Infecté par virus

Bonsoir a tous,

J'ai été infecté par un cheval de troie et mon antivirus n'arrive pas à le supprimer.
Voice le scan de Hijackthis et de combofax.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:11:00, on 18/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched .exe
C:\Program Files\MSN Messenger\msnmsgr .exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication .exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F3 - REG:win.ini: load=C:\WINDOWS\system32\awvvw.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4F0A5D63-EFA7-4F98-8838-374117428EF8} - C:\Program Files\WindowsUpdate\mevoxC:\WINDOWS\system32\rey2\perpre83122.exe.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: {24504d4a-3139-2aea-bdf4-8214d9f3f45a} - {a54f3f9d-4128-4fdb-aea2-9313a4d40542} - C:\WINDOWS\system32\mbdxoiug.dll
O2 - BHO: (no name) - {A74F3FC3-CC9A-4D4C-AFB5-B56F0CAA445D} - C:\WINDOWS\system32\awtsrss.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [6012347d] rundll32.exe "C:\WINDOWS\system32\xxdcyoft.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [VoipDiscount] "C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe" -nosplash -minimized
O4 - HKCU\..\Run: [bmamylader] c:\documents and settings\administrateur\local settings\application data\bmamylader.exe bmamylader
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O20 - Winlogon Notify: awtsrss - awtsrss.dll (file missing)
O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\xgjmspwr.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 7726 bytes

ComboFix 08-01-18.5 - Administrateur 2008-01-18 19:14:26.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1050 [GMT 1:00]
Running from: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\Documents and Settings\Administrateur\Local Settings\Application Data\bmamylader.dat
c:\documents and settings\administrateur\local settings\application data\bmamylader.exe
c:\Documents and Settings\Administrateur\Local Settings\Application Data\bmamylader_nav.dat
C:\Documents and Settings\Administrateur\Local Settings\Application Data\bmamylader_navps.dat
C:\Documents and Settings\All Users\Bureau\webmediaplayer.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes.\WebMediaPlayer
C:\Documents and Settings\All Users\Menu Démarrer\Programmes.\WebMediaPlayer\Conditions générales.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes.\WebMediaPlayer\Confidentialité.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes.\WebMediaPlayer\WebMediaPlayer.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes.\WebMediaPlayer\Website.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Conditions générales.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Confidentialité.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\WebMediaPlayer.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Website.lnk
C:\Program Files\Alwil Software\Avast4\ashDisp .exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched .exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr .exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication .exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe
C:\Program Files\webmediaplayer
C:\Program Files\webmediaplayer\Conditions générales.url
C:\Program Files\webmediaplayer\Confidentialité.url
C:\Program Files\webmediaplayer\resources\languages_v2.xml
C:\Program Files\webmediaplayer\resources\webmedias
C:\Program Files\webmediaplayer\skins\classic.skn
C:\Program Files\webmediaplayer\sqlite3.dll
C:\Program Files\webmediaplayer\uninst.exe
C:\Program Files\webmediaplayer\WebMediaPlayer.exe
C:\Program Files\webmediaplayer\Website.url
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\autorun.inf
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\ciphlnxw.dll
C:\WINDOWS\system32\dfygvkaq.ini
C:\WINDOWS\system32\fxvwqxpj.dll
C:\WINDOWS\system32\gojftfbh.dll
C:\WINDOWS\system32\jpxqwvxf.ini
C:\WINDOWS\system32\mbdxoiug.dll
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\qakvgyfd.dll
C:\WINDOWS\system32\qtbosakr.ini
C:\WINDOWS\system32\ref1
C:\WINDOWS\system32\sdmfqwcu.dll
C:\WINDOWS\system32\tfoycdxx.ini
C:\WINDOWS\system32\ucwqfmds.ini
C:\WINDOWS\system32\wvvwa.ini
C:\WINDOWS\system32\wvvwa.ini2
C:\WINDOWS\system32\wwgtyhuf.dll
C:\WINDOWS\system32\xxdcyoft.dll
C:\WINDOWS\system32\ymbojdxa.dll

[code] <pre>
C:\Program Files\Alwil Software\Avast4\ashDisp .exe ---> QooBox
C:\Program Files\Fichiers communs\Real\Update_OB\realsched .exe ---> QooBox
C:\Program Files\MSN Messenger\msnmsgr .exe ---> QooBox
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication .exe ---> QooBox
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe ---> QooBox
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe ---> QooBox
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe ---> YahooMessenger.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe ---> YahooMessenger.exe
</pre> [/code]
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-18 to 2008-01-18 ))))))))))))))))))))))))))))))))))))
.

