Security toolbar...

Voici le compte-rendu...

ComboFix 07-11-08.1 - BigBoss 2007-11-12 23:29:16.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.979 [GMT 1:00]
Running from: D:\Documents and Settings\BigBoss\Local Settings\Temporary Internet Files\Content.IE5\79EK17JP\ComboFix[1].exe
.

Incapable d'obtenir les privilèges Système

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\__c00A3633.dat
C:\WINDOWS\system32\awtqn.dll
.
---- Previous Run -------
.
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\__c005265F.dat
C:\WINDOWS\system32\__c0073434.dat
C:\WINDOWS\system32\__c00ED95C.dat
C:\WINDOWS\system32\~.exe
C:\WINDOWS\system32\dlbgxjfr.dll
C:\WINDOWS\system32\gnhulnqj.dll
C:\WINDOWS\system32\kmxxredo.dll
C:\WINDOWS\system32\nqtwa.bak1
C:\WINDOWS\system32\nqtwa.bak2
C:\WINDOWS\system32\nqtwa.ini
C:\WINDOWS\system32\ohpkwlpg.dll
C:\WINDOWS\system32\pxxonbmq.dll
C:\WINDOWS\system32\sysdl132.exe
C:\WINDOWS\system32\uscbmerr.dllbox
C:\WINDOWS\system32\winsys.exe
C:\WINDOWS\system32\wvusroo.dll
D:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk
D:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk
D:\Documents and Settings\BigBoss\Bureau\Live Safety Center.lnk
D:\Documents and Settings\BigBoss\Bureau\Online Security Guide.lnk
D:\Documents and Settings\BigBoss\Favoris\Online Security Guide.lnk

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService

-------\LEGACY_DOMAINSERVICE
-------\DomainService

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-12 to 2007-11-12 ))))))))))))))))))))))))))))))))))))
.

2007-11-12 23:23 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-12 22:56 3,468 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-12 22:41 <REP> d-------- C:\Program Files\Trend Micro
2007-11-12 19:04 89,664 --a------ C:\WINDOWS\system32\mmygvonm.dll
2007-11-12 19:01 81,472 --a------ C:\WINDOWS\system32\kqeefioq.dll
2007-11-12 18:58 71,232 --a------ C:\WINDOWS\system32\egcrwmte.exe
2007-11-11 16:17 79,936 --a------ C:\WINDOWS\system32\fxgeridv.dll
2007-11-11 16:14 71,232 --a------ C:\WINDOWS\system32\wfwjewxp.exe
2007-11-10 16:25 81,472 --a------ C:\WINDOWS\system32\ccgiting.dll
2007-11-10 16:16 71,232 --a------ C:\WINDOWS\system32\ebmgdchb.exe
2007-11-10 15:31 81,472 --a------ C:\WINDOWS\system32\ivwgwyhp.dll
2007-11-09 14:37 77,888 --a------ C:\WINDOWS\system32\yfttwuvh.dll
2007-11-09 14:28 71,232 --a------ C:\WINDOWS\system32\xdgkuegu.exe
2007-11-09 14:27 145,984 --a------ C:\WINDOWS\system32\uscbmerr.dll
2007-11-09 14:27 145,984 --a------ C:\WINDOWS\system32\mxixhrjr.dll
2007-11-08 22:52 0 --a------ C:\WINDOWS\ativpsrm.bin
2007-11-08 22:23 <REP> d-------- D:\Documents and Settings\BigBoss\Application Data\Earthsim
2007-11-08 22:00 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-11-08 21:59 <REP> d-------- C:\ATI
2007-10-14 22:13 <REP> d-------- C:\WINDOWS\Downloaded Installations

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-08 20:40 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-08 18:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-09 17:16 --------- d-----w D:\Documents and Settings\BigBoss\Application Data\Newsbin
2007-09-29 05:46 47,376 ----a-w C:\WINDOWS\system32\drivers\ativvpxx.vp
2007-09-29 03:05 2,456,064 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-09-29 02:19 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-09-26 21:18 --------- d-----w D:\Documents and Settings\BigBoss\Application Data\Quark
2007-09-26 21:16 --------- d-----w C:\Program Files\Quark
2007-09-25 14:29 --------- d-----w D:\Documents and Settings\All Users\Application Data\HP
2007-09-25 14:29 --------- d-----w C:\Program Files\HP
2007-09-25 14:28 --------- d-----w D:\Documents and Settings\All Users\Application Data\Sonic
2007-09-25 14:27 --------- d-----w C:\Program Files\Fichiers communs\HP
2007-09-25 14:24 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2007-09-25 14:07 --------- d-----w D:\Documents and Settings\BigBoss\Application Data\HP
2007-09-22 14:49 --------- d-----w D:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-09-15 16:58 --------- d-----w C:\Program Files\Microsoft Works
2007-09-15 15:36 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-09-15 15:35 --------- d-----w C:\Program Files\Windows Messaging
2007-09-15 15:27 --------- d-----w C:\Program Files\Google
2006-02-24 19:13 499,536 ----a-w C:\Program Files\QuickPar-0.9.1.0-FRA.exe
2006-01-19 23:09 2,661,621 ----a-w C:\Program Files\Webwiz.exe
2006-01-19 22:56 943,277 ----a-w C:\Program Files\VirtualDub-1.6.11.zip
2005-05-11 21:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-09 14:27 145984 --a------ C:\WINDOWS\system32\uscbmerr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b2d717ac-3867-420b-bd50-3e9ba842d889}]
2007-11-12 19:01 81472 --a------ C:\WINDOWS\system32\kqeefioq.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\uscbmerr.dll [2007-11-09 14:27 145984]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 17:07 C:\WINDOWS\system32\HdAShCut.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-08 16:55]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 13:25 C:\WINDOWS\RTHDCPL.EXE]
"Ulead AutoDetector v2"="C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 11:43]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 14:00]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 10:31]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-29 20:50]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 22:12]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-12 16:44]
"nwiz"="nwiz.exe" [2007-04-12 16:44 C:\WINDOWS\system32\nwiz.exe]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-12-15 03:58]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-12-15 03:58]
"WinSys2"="C:\WINDOWS\system32\winsys2.exe" [2006-12-15 03:59]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-12 16:44]
"0856fddb"="C:\WINDOWS\system32\mmygvonm.dll" [2007-11-12 19:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\uscbmerr]
uscbmerr.dll 2007-11-09 14:27 145984 C:\WINDOWS\system32\uscbmerr.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\awtqn.dll

