Conhook.cf difficile à déloger

Bonsoir,

Bon grosse grosse galère, j'ai réussi à isoler un Troj nommé conhook situé dans C:\Windows\system32\_c006B529.dat que bien sûr je n'arrive pas à déloger.

Alors dans l'ordre, j'ai fait un scan en ligne qui m'a trouvé plein de************
Ensuite, Vundofix qui m'en a viré certains
Puis combofix dont voici le log :


ComboFix 07-12-08.1 - Valérie POULAIN 2007-12-08 19:02:48.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.523 [GMT 1:00]
Running from: C:\Documents and Settings\Valérie POULAIN\Local Settings\Temporary Internet Files\Content.IE5\Q0S23D5F\ComboFix[1].exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\Valérie POULAIN\Application Data\installer_fr[1].exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\__c006B529.dat
C:\WINDOWS\system32\altqjiqv.dll
C:\WINDOWS\system32\aqvjndtw.dll
C:\WINDOWS\system32\bqcrdiln.dll
C:\WINDOWS\system32\bstnnmuh.dll
C:\WINDOWS\system32\cxankrul.dll
C:\WINDOWS\system32\cylsesrb.dll
C:\WINDOWS\system32\djcvnuhs.dll
C:\WINDOWS\system32\eghekbot.dll
C:\WINDOWS\system32\ehfoowqk.dll
C:\WINDOWS\system32\flxxxqml.dll
C:\WINDOWS\system32\ftejtgun.dll
C:\WINDOWS\system32\fuwoyhhk.dll
C:\WINDOWS\system32\gfarjgqp.dll
C:\WINDOWS\system32\gjefibhv.dll
C:\WINDOWS\system32\ivwmvobc.dll
C:\WINDOWS\system32\jjmrouck.dll
C:\WINDOWS\system32\jkbwward.dll
C:\WINDOWS\system32\juqluvfe.dll
C:\WINDOWS\system32\kginjijf.dll
C:\WINDOWS\system32\kqlrutkh.dll
C:\WINDOWS\system32\lgyskgbq.dll
C:\WINDOWS\system32\lmqxxxlf.ini
C:\WINDOWS\system32\lvijedkk.dll
C:\WINDOWS\system32\lvpwtiic.dll
C:\WINDOWS\system32\macnlvqh.dll
C:\WINDOWS\system32\msqysrah.dll
C:\WINDOWS\system32\myoqbmex.dll
C:\WINDOWS\system32\ncghpbqr.dll
C:\WINDOWS\system32\nilkolvb.dll
C:\WINDOWS\system32\nkdxaoxk.dll
C:\WINDOWS\system32\nugkgiot.dll
C:\WINDOWS\system32\oredwkcj.dll
C:\WINDOWS\system32\orxrsovm.dll
C:\WINDOWS\system32\oujpcnyv.dll
C:\WINDOWS\system32\pprhwkul.dll
C:\WINDOWS\system32\qbqobcjn.dll
C:\WINDOWS\system32\qkgauphf.dll
C:\WINDOWS\system32\rgcfjceo.dll
C:\WINDOWS\system32\rnonvyeu.dll
C:\WINDOWS\system32\ryblrufx.dll
C:\WINDOWS\system32\sgkifhni.dll
C:\WINDOWS\system32\tiwkmsty.dll
C:\WINDOWS\system32\tniswelq.dll
C:\WINDOWS\system32\twtufnuo.dll
C:\WINDOWS\system32\uvfyntcu.dll
C:\WINDOWS\system32\uwxcpllq.dll
C:\WINDOWS\system32\vwuknpma.dll
C:\WINDOWS\system32\xmgofcnu.dll
C:\WINDOWS\system32\xyadd.bak1
C:\WINDOWS\system32\xyadd.bak2
C:\WINDOWS\system32\xyadd.ini
C:\WINDOWS\system32\xyadd.ini2
C:\WINDOWS\system32\xyadd.tmp
C:\WINDOWS\system32\yciwkmeb.dll
C:\WINDOWS\system32\yyrivjlx.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-08 to 2007-12-08 ))))))))))))))))))))))))))))))))))))
.

