - DPF: {7504F0D5-644A-4103-9D02-95488B6CB9A1} - https://www.afternic.com/domains/downloadv3.com
O16 - DPF: {87C1805D-C5AE-4455-AB39-E245BB516136} - http://scripts.dlv4.com/binaries/egaccess4/egaccess4_1059_XP.cab
O16 - DPF: {8D8BAF56-B581-4B90-A549-C4AC6B03F1BB} - https://www.afternic.com/domains/downloadv3.com
O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - https://www.afternic.com/domains/downloadv3.com
O16 - DPF: {C2481ED1-9896-4D49-AE90-69858DFDE446} - https://www.afternic.com/domains/downloadv3.com
O16 - DPF: {EC4AFBF3-4540-4306-AF10-4CAC509EA16B} - https://www.afternic.com/domains/downloadv3.com
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Microsoft Security Subsystem Provider (eProxy) - Unknown owner - C:\WINDOWS\ngsrv.exe" " (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Windows Update Service (muamgrd) - Unknown owner - C:\WINDOWS\System32\muamgrd.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

les logiciels anti-spywares que j'ai sont:
spybot-search and destroy
Ad-aware
AVG anti spyware

et voilà le rapport du scan en ligne

BitDefender Online Scanner



Scan report generated at: Fri, Dec 15, 2006 - 21:11:55





Scan path: A:\;C:\;D:\;E:\;







Statistics

Time
01:05:27

Files
174609

Folders
3228

Boot Sectors
2

Archives
1738

Packed Files
17342




Results

Identified Viruses
3

Infected Files
5

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
5




Engines Info

Virus Definitions
339294

Engine build
AVCORE v1.0 (build 2371) (i386) (Dec 13 2006 11:16:42)

Scan plugins
14

Archive plugins
38

Unpack plugins
6

E-mail plugins
6

System plugins
1




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status

C:\Documents and Settings\Haykon\staff.html=>(JAVASCRIPT 1)
Infected with: Trojan.Clicker.Js.Linker.J

C:\Documents and Settings\Haykon\staff.html=>(JAVASCRIPT 1)
Disinfection failed

C:\Documents and Settings\Haykon\staff.html=>(JAVASCRIPT 1)
Deleted

C:\Documents and Settings\Haykon\staff.html
Updated

C:\Documents and Settings\Haykon\x.bat
Infected with: Trojan.Multidropper.FU

C:\Documents and Settings\Haykon\x.bat
Disinfection failed

C:\Documents and Settings\Haykon\x.bat
Deleted

C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113363.exe
Infected with: TrojanDropper.Yabinder.2.0

C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113363.exe
Disinfection failed

C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP550\A0113363.exe
Deleted

C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP554\A0117480.bat
Infected with: Trojan.Multidropper.FU

C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP554\A0117480.bat
Disinfection failed

C:\System Volume Information\_restore{608CAB7A-2C0A-4816-A76F-2E25DEFC1BAE}\RP554\A0117480.bat
Deleted

C:\WINDOWS\system32\x.bat
Infected with: Trojan.Multidropper.FU

C:\WINDOWS\system32\x.bat
Disinfection failed

C:\WINDOWS\system32\x.bat
Deleted

ok ben merci bcp, vraiment c'est sympa...

voilà le rapport de combofix:

Haykon - 06-12-15 22:09:51,39 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\Haykon\Bureau"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\windows


((((((((((((((((((((((((((((((( Files Created from 2006-11-15 to 2006-12-15 ))))))))))))))))))))))))))))))))))


2006-12-15 21:59 <REP> d-------- C:\Program Files\xerox
2006-12-15 21:59 <REP> d-------- C:\Program Files\microsoft frontpage
2006-12-15 20:02 <REP> d-------- C:\WINDOWS\BDOSCAN8
2006-12-15 18:36 <REP> d-------- C:\Program Files\Sunbelt Software
2006-12-15 18:29 <REP> dr-h----- C:\Documents and Settings\Haykon\Recent
2006-12-15 18:07 <REP> d-------- C:\Program Files\CCleaner
2006-12-15 16:56 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-15 16:56 <REP> d-------- C:\Program Files\Grisoft
2006-12-15 16:13 2,484 --a------ C:\WINDOWS\system32\tmp.reg
2006-12-15 16:12 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2006-12-15 16:12 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-12-15 16:12 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2006-12-15 16:12 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-12-15 16:12 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-12-15 16:12 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-12-15 15:44 <REP> d-------- C:\HijackThis
2006-12-08 18:35 <REP> d-------- C:\Program Files\Trymedia
2006-12-02 15:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Prism
2006-12-02 15:24 <REP> d-------- C:\Program Files\Free
2006-12-02 15:19 <REP> d--hs---- C:\WINDOWS\ftpcache


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-15 11:05 -------- d-------- C:\Program Files\Minitel
2006-12-08 18:27 -------- d-------- C:\Program Files\eMule
2006-12-03 03:01 -------- d-------- C:\Program Files\Internet Explorer
2006-12-02 15:18 -------- d---s---- C:\Documents and Settings\Haykon\Application Data\Microsoft
2006-10-13 13:36 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 13:36 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 13:36 145920 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-09-25 17:45 666240 --a------ C:\WINDOWS\system32\aswBoot.exe
2006-09-25 17:37 90112 --a------ C:\WINDOWS\system32\AVASTSS.scr


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"WindowsRegKey update"="16winupdate32.exe"
"Microsoft Update Machine"="winupdt.exe"
"Microsoft IT Update"="IEserv.exe"
"Process Session Manager"="pidserv.exe"
"Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"WindowsRegKey update"="16winupdate32.exe"
"Microsoft Update Machine"="winupdt.exe"
"Microsoft IT Update"="IEserv.exe"
"Microsoft Update"="muamgrd.exe"
"Process Session Manager"="pidserv.exe"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN"
"MessengerPlus3"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\""
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"HP Software Update"="\"C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"WindowsRegKey update"="16winupdate32.exe"
"Microsoft Update Machine"="winupdt.exe"
"Microsoft IT Update"="IEserv.exe"
"Microsoft Update"="muamgrd.exe"
"Process Session Manager"="pidserv.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,36,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"WindowsRegKey update"="16winupdate32.exe"
"Microsoft Update Machine"="winupdt.exe"
"Microsoft Update"="muamgrd.exe"
"Process Session Manager"="pidserv.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"WindowsRegKey update"="16winupdate32.exe"
"Microsoft Update Machine"="winupdt.exe"
"Microsoft Update"="muamgrd.exe"
"Process Session Manager"="pidserv.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=hex:95,00,00,00

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\HPpromotions journeysoftware.job

Completion time: 06-12-15 22:14:41.28
C:\ComboFix.txt ... 06-12-15 22:14

et voilà le rapport de Blacklight:

12/15/06 22:20:18 [Info]: BlackLight Engine 1.0.47 initialized
12/15/06 22:20:18 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/15/06 22:20:21 [Note]: 7019 4
12/15/06 22:20:21 [Note]: 7005 0
12/15/06 22:20:30 [Note]: 7006 0
12/15/06 22:20:30 [Note]: 7011 2820
12/15/06 22:20:31 [Note]: 7026 0
12/15/06 22:20:31 [Note]: 7026 0
12/15/06 22:20:31 [Note]: 7024 3
12/15/06 22:20:31 [Info]: Hidden process: C:\windows\system32\tvkpezoyh.exe
12/15/06 22:20:31 [Note]: FSRAW library version 1.7.1020
12/15/06 22:24:08 [Info]: Hidden file: c:\WINDOWS\Prefetch\TVKPEZOYH.EXE-315C7AD1.pf
12/15/06 22:24:08 [Note]: 10002 1
12/15/06 22:24:49 [Info]: Hidden file: c:\WINDOWS\system32\tvkpezoyh.dat
12/15/06 22:24:49 [Note]: 10002 1
12/15/06 22:24:49 [Info]: Hidden file: C:\windows\system32\tvkpezoyh.exe
12/15/06 22:24:49 [Note]: 10002 1
12/15/06 22:24:50 [Info]: Hidden file: c:\WINDOWS\system32\tvkpezoyh_nav.dat
12/15/06 22:24:50 [Note]: 10002 1
12/15/06 22:24:50 [Info]: Hidden file: c:\WINDOWS\system32\tvkpezoyh_navps.dat
12/15/06 22:24:50 [Note]: 10002 1
12/15/06 22:36:49 [Note]: 7007 0