R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
R3 genmcmnUSB;USB Scroll Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
S2 webwiz;[webwiz] - webcam via ftp - [RUELEPIC];C:\Program Files\[webwiz]\Webwizsvc.exe
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-12 23:35:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\CrystalSysInfo]
"ImagePath"="\??\C:\WINDOWS\system32\SysInfo.sys"

voici ce que j'obtiens (sans pouvoir rebooté en mode sans echec) en esperant que cela puisse faire avancer le shmillblik...

Encore merci pour ta patience.

System Report
*************

Run on 13/11/2007 at 23:17

Microsoft Windows XP [version 5.1.2600]

Current user is an administrator

Running Processes:

\SystemRoot\System32\smss.exe [588]
\??\C:\WINDOWS\system32\csrss.exe [644]
\??\C:\WINDOWS\system32\winlogon.exe [668]
C:\WINDOWS\system32\services.exe [716]
C:\WINDOWS\system32\lsass.exe [728]
C:\WINDOWS\system32\svchost.exe [912]
C:\WINDOWS\system32\svchost.exe [972]
C:\WINDOWS\System32\svchost.exe [1040]
C:\WINDOWS\system32\svchost.exe [1120]
C:\WINDOWS\system32\svchost.exe [1240]
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [1324]
C:\Program Files\Alwil Software\Avast4\ashServ.exe [1432]
C:\WINDOWS\Explorer.EXE [1580]
C:\WINDOWS\system32\spoolsv.exe [1840]
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe [208]
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe [364]
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe [476]
C:\WINDOWS\system32\nvsvc32.exe [568]
C:\WINDOWS\system32\HPZipm12.exe [416]
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe [628]
C:\WINDOWS\RTHDCPL.EXE [840]
C:\WINDOWS\system32\svchost.exe [900]
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe [1008]
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe [1032]
C:\apps\ABoard\ABoard.exe [1116]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [1160]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe [1300]
C:\apps\ABoard\AOSD.exe [1168]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [1364]
C:\WINDOWS\system32\winsys2.exe [1088]
C:\WINDOWS\system32\RUNDLL32.EXE [1880]
c:\APPS\Powercinema\Kernel\TV\CLSched.exe [1896]
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2368]
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2428]
C:\WINDOWS\System32\alg.exe [2716]
C:\Program Files\Internet Explorer\iexplore.exe [1984]

Files Created/Modified - 60 Days :

C:\

ÃS±Óë¸ HÍ!rD‹èŽÀ¹D3ÿ¾ó¤‹×Ÿ3À¾I|$‹Ùè„ü‹—+Ö&‰‹—+Ö& - 1252,
13 Nov 2007 22:44:50 53 A.... "C:\biosinfo"
12 Nov 2007 23:37:14 8 844 A.... "C:\ComboFix.txt"
21 Sep 2007 16:52:20 171 136 A.SHR "C:\grldr"
13 Nov 2007 22:43:36 1 610 141 696 A.SH. "C:\hiberfil.sys"
13 Nov 2007 22:43:36 1 610 067 968 A.SH. "C:\pagefile.sys"
12 Nov 2007 22:57:02 4 442 A.... "C:\rapport.txt"

C:\WINDOWS\

13 Nov 2007 22:44:42 0 A.... "C:\WINDOWS\0.log"
8 Nov 2007 22:52:08 0 A.... "C:\WINDOWS\ativpsrm.bin"
13 Nov 2007 22:43:42 2 048 A.S.. "C:\WINDOWS\bootstat.dat"
29 Oct 2007 18:56:20 136 192 A.... "C:\WINDOWS\catchme.exe"
8 Nov 2007 19:55:14 272 A.... "C:\WINDOWS\game.ini"
25 Sep 2007 15:32:28 90 425 A.... "C:\WINDOWS\hpoins06.dat"
26 Oct 2007 19:37:44 214 A.... "C:\WINDOWS\HP_48BitScanUpdatePatch.ini"
26 Oct 2007 19:37:58 227 A.... "C:\WINDOWS\HP_CounterReport_Update_HPSU.ini"
26 Oct 2007 19:30:40 214 A.... "C:\WINDOWS\HP_InstantSHareJPG.ini"
26 Oct 2007 19:30:14 217 A.... "C:\WINDOWS\HP_IZClosingDiscErrorPatch.ini"
26 Oct 2007 19:28:54 221 A.... "C:\WINDOWS\HP_RedboxHprblog_HPSU.ini"
1 Nov 2007 19:42:26 116 A.... "C:\WINDOWS\NeroDigital.ini"
15 Sep 2007 16:37:12 949 A.... "C:\WINDOWS\ODBC.INI"
9 Nov 2007 16:46:18 65 536 A.... "C:\WINDOWS\outlook.pst"
26 Oct 2007 19:31:04 234 A.... "C:\WINDOWS\PrnHlpLogConfig.ini"
8 Nov 2007 19:32:00 1 409 A.... "C:\WINDOWS\QTFont.for"
8 Nov 2007 19:32:00 54 156 A..H. "C:\WINDOWS\QTFont.qfn"
13 Nov 2007 22:42:10 32 534 A.... "C:\WINDOWS\SchedLgU.Txt"
9 Nov 2007 18:37:40 198 A.... "C:\WINDOWS\setupact.log"
10 Nov 2007 15:14:02 126 424 A.... "C:\WINDOWS\setupapi.log"
9 Nov 2007 18:20:16 0 A.... "C:\WINDOWS\setuperr.log"
13 Nov 2007 22:44:26 159 A.... "C:\WINDOWS\wiadebug.log"
13 Nov 2007 22:44:26 50 A.... "C:\WINDOWS\wiaservc.log"
25 Sep 2007 15:29:30 1 369 A.... "C:\WINDOWS\win.ini"
13 Nov 2007 22:44:30 1 301 013 A.... "C:\WINDOWS\WindowsUpdate.log"

C:\WINDOWS\system\

C:\WINDOWS\system32\

C:\WINDOWS\system32\drivers\

29 Sep 2007 3:19:32 49 152 A.... "C:\WINDOWS\system32\drivers\ati2erec.dll"
29 Sep 2007 4:06:00 2 456 064 A.... "C:\WINDOWS\system32\drivers\ati2mtag.sys"
29 Sep 2007 6:46:54 47 376 A.... "C:\WINDOWS\system32\drivers\ativvpxx.vp"

C:\WINDOWS\system32\dllcache\

29 Sep 2007 4:06:00 2 456 064 A.... "C:\WINDOWS\system32\dllcache\ati2mtag.sys"

C:\Program Files\

15 Sep 2007 17:58:00 266 508 A.... "C:\Program Files\Microsoft Works\wklntnts.dat"
15 Sep 2007 17:58:00 266 508 A.... "C:\Program Files\Microsoft Works\wklntsk.dat"
3 Nov 2007 15:57:28 1 031 A.... "C:\Program Files\PhotoFiltre\PhotoFiltre.ini"
26 Oct 2007 19:21:42 95 148 A.... "C:\Program Files\HP\HP Software Update\Contents.dat"
29 Sep 2007 2:05:00 46 080 A.... "C:\Program Files\InstallShield Installation Information\{9B94BE6F-7CA3-4C40-A266-62667FF746CC}\Setup.exe"
9 Nov 2007 19:29:10 166 A.... "C:\Program Files\InstallShield Installation Information\{9B94BE6F-7CA3-4C40-A266-62667FF746CC}\Setup.ini"
4 Oct 2007 8:40:40 2 236 257 ....R "C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\ISSetup.dll"
8 Nov 2007 19:43:34 316 728 A.... "C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe"
8 Nov 2007 20:05:20 2 077 A.... "C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.ini"
4 Oct 2007 8:45:00 316 728 A.... "C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\uninstall.exe"
27 Sep 2007 22:36:56 17 605 A.... "C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.ini"
26 Sep 2007 22:17:40 29 829 120 A.... "C:\Program Files\Quark\QuarkXPress 7.0\QuarkXPress Passport.exe"
3 Nov 2007 18:14:34 8 646 A.... "C:\Program Files\Shareaza\Data\Discovery.dat"
3 Nov 2007 18:14:32 526 A.... "C:\Program Files\Shareaza\Data\DownloadGroups.dat"
3 Nov 2007 18:14:34 88 995 A.... "C:\Program Files\Shareaza\Data\HostCache.dat"
3 Nov 2007 18:14:34 24 102 A.... "C:\Program Files\Shareaza\Data\Library1.dat"
3 Nov 2007 17:04:56 23 248 A.... "C:\Program Files\Shareaza\Data\Library2.dat"
3 Nov 2007 18:14:32 19 519 306 A.... "C:\Program Files\Shareaza\Data\Searches.dat"
3 Nov 2007 18:14:34 10 A.... "C:\Program Files\Shareaza\Data\Security.dat"
3 Nov 2007 17:04:56 3 036 272 A.... "C:\Program Files\Shareaza\Data\TigerTree.dat"
3 Nov 2007 18:14:34 212 A.... "C:\Program Files\Shareaza\Data\UploadQueues.dat"
15 Sep 2007 16:46:26 0 A.... "C:\Program Files\Shareaza\Incomplete\Microsoft Works 8.exe"
12 Nov 2007 22:41:08 396 288 A.... "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe"
13 Nov 2007 22:44:36 10 471 A.... "C:\Program Files\Alwil Software\Avast4\DATA\avast4.ini"
13 Nov 2007 22:43:52 391 216 A.... "C:\Program Files\Alwil Software\Avast4\DATA\clnr0.dll"
13 Nov 2007 22:43:54 284 728 A.... "C:\Program Files\Alwil Software\Avast4\DATA\dllcc0.dat"
13 Nov 2007 22:43:54 9 080 A.... "C:\Program Files\Alwil Software\Avast4\DATA\exts0.dll"
15 Sep 2007 13:07:46 90 160 A.... "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll"
13 Nov 2007 22:45:02 1 312 A.... "C:\Program Files\Alwil Software\Avast4\Setup\setup.ini"
16 Sep 2007 13:51:56 16 384 A.... "C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalcat.dat"
26 Oct 2007 19:38:00 241 664 A.... "C:\Program Files\HP\Digital Imaging\bin\hpqmif08.dll"
26 Oct 2007 19:28:54 233 472 A.... "C:\Program Files\HP\Digital Imaging\bin\hpqrif08.dll"
26 Oct 2007 19:32:42 69 632 A.... "C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprbeh.dll"
28 Sep 2007 21:05:00 28 529 A.... "C:\Program Files\Fichiers communs\InstallShield\engine\6\Intel 32\corecomp.ini"
30 Oct 2007 23:14:02 16 554 A.... "C:\Program Files\HP\Digital Imaging\hp photosmart 2570 series\1190730565\Data\1190730565.ini"
12 Nov 2007 19:53:26 14 263 A.... "C:\Program Files\HP\Digital Imaging\hp photosmart 2570 series\1190730565\Data\ScanTo.ini"

Files with hidden attributes:

Fri 17 Aug 2007 440 ...H. --- "C:\Boot.BAK"
Tue 13 Nov 2007 20,640 ..SH. --- "C:\WINDOWS\system32\uscbmerr.dllbox"
Tue 31 May 2005 106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"

Program Folders:

C:\Program Files\

Adesign
Adobe
ahead
Alwil Software
Apple Software Update
AVI MPEG RM WMV Joiner
Catalencoder
CCleaner
CFWebAdvancedU
ComPlus Applications
CyberLink
DAEMON Tools
DivX
DVD Shrink
Everest Poker
Fichiers communs
Free Audio Pack
Free.fr
GMixon
Google
GrabIt
Hewlett-Packard
HP
hp deskjet 970c series
Illustrate
InstallShield Installation Information
Internet Explorer
Java
K-Lite Codec Pack
Lavasoft
Media Player Classic
Messenger
Microsoft ActiveSync
microsoft frontpage
Microsoft Games
Microsoft Office
Microsoft Works
Movie Maker
MSN
MSN Gaming Zone
MSN Messenger
MSXML 4.0
NetMeeting
Nikon
Online Services
Outlook Express
Partition Magic 8 fr
PhotoFiltre
Photoshop5.5
Quark
QuickPar
QuickTime
Real
Realtek
Services en ligne
Shareaza
Sharp Corporation
SlySoft
Smart Projects
Sonic
Spybot - Search & Destroy
Stellarium
Trend Micro
Tronics
TwinTouch LuxeMate
Ulead Systems
Uninstall Information
VideoLAN
Viewpoint
Virtools Web Player 2.0
VirtualDJ
VirtualDub-1.6.11
vso
Winace
Windows Media Components
Windows Media Connect 2
Windows Media Player
Windows Messaging
Windows NT
WindowsUpdate
WinRAR
WinZip
xerox
X'nStop 2.5
Yahoo!

C:\Program Files\Fichiers communs\

Adobe
Ahead
AOL
aolshare
BOONTY Shared
Designer
Hewlett-Packard
HP
InstallShield
Java
Microsoft Shared
MSSoap
Nullsoft
ODBC
Real
Services
Sonic Shared
SpeechEngines
SureThing Shared
Symantec Shared
System
Ulead Systems
xing shared

Add/Remove Programs:

Ad-Aware SE Personal
Adobe Flash Player Plugin
ATI Display Driver
avast! Antivirus
AVI/MPEG/RM/WMV Joiner 4.82
Canon S750
Catalencodec Pack
Catalencoder
CCleaner (remove only)
CamfrogWEB Advanced ActiveX Plugin (remove only)
DivX Pro Codec Adware
DivX Player
Everest Poker (Remove Only)
Free Mp3 Wma Converter V 1.4.0
Free - Kit de connexion
GrabIt 1.6.2 Beta (build 940)
HijackThis 2.0.2
hp deskjet 970c series (Supprimer uniquement)
hp deskjet 970c series
HP Document Viewer 5.3
HP Imaging Device Functions 5.3
HP Image Zone 5.3
HP Solution Center & Imaging Support Tools 5.3
HP Extended Capabilities 5.3
PowerQuest PartitionMagic 8.0
Call of Duty(R) 4 - Modern Warfare(TM)
IsoBuster 1.9
Correctif Windows XP - KB873333
Correctif Windows XP - KB873339
Correctif Windows XP - KB885250
Correctif Windows XP - KB885835
Correctif Windows XP - KB885836
Correctif Windows XP - KB886185
Correctif Windows XP - KB887472
High Definition Audio Driver Package - KB888111
Correctif Windows XP - KB888113
Correctif Windows XP - KB888302
Correctif Windows XP - KB890047
Correctif Windows XP - KB890175
Correctif Windows XP - KB890859
Correctif Windows XP - KB890923
Correctif Windows XP - KB891781
Correctif Windows XP - KB893066
Correctif Windows XP - KB893086
Windows Installer 3.1 (KB893803)
Security Update pour Microsoft .NET Framework 2.0 (KB928365)
TwinTouch LuxeMate
Language pack for Ad-Aware SE
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
MSN
Nero Suite
NVIDIA Drivers
PhotoFiltre
Pierresoft Adesign 1.5
QuickPar 0.9
Microsoft Rise Of Nations
Shareaza version 2.2.1.0
Shockwave
Adobe Flash Player 9 ActiveX
Spybot - Search & Destroy 1.4
Stellarium 0.8.0
Virtual DJ - Atomix Productions
Windows Genuine Advantage Validation Tool
Windows Genuine Advantage Notifications (KB905474)
Windows Media Format 11 runtime
Lecteur Windows Media 11
WinZip
X'nStop 2.5
MSXML4 Parser
PhotoGallery
CP_Package_Variety1
Destinations
Panneau de contrôle ATI
HP Software Update
DocumentViewer
CP_Package_Variety3
Sonic MyDVD
Sonic_PrimoSDK
CP_Panorama1Config
Unload
TrayApp
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
Java(TM) SE Runtime Environment 6 Update 1
Java(TM) 6 Update 2
InstantShareDevices
CP_CalendarTemplates1
MSXML 4.0 SP2 (KB927978)
HP PSC & OfficeJet 5.3.A
2570_Help
ProductContextNPI
FullDPAppQFolder
QuickTime
Microsoft Works 2000
NewCopy_CDA
RandMap
WebReg
CP_Package_Basic1
MarketResearch
DeviceFunctionQFolder
SkinsHP1
eSupportQFolder
DocProc
PartitionMagic
CustomerResearchQFolder
Microsoft .NET Framework 2.0
DocumentViewerQFolder
Macromedia Shockwave Player
CP_AtenaShokunin1Config
JourneySoftwarePromo
Microsoft Office XP Professional with FrontPage
Readme
Sonic RecordNow!
Microsoft .NET Framework 1.1 French Language Pack
ScannerCopy
QuarkXPress 7.0
CueTour
MSNdecrypter 2.0
2570
DeviceManagementQFolder
Adobe Reader 7.0 - Français
AiO_Scan_CDA
PanoStandAlone
Fax_CDA
AiOSoftwareNPI
DivX Web Player
CP_Package_Variety2
BufferChm
Tom Clancy's Splinter Cell Chaos Theory
ConvertXtoDVD 2.0.9b
MSXML 4.0 SP2 (KB936181)
Scan
Microsoft .NET Framework 1.1
Colin McRae Rally 2005
DivX Content Uploader
Codeur Windows Media Série 9
HPProductAssistant
Call of Duty(R) 4 - Modern Warfare(TM)
SolutionCenter
2570Trb
Realtek High Definition Audio Driver
Status
Windows Live Messenger
Windows Live Sign-in Assistant
SparkAngels

Run Values:

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"High Definition Audio Property Page Shortcut"="HDAShCut.exe"
"AzMixerSel"="C:\\Program Files\\Realtek\\InstallShield\\AzMixerSel.exe"
"RTHDCPL"="RTHDCPL.EXE"
"Ulead AutoDetector v2"="C:\\Program Files\\Fichiers communs\\Ulead Systems\\AutoDetector\\monitor.exe"
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32\""
"ACTIVBOARD"="c:\\apps\\ABoard\\ABoard.exe"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb04.exe"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"SW20"="C:\\WINDOWS\\system32\\sw20.exe"
"SW24"="C:\\WINDOWS\\system32\\sw24.exe"
"WinSys2"="C:\\WINDOWS\\system32\\winsys2.exe"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"0856fddb"="rundll32.exe \"C:\\WINDOWS\\system32\\mmygvonm.dll\",b"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

Bot Check:

SERVICE_NAME: wscsvc
DISPLAY_NAME : Centre de sécurité
START_TYPE : 2 AUTO_START

SERVICE_NAME: sharedaccess
DISPLAY_NAME : Pare-feu Windows / Partage de connexion Internet
START_TYPE : 2 AUTO_START

SERVICE_NAME: wuauserv
DISPLAY_NAME : Mises à jour automatiques
START_TYPE : 2 AUTO_START

SERVICE_NAME: srservice
DISPLAY_NAME : Service de restauration système
START_TYPE : 2 AUTO_START

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"EnableDCOM"="Y"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"restrictanonymous"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"AUOptions"=dword:00000004

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
"WaitToKillServiceTimeout"="20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"SFCDisable"=dword:00000000
"Shell"="Explorer.exe"
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shell extensions]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters]
"TransportBindName"="\\Device\\"

ShellExecuteHooks:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

Environment:

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\environment
ComSpec REG_EXPAND_SZ %SystemRoot%\system32\cmd.exe
Path REG_EXPAND_SZ %systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\ATI Technologies\ATI Control Panel;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\PROGRA~1\FICHIE~1\SONICS~1\;C:\Program Files\QuickTime\QTSystem
windir REG_EXPAND_SZ %SystemRoot%
OS REG_SZ Windows_NT
PATHEXT REG_SZ .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
TEMP REG_EXPAND_SZ %SystemRoot%\TEMP
TMP REG_EXPAND_SZ %SystemRoot%\TEMP
CLASSPATH REG_SZ .;C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
QTJAVA REG_SZ C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip

SecurityProviders:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders
SecurityProviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

Authentication Packages:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Authentication Packages REG_MULTI_SZ msv1_0\0C:\WINDOWS\system32\awtqn.dll\0\0

Non-Default IFEO Debugger:

Non-Default Installed Components:

Non-Default Safeboot Minimal:

File Associations:

[HKEY_CLASSES_ROOT\batfile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\cmdfile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\comfile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\htafile\shell\open\command]
@="C:\\WINDOWS\\system32\\mshta.exe \"%1\" %*"

[HKEY_CLASSES_ROOT\http\shell\open\command]
@="\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" -nohome"

[HKEY_CLASSES_ROOT\https\shell\open\command]
@="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" -nohome"

[HKEY_CLASSES_ROOT\htmlfile\shell\open\command]
@="\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" -nohome"

[HKEY_CLASSES_ROOT\regedit\shell\open\command]
@="regedit.exe %1"

[HKEY_CLASSES_ROOT\regfile\shell\open\command]
@="regedit.exe \"%1\""

[HKEY_CLASSES_ROOT\scrfile\shell\open\command]
@="\"%1\" /S"

[HKEY_CLASSES_ROOT\txtfile\shell\open\command]
@="%SystemRoot%\system32\NOTEPAD.EXE %1"

Finished!

__________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:21:36, on 13/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\winsys2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/wdgt3/*https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/wdgt3/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/wdgt3/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=32153&locale=40c&geoid=54&version=10.0.0.3646&userlocale=40c
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\uscbmerr.dll
O2 - BHO: {988d248a-b9e3-05db-b024-7683ca717d2b} - {b2d717ac-3867-420b-bd50-3e9ba842d889} - C:\WINDOWS\system32\kqeefioq.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\uscbmerr.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [0856fddb] rundll32.exe "C:\WINDOWS\system32\mmygvonm.dll",b
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/2.0.1.14/cfweb_activex.camfrogweb.com-advanced-2.0.1.14_instmodule.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/2.0.0.33/player.virtools.com/downloads/player/Install2.0/Installer.exe
O20 - Winlogon Notify: uscbmerr - C:\WINDOWS\SYSTEM32\uscbmerr.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: [webwiz] - webcam via ftp - [RUELEPIC] (webwiz) - Unknown owner - C:\Program Files\[webwiz]\Webwizsvc.exe (file missing)

Salut,

il n'y a aucune évolution pour le moment...patience,patience!
ci-joint le rapport:

SmitFraudFix v2.253

Rapport fait à 18:51:14,12, 14/11/2007
Executé à partir de D:\Documents and Settings\BigBoss\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\winsys2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» D:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» D:\Documents and Settings\BigBoss

»»»»»»»»»»»»»»»»»»»»»»»» D:\Documents and Settings\BigBoss\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» D:\DOCUME~1\BigBoss\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.54.252
DNS Server Search Order: 212.27.53.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{994F809F-8295-430B-A8E0-E64DA40144CF}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{994F809F-8295-430B-A8E0-E64DA40144CF}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{994F809F-8295-430B-A8E0-E64DA40144CF}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Re...
j'ai réussi à booter en mode sans échec sous xp
il fallait que je change certains paramètres de vista pour cela: Poste de travail/propriétés/avancé/paramarétres démarrage et récupération puis choisir xp comme systéme d'expoitation...

Aussi,j'ai donc relancé SmitfraudFix mais pas d'amélioration.
voici le rapport:

SmitFraudFix v2.253

Rapport fait à 21:19:54,12, 14/11/2007
Executé à partir de D:\Documents and Settings\BigBoss\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» D:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» D:\Documents and Settings\BigBoss

»»»»»»»»»»»»»»»»»»»»»»»» D:\Documents and Settings\BigBoss\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» D:\DOCUME~1\BigBoss\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{994F809F-8295-430B-A8E0-E64DA40144CF}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{994F809F-8295-430B-A8E0-E64DA40144CF}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{994F809F-8295-430B-A8E0-E64DA40144CF}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Il semble que sécurity toolbar est disparu...
dois-je te faire la bise ou est-ce prématuré car une autre démarche doit suivre...?

en attendant voici le rapport combifix:

ComboFix 07-11-08.1 - BigBoss 2007-11-14 22:08:08.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1050 [GMT 1:00]
Running from: D:\Documents and Settings\BigBoss\Bureau\ComboFix.exe
Command switches used :: D:\Documents and Settings\BigBoss\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\ccgiting.dll
C:\WINDOWS\system32\ebmgdchb.exe
C:\WINDOWS\system32\egcrwmte.exe
C:\WINDOWS\system32\fxgeridv.dll
C:\WINDOWS\system32\ivwgwyhp.dll
C:\WINDOWS\system32\kqeefioq.dll
C:\WINDOWS\system32\mmygvonm.dll
C:\WINDOWS\system32\mxixhrjr.dll
C:\WINDOWS\system32\uscbmerr.dll
C:\WINDOWS\system32\wfwjewxp.exe
C:\WINDOWS\system32\xdgkuegu.exe
C:\WINDOWS\system32\yfttwuvh.dll
.

Incapable d'obtenir les privilèges Système

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\ccgiting.dll
C:\WINDOWS\system32\ebmgdchb.exe
C:\WINDOWS\system32\egcrwmte.exe
C:\WINDOWS\system32\fxgeridv.dll
C:\WINDOWS\system32\ivwgwyhp.dll
C:\WINDOWS\system32\kqeefioq.dll
C:\WINDOWS\system32\mmygvonm.dll
C:\WINDOWS\system32\mxixhrjr.dll
C:\WINDOWS\system32\uscbmerr.dll
C:\WINDOWS\system32\uscbmerr.dllbox
C:\WINDOWS\system32\wfwjewxp.exe
C:\WINDOWS\system32\xdgkuegu.exe
C:\WINDOWS\system32\yfttwuvh.dll
D:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk
D:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk
D:\Documents and Settings\BigBoss\Bureau\Live Safety Center.lnk
D:\Documents and Settings\BigBoss\Bureau\Online Security Guide.lnk
D:\Documents and Settings\BigBoss\Favoris\Online Security Guide.lnk

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-14 to 2007-11-14 ))))))))))))))))))))))))))))))))))))
.

2007-11-12 23:23 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-12 22:56 3,614 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-12 22:41 <REP> d-------- C:\Program Files\Trend Micro
2007-11-08 22:52 0 --a------ C:\WINDOWS\ativpsrm.bin
2007-11-08 22:23 <REP> d-------- D:\Documents and Settings\BigBoss\Application Data\Earthsim
2007-11-08 22:00 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-11-08 21:59 <REP> d-------- C:\ATI
2007-10-14 22:13 <REP> d-------- C:\WINDOWS\Downloaded Installations

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-08 20:40 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-08 18:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-09 17:16 --------- d-----w D:\Documents and Settings\BigBoss\Application Data\Newsbin
2007-09-29 05:46 47,376 ----a-w C:\WINDOWS\system32\drivers\ativvpxx.vp
2007-09-29 03:05 2,456,064 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-09-29 02:19 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-09-26 21:18 --------- d-----w D:\Documents and Settings\BigBoss\Application Data\Quark
2007-09-26 21:16 --------- d-----w C:\Program Files\Quark
2007-09-25 14:29 --------- d-----w D:\Documents and Settings\All Users\Application Data\HP
2007-09-25 14:29 --------- d-----w C:\Program Files\HP
2007-09-25 14:28 --------- d-----w D:\Documents and Settings\All Users\Application Data\Sonic
2007-09-25 14:27 --------- d-----w C:\Program Files\Fichiers communs\HP
2007-09-25 14:24 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2007-09-25 14:07 --------- d-----w D:\Documents and Settings\BigBoss\Application Data\HP
2007-09-22 14:49 --------- d-----w D:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-09-15 16:58 --------- d-----w C:\Program Files\Microsoft Works
2007-09-15 15:36 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-09-15 15:35 --------- d-----w C:\Program Files\Windows Messaging
2007-09-15 15:27 --------- d-----w C:\Program Files\Google
2006-02-24 19:13 499,536 ----a-w C:\Program Files\QuickPar-0.9.1.0-FRA.exe
2006-01-19 23:09 2,661,621 ----a-w C:\Program Files\Webwiz.exe
2006-01-19 22:56 943,277 ----a-w C:\Program Files\VirtualDub-1.6.11.zip
2005-05-11 21:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((( snapshot@2007-11-12_23.36.11.65 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-12-19 21:49:47 8,509,952 ------w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2007-10-25 16:56:24 8,510,976 ------w C:\WINDOWS\system32\dllcache\shell32.dll
- 2007-09-28 05:19:39 18,089,592 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2007-11-02 07:12:57 18,238,072 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2007-11-14 21:11:54 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_504.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 17:07 C:\WINDOWS\system32\HdAShCut.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-08 16:55]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 13:25 C:\WINDOWS\RTHDCPL.EXE]
"Ulead AutoDetector v2"="C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 11:43]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 14:00]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 10:31]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-29 20:50]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 22:12]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-12 16:44]
"nwiz"="nwiz.exe" [2007-04-12 16:44 C:\WINDOWS\system32\nwiz.exe]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-12-15 03:58]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-12-15 03:58]
"WinSys2"="C:\WINDOWS\system32\winsys2.exe" [2006-12-15 03:59]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-12 16:44]
"0856fddb"="C:\WINDOWS\system32\mmygvonm.dll" []
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-11-22 22:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\uscbmerr]
uscbmerr.dll

R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
R3 genmcmnUSB;USB Scroll Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
S2 webwiz;[webwiz] - webcam via ftp - [RUELEPIC];C:\Program Files\[webwiz]\Webwizsvc.exe
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-14 22:12:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\CrystalSysInfo]
"ImagePath"="\??\C:\WINDOWS\system32\SysInfo.sys"

Hello,

voici les différents rapports des processus efféctués (moi qui croyait être vacciné...!lol!),
en attendant la suite de tes recommandations,je t'en remercie par avance:

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 23:16:09 14/11/2007

+ Résultat de l'analyse:

C:\Program Files\Everest Poker\Everest Poker.exe -> Adware.Casino : Ignoré.
C:\Program Files\Everest Poker\cstart.exe -> Adware.Casino : Ignoré.
D:\Mes images\Website\Screensaver\Matrix screensaver\matrix2.zip/Matrix Code Emulator.scr -> Backdoor.BackAttack.15 : Nettoyé.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@2o7[2].txt -> TrackingCookie.2o7 : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@divx.112.2o7[1].txt -> TrackingCookie.2o7 : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@fnac.112.2o7[1].txt -> TrackingCookie.2o7 : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@sfr.122.2o7[1].txt -> TrackingCookie.2o7 : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@adbrite[1].txt -> TrackingCookie.Adbrite : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@ads.adbrite[1].txt -> TrackingCookie.Adbrite : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@adtech[2].txt -> TrackingCookie.Adtech : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@atdmt[2].txt -> TrackingCookie.Atdmt : Ignoré.
D:\Documents and Settings\BigBoss\Cookies\bigboss@bluestreak[1].txt -> TrackingCookie.Bluestreak : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@bluestreak[2].txt -> TrackingCookie.Bluestreak : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@vip2.clickzs[2].txt -> TrackingCookie.Clickzs : Ignoré.
D:\Documents and Settings\BigBoss\Cookies\bigboss@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@mediaplex[1].txt -> TrackingCookie.Mediaplex : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@overture[2].txt -> TrackingCookie.Overture : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@smartadserver[2].txt -> TrackingCookie.Smartadserver : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Ignoré.
:mozilla.26:P:\Users\Big Boss\AppData\Roaming\Mozilla\Firefox\Profiles\gela6y7e.default\cookies.txt -> TrackingCookie.Weborama : Ignoré.
:mozilla.27:P:\Users\Big Boss\AppData\Roaming\Mozilla\Firefox\Profiles\gela6y7e.default\cookies.txt -> TrackingCookie.Weborama : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@weborama[2].txt -> TrackingCookie.Weborama : Ignoré.
P:\Users\Big Boss\AppData\Roaming\Microsoft\Windows\Cookies\big_boss@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Ignoré.

Fin du rapport

____________________________
BitDefender Online Scanner - Real Time Virus Report

Generated at: Thu, Nov 15, 2007 - 21:37:51

--------------------------------------------------------------------------------

Scan Info

Scanned Files
548370

Infected Files
39

Virus Detected

Trojan.Fotomoto.F
8

Trojan.Agent.AFTJ
3

Trojan.Downloader.Conhook.BI
14

Trojan.Vundo.DQE
2

Win32.Virtob.2.Gen
11

Win32.Virtob.4.Gen
1

--------------------------------------------------------------------------------

This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world.

_____________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:40:10, on 15/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\apps\ABoard\ABoard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\winsys2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=32153&locale=40c&geoid=54&version=10.0.0.3646&userlocale=40c
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/2.0.1.14/cfweb_activex.camfrogweb.com-advanced-2.0.1.14_instmodule.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/2.0.0.33/player.virtools.com/downloads/player/Install2.0/Installer.exe
O20 - Winlogon Notify: uscbmerr - uscbmerr.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: [webwiz] - webcam via ftp - [RUELEPIC] (webwiz) - Unknown owner - C:\Program Files\[webwiz]\Webwizsvc.exe (file missing)

Bonjour Green Day,

peux-tu me dire si les résultats sont positifs conçernant les scans et dans ce cas si je peux clore ce problème comme résolu ou
si d'autres process sont nécessaires?
Merci par avance
;)

@bussinos messages ce sont croisés ! :)

@bussioui, lol!
j'effectue la manip et t'envoie le rapport...
wait and see!
;)

@green dayvoici le rapport navilogmais j'ai l'impression d'avoir omis une étape...(con je suis!):

Search Navipromo version 3.3.6 commencé le 16/11/2007 à 16:01:32,67

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 14.11.2007 à 18h00 par IL-MAFIOSO

Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180

*** Recherche Programmes installés ***

*** Recherche dossiers dans C:\WINDOWS ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans D:\Documents and Settings\All Users\Application Data ***

*** Recherche dossiers dans D:\Documents and Settings\BigBoss\Application Data ***

*** Recherche dossiers dans ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
-

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans *

gnc.exe absent, Recherche non effectué dans !

*** Recherche fichiers ***

*** Recherche clés spécifiques dans le Registre ***

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

2)Recherche Heuristique :

3)Recherche Certificats :

Certificat Egroup absent !

*** Analyse terminée le 16/11/2007 à 16:05:54,35 ***

et suite à l'analyse AVG,j'ai bien éffacé tout ce qu'il avait trouvé...

Merci pour ton aide (efficace!!!) et reçois ma reconnaissance éternelle
(j'en fais peut-être un peu trop là...!).

Dois-je faire un post pour indiquer que le problème est résolu?

Merci et bon week-end!

++