2007-12-08 20:19 . 2007-12-08 20:19 <REP> dr------- C:\Documents and Settings\All Users\Application Data\SalesMonitor
2007-12-08 18:51 . 2007-12-08 18:51 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-12-08 18:50 . 2007-12-08 18:50 <REP> d-------- C:\Program Files\Alwil Software
2007-12-08 18:50 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-08 18:50 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-08 18:50 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-08 18:50 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-08 18:50 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-08 18:50 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-08 18:50 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-08 18:50 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-08 18:12 . 2007-12-08 18:56 <REP> d-------- C:\VundoFix Backups
2007-12-08 17:58 . 2007-12-08 17:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\DefenseNetSurfage
2007-12-08 17:57 . 2007-12-08 17:57 <REP> d-------- C:\WINDOWS\AU_Temp
2007-12-07 21:58 . 2007-12-08 12:30 834,188 ---hs---- C:\WINDOWS\system32\guvvoiuk.ini
2007-12-07 21:41 . 2007-12-07 21:41 834,400 ---hs---- C:\WINDOWS\system32\uyxljosc.ini
2007-12-07 21:13 . 2007-03-28 19:42 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2007-12-07 21:12 . 2007-12-07 21:16 <REP> d-------- C:\Program Files\TuneUp Utilities 2007
2007-12-07 21:11 . 2007-12-07 21:11 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-12-07 21:11 . 2007-12-07 21:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2007-12-07 20:59 . 2007-12-08 17:11 <REP> d-------- C:\WINDOWS\report
2007-12-07 20:59 . 2007-12-07 20:59 <REP> d-------- C:\WINDOWS\AU_Backup
2007-12-07 20:59 . 2007-12-07 20:59 39,917,509 --a------ C:\WINDOWS\VPTNFILE.869
2007-12-07 20:59 . 2007-12-07 20:59 1,902,547 --a------ C:\WINDOWS\tsc.ptn
2007-12-07 20:59 . 2007-12-07 20:59 1,163,344 --a------ C:\WINDOWS\vsapi32.dll
2007-12-07 20:59 . 2007-12-07 20:59 267,845 --a------ C:\WINDOWS\tsc.exe
2007-12-07 20:59 . 2007-12-07 20:59 86,094 --a------ C:\WINDOWS\BPMNT.dll
2007-12-07 20:59 . 2007-12-07 20:59 71,749 --a------ C:\WINDOWS\hcextoutput.dll
2007-12-07 20:58 . 2007-12-07 20:58 170 --a------ C:\WINDOWS\GetServer.ini
2007-12-07 20:34 . 2007-12-08 18:07 823 --a------ C:\WINDOWS\TSC.INI
2007-12-07 20:32 . 2007-12-07 20:32 <REP> d-------- C:\WINDOWS\AU_Log
2007-12-07 20:31 . 2007-12-07 20:31 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2007-12-07 20:31 . 2007-12-07 20:31 286,720 --a------ C:\WINDOWS\PATCH.EXE
2007-12-07 20:31 . 2007-12-07 20:31 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2007-12-07 20:23 . 2007-12-07 21:33 834,349 ---hs---- C:\WINDOWS\system32\yjtfdtka.ini
2007-12-07 20:22 . 2007-12-07 20:22 <REP> d-------- C:\Program Files\Trend Micro
2007-12-07 17:21 . 2007-12-07 20:17 834,160 ---hs---- C:\WINDOWS\system32\miqggnvp.ini
2007-12-07 11:29 . 2007-12-07 17:16 823,541 ---hs---- C:\WINDOWS\system32\sshaygdo.ini
2007-12-06 15:04 . 2007-12-07 11:26 797,483 ---hs---- C:\WINDOWS\system32\dnavkqio.ini
2007-12-06 14:55 . 2007-12-06 14:56 797,567 ---hs---- C:\WINDOWS\system32\wvrdqyhi.ini
2007-12-06 08:43 . 2007-12-06 14:55 797,507 ---hs---- C:\WINDOWS\system32\hhxdpwxe.ini
2007-12-05 22:57 . 2007-12-06 08:38 797,567 ---hs---- C:\WINDOWS\system32\pehgakcy.ini
2007-12-05 21:18 . 2007-12-05 22:48 797,447 ---hs---- C:\WINDOWS\system32\tbultvix.ini
2007-12-05 21:13 . 2007-12-05 21:13 807,419 ---hs---- C:\WINDOWS\system32\bpgpkrad.ini
2007-12-05 19:00 . 2007-12-05 21:13 669,112 ---hs---- C:\WINDOWS\system32\xxfgdxch.ini
2007-12-05 18:57 . 2007-12-05 18:58 668,992 ---hs---- C:\WINDOWS\system32\xcmoxegx.ini
2007-12-05 17:57 . 2007-12-05 17:58 668,932 ---hs---- C:\WINDOWS\system32\mmkaouvr.ini
2007-12-05 08:41 . 2007-12-05 17:55 669,052 ---hs---- C:\WINDOWS\system32\hemolnkb.ini
2007-12-04 08:36 . 2007-12-05 08:37 668,932 ---hs---- C:\WINDOWS\system32\kjiobhfs.ini
2007-12-03 18:20 . 2007-12-04 08:26 792,589 ---hs---- C:\WINDOWS\system32\uxyjudyl.ini
2007-12-02 20:50 . 2007-12-02 20:50 6,283 --a------ C:\WINDOWS\system32\btsbaobq.dll
2007-12-02 20:38 . 2007-12-02 20:38 <REP> d-------- C:\Program Files\Micro Application
2007-12-02 10:00 . 2007-12-03 18:10 1,153,111 ---hs---- C:\WINDOWS\system32\lefbcnmq.ini
2007-11-30 23:57 . 2007-11-30 23:57 317,616 --a------ C:\WINDOWS\system32\drivers\srtspl.sys
2007-11-30 23:57 . 2007-11-30 23:57 279,088 --a------ C:\WINDOWS\system32\drivers\srtsp.sys
2007-11-30 23:57 . 2007-11-30 23:57 43,696 --a------ C:\WINDOWS\system32\drivers\srtspx.sys
2007-11-30 23:57 . 2007-11-30 23:57 10,549 --a------ C:\WINDOWS\system32\drivers\srtspx.cat
2007-11-30 23:57 . 2007-11-30 23:57 10,549 --a------ C:\WINDOWS\system32\drivers\srtspl.cat
2007-11-30 23:57 . 2007-11-30 23:57 10,545 --a------ C:\WINDOWS\system32\drivers\srtsp.cat
2007-11-30 23:57 . 2007-11-30 23:57 1,430 --a------ C:\WINDOWS\system32\drivers\srtspl.inf
2007-11-30 23:57 . 2007-11-30 23:57 1,421 --a------ C:\WINDOWS\system32\drivers\srtspx.inf
2007-11-30 23:57 . 2007-11-30 23:57 1,415 --a------ C:\WINDOWS\system32\drivers\srtsp.inf
2007-11-30 09:42 . 2007-12-02 09:58 1,160,147 ---hs---- C:\WINDOWS\system32\mwvwvdpg.ini
2007-11-30 08:45 . 2007-11-30 08:45 1,176,938 ---hs---- C:\WINDOWS\system32\cbrmcwui.ini
2007-11-29 08:41 . 2007-11-30 08:42 1,341,551 ---hs---- C:\WINDOWS\system32\lkagbnoh.ini
2007-11-28 16:35 . 2007-11-29 08:33 667,434 ---hs---- C:\WINDOWS\system32\mvjipnxj.ini
2007-11-28 16:32 . 2007-11-28 16:32 667,314 ---hs---- C:\WINDOWS\system32\kktkspwm.ini
2007-11-28 15:32 . 2007-11-28 15:32 667,254 ---hs---- C:\WINDOWS\system32\hmechagl.ini
2007-11-28 14:29 . 2007-11-28 14:29 667,194 ---hs---- C:\WINDOWS\system32\xphrhhnp.ini
2007-11-28 14:26 . 2007-11-28 14:26 667,134 ---hs---- C:\WINDOWS\system32\xlmonxoi.ini
2007-11-28 08:51 . 2007-11-28 14:26 667,554 ---hs---- C:\WINDOWS\system32\hnlqqgoq.ini
2007-11-27 08:47 . 2007-11-28 08:48 702,600 ---hs---- C:\WINDOWS\system32\circsgmn.ini
2007-11-26 08:46 . 2007-11-27 08:47 708,632 ---hs---- C:\WINDOWS\system32\untwhbbg.ini
2007-11-25 12:31 . 2007-11-26 08:44 695,874 ---hs---- C:\WINDOWS\system32\apocdubf.ini
2007-11-24 10:35 . 2007-11-25 12:25 695,754 ---hs---- C:\WINDOWS\system32\kmapfufr.ini
2007-11-23 10:29 . 2007-11-24 10:30 749,968 ---hs---- C:\WINDOWS\system32\xksnvqba.ini
2007-11-23 09:27 . 2007-11-23 09:27 750,088 ---hs---- C:\WINDOWS\system32\oidjhenn.ini
2007-11-23 08:26 . 2007-11-23 08:26 750,028 ---hs---- C:\WINDOWS\system32\mspayxou.ini
2007-11-23 08:22 . 2007-11-23 08:22 749,968 ---hs---- C:\WINDOWS\system32\nlwmhffk.ini
2007-11-22 08:47 . 2007-11-23 08:21 719,272 ---hs---- C:\WINDOWS\system32\qnirgjlh.ini
2007-11-22 08:33 . 2007-11-22 08:33 859,602 ---hs---- C:\WINDOWS\system32\tkyijgap.ini
2007-11-21 08:45 . 2007-11-22 08:30 688,390 ---hs---- C:\WINDOWS\system32\irhdxhxo.ini
2007-11-20 09:56 . 2007-11-21 08:40 688,600 ---hs---- C:\WINDOWS\system32\vbbintkm.ini
2007-11-19 11:26 . 2007-11-20 08:39 679,055 ---hs---- C:\WINDOWS\system32\hlgqxffm.ini
2007-11-18 09:14 . 2007-11-19 11:20 678,935 ---hs---- C:\WINDOWS\system32\cfdbifyb.ini
2007-11-17 08:37 . 2007-11-18 09:09 678,100 ---hs---- C:\WINDOWS\system32\soumppcj.ini
2007-11-16 08:43 . 2007-11-17 08:28 675,949 ---hs---- C:\WINDOWS\system32\mobivqva.ini
2007-11-15 10:30 . 2007-11-16 08:35 671,316 ---hs---- C:\WINDOWS\system32\sxkapxty.ini
2007-11-15 09:45 . 2007-11-15 10:25 671,196 ---hs---- C:\WINDOWS\system32\dxvrsgop.ini
2007-11-14 09:42 . 2007-11-14 09:42 <REP> d-------- C:\HSF
2007-11-14 09:42 . 2007-11-14 09:46 0 --a------ C:\WINDOWS\WD.INI
2007-11-13 13:30 . 2007-11-15 09:42 671,256 ---hs---- C:\WINDOWS\system32\qtfcljtu.ini
2007-11-13 11:26 . 2007-11-13 11:26 658,621 ---hs---- C:\WINDOWS\system32\bexegkyx.ini
2007-11-13 09:18 . 2007-11-13 09:19 614,282 ---hs---- C:\WINDOWS\system32\upbawlqt.ini
2007-11-12 09:09 . 2007-11-12 09:09 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2007-11-11 20:31 . 2007-11-13 08:30 535,664 ---hs---- C:\WINDOWS\system32\cvvsgcha.ini
2007-11-10 13:54 . 2007-11-11 20:25 535,544 ---hs---- C:\WINDOWS\system32\mjgncigr.ini

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-08 17:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-12-08 17:58 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-12-07 20:18 --------- d-----w C:\Program Files\Wanadoo
2007-12-07 20:18 --------- d-----w C:\Program Files\Smart Panel
2007-12-07 20:18 --------- d-----w C:\Program Files\PDFCreator
2007-12-07 20:18 --------- d-----w C:\Program Files\Microsoft Works
2007-12-07 20:18 --------- d-----w C:\Program Files\LimeWire
2007-12-07 20:18 --------- d-----w C:\Program Files\Disc2Phone
2007-12-05 07:40 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-05 07:40 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-12-05 07:40 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-05 07:40 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-12-05 07:40 --------- d-----w C:\Program Files\Symantec
2007-12-02 19:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-23 07:19 --------- d-----w C:\Program Files\Norton Internet Security
2007-11-02 11:50 --------- d-----w C:\Program Files\Fichiers communs\Nettordinateur
2007-10-31 13:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logishrd
2007-10-31 13:09 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-10-31 13:09 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2007-10-31 13:08 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2007-10-31 13:07 --------- d-----w C:\Program Files\Logitech
2007-10-31 13:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2007-10-31 12:01 --------- d-----w C:\Program Files\DefenseDuDisque
2007-10-30 22:00 --------- d-----w C:\Program Files\Fichiers communs\DefenseNetSurfage
2007-10-09 06:46 --------- d-----w C:\Program Files\CCleaner
2007-10-08 09:04 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-09-13 07:43 6,440 --sh--w C:\WINDOWS\system32\kjllm.bak2
2007-09-09 14:53 23,552 ----a-w C:\WINDOWS\system32\opnoopo.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{547691FA-560B-4F7B-840F-3C1599D6CCD2}]
C:\WINDOWS\system32\ddayx.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2006-09-03 00:04]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-09-05 18:22]
"Symantec PIF AlertEng"="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 09:22]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 C:\WINDOWS\KHALMNPR.Exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 C:\WINDOWS\KHALMNPR.Exe]
"Salestart(1)"="C:\Program Files\Fichiers communs\Nettordinateur\mc.exe" [2007-10-09 15:09]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

R0 O2MDRDR;O2MDRDR;C:\WINDOWS\system32\DRIVERS\o2media.sys
R0 O2SDRDR;O2SDRDR;C:\WINDOWS\system32\DRIVERS\o2sd.sys
R0 SiSRaid2;SiSRaid2;C:\WINDOWS\system32\drivers\SiSRaid2.sys
R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys
R2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe -k netsvcs
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f451c4a9-41e1-11dc-94a6-00c0a8be533e}]
\Shell\AutoRun\command - E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f6ac3ed9-53f8-11dc-94ae-00147f049dbf}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-07 20:13:39 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-11-02 19:02:19 C:\WINDOWS\Tasks\Norton Internet Security - Analyse système complète - Valérie POULAIN.job"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\DOCUME~1\VALRIE~1\LOCALS~1\Temp\uvuuqdwr.dll
.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-08 20:20:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-08 20:21:17 - machine was rebooted
.
--- E O F ---


Eventuellement je balance aussi un log d'Hijack, si ça peut servir.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:27:02, on 08/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Nettordinateur\mc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tele2.fr/redirect/startpage/adsl/fra
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/fuji/defaults/su/*https://fr.yahoo.com/?p=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {547691FA-560B-4F7B-840F-3C1599D6CCD2} - C:\WINDOWS\system32\ddayx.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\Nettordinateur\mc.exe" dm=http://nettordinateur.com; ad=http://nettordinateur.com
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7DA181BB-EF8D-4A7E-8C53-7BFC718EF71D} (Upload Class) - http://photoservice.photos.orange.fr/migrationorange/index.cfm
O16 - DPF: {952F9A71-131A-11D5-8404-00500445A7D0} (ActiveMiniplug Class) - https://intranet.unss.org/plugins/mplugax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe