Trojans a la pelle

salut g!rly

désolé d'etre aussi long mais je suis en plein demenagement donc souvent absent
mais voici ce que tu ma demandé

mon pc est de plus en plus long

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 12:04 2008-02-18

+ Résultat de l'analyse:



C:\Documents and Settings\ludo\Mes documents\pinnacle\Hollywood FX 5.1\FX 5.1\keygen.exe -> Downloader.Zlob.bnv : Aucune action entreprise.
D:\programme\Pinnacle_Studio_9.3.5_MultiLanguage + Hollywood Fx 5.1 Plus Extra Packs.zip/Hollywood FX 5.1/FX 5.1/keygen.exe -> Downloader.Zlob.bnv : Aucune action entreprise.
C:\Documents and Settings\ludo\Application Data\installer_en[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.au : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@247realmedia[1].txt -> TrackingCookie.247realmedia : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@aoleusearch.122.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@aolfr.122.2o7[2].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@microsoftwga.112.2o7[2].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@mistergooddeal.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@shopping.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@webpopulation.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\joelle\Cookies\joelle@adtech[1].txt -> TrackingCookie.Adtech : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@adtech[1].txt -> TrackingCookie.Adtech : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@advertising[2].txt -> TrackingCookie.Advertising : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@advertising[3].txt -> TrackingCookie.Advertising : Aucune action entreprise.
C:\Documents and Settings\joelle\Cookies\joelle@atdmt[1].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@bluestreak[1].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@bluestreak[2].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
:mozilla.19:C:\Documents and Settings\ludo\Application Data\Mozilla\Firefox