2008-01-18 19:13 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-18 19:10 . 2008-01-18 19:10 <REP> d-------- C:\Program Files\Trend Micro
2008-01-15 23:11 . 2008-01-15 23:11 <REP> d-------- C:\WINDOWS\system32\NtmsData
2008-01-05 21:23 . 2008-01-05 21:23 11,526 --a------ C:\WINDOWS\system32\lewfnjvo.dll
2008-01-04 20:51 . 2008-01-04 20:51 11,497 --a------ C:\WINDOWS\system32\ccfdnqga.dll
2008-01-04 20:20 . 2008-01-04 20:20 11,522 --a------ C:\WINDOWS\system32\ojcckwhi.dll
2007-12-27 21:25 . 2007-12-27 21:25 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\DAEMON Tools
2007-12-22 17:07 . 2008-01-11 23:30 155,648 --a------ C:\WINDOWS\system32\igfxtray .exe
2007-12-22 17:07 . 2008-01-11 23:30 126,976 --a------ C:\WINDOWS\system32\hkcmd .exe
2007-12-21 23:48 . 2007-12-21 23:48 <REP> d-------- C:\WINDOWS\system32\twdr
2007-12-21 23:48 . 2007-12-21 23:48 <REP> d-------- C:\WINDOWS\system32\rey2
2007-12-21 23:48 . 2007-12-21 23:48 <REP> d-------- C:\WINDOWS\system32\ardCo01
2007-12-21 23:48 . 2007-12-21 23:48 <REP> d-------- C:\temp\cEeer12
2007-12-21 23:48 . 2007-12-21 23:48 224,810 --a------ C:\temp\iniag2101.exe
2007-12-19 21:18 . 2007-12-19 21:18 <REP> d-------- C:\WINDOWS\MaxTV
2007-12-19 21:18 . 2007-12-22 23:04 <REP> d-------- C:\Program Files\MaxTV
2007-12-19 19:22 . 2007-12-19 19:22 <REP> d-------- C:\Program Files\VoipDiscount.com

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-18 18:16 --------- d-----w C:\Program Files\MSN Messenger
2008-01-14 21:22 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Azureus
2008-01-13 18:14 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\uTorrent
2008-01-09 21:43 --------- d-----w C:\Program Files\DivX
2007-12-27 20:18 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-12-27 18:22 --------- d-----w C:\Program Files\Neuf
2007-12-21 21:17 --------- d-----w C:\Program Files\Azureus
2007-12-04 23:09 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Nokia Multimedia Player
2007-12-04 21:57 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Datalayer
2007-12-04 21:56 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\PC Suite
2007-12-04 21:51 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Nokia
2007-12-04 21:47 --------- d-----w C:\Program Files\Nokia
2007-12-04 21:47 --------- d-----w C:\Program Files\Fichiers communs\PCSuite
2007-12-04 21:47 --------- d-----w C:\Program Files\Fichiers communs\Nokia
2007-12-04 21:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite
2007-12-04 21:46 --------- d-----w C:\Program Files\PC Connectivity Solution
2007-12-04 21:46 --------- d-----w C:\Program Files\DIFX
2007-12-04 21:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-22 22:02 --------- d-----w C:\Program Files\VirtualDJ
2007-11-18 14:05 --------- d-----w C:\Program Files\DaemonTools_WhenUSave_Installer
2007-11-18 13:40 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\S.A.D
2007-11-02 21:02 166,806 -c--a-w C:\WINDOWS\uninstall Soleil.exe
2007-11-02 21:02 1,091,823 -c--a-w C:\WINDOWS\Soleil.scr
.
[code]<pre>
----a-w 39,792 2008-01-11 22:30:43 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
----a-w 132,496 2008-01-02 18:08:14 C:\Program Files\Java\jre1.6.0_02\bin\jusched .exe
----a-w 181,752 2007-12-24 19:53:01 C:\Program Files\Neuf\Kit\WiFi\9wifi .exe
----a-w 181,752 2008-01-11 22:33:11 C:\Program Files\Neuf\Kit\WiFi\9wifi .exe
----a-w 708,698 2008-01-11 22:30:49 C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
----a-w 102,490 2007-12-26 00:07:09 C:\Program Files\Synaptics\SynTP\SynTPLpr .exe
----a-w 126,976 2008-01-11 22:30:40 C:\WINDOWS\system32\hkcmd .exe
----a-w 155,648 2008-01-11 22:30:40 C:\WINDOWS\system32\igfxtray .exe
</pre>[/code]

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F0A5D63-EFA7-4F98-8838-374117428EF8}]
C:\Program Files\WindowsUpdate\mevoxC:\WINDOWS\system32\rey2\perpre83122.exe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe" [ ]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]
"VoipDiscount"="C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount .exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06 79224]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [ ]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [ ]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [ ]
"SoundMan"="SOUNDMAN.EXE" [2005-04-15 10:01 77824 C:\WINDOWS\SOUNDMAN.EXE]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [ ]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [ ]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 03:54 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2004-08-04 03:54 101888 C:\WINDOWS\system32\advpack.dll]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 14:52 44544]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"ForceStartMenuLogoff"= 0 (0x0)
"NoUserNameInStartMenu"= 1 (0x1)
"NoStartMenuPinnedList"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"StartMenuLogoff"= 1 (0x1)
"ForceStartMenuLogoff"= 0 (0x0)
"NoUserNameInStartMenu"= 1 (0x1)
"NoStartMenuPinnedList"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtsrss]
awtsrss.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2001-07-09 09:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2005-04-15 10:01 77824 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-04 03:54]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 02:13]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 02:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b65ba2b0-a00d-11dc-ad12-0014a47a45b8}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-09 12:58:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-18 19:20:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]
-> C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\DockShellHook.dll
.
Completion time: 2008-01-18 19:22:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-18 18:22:03
.
2007-10-01 21:28:05 --- E O F ---

Configuration: Windows XP
Internet Explorer 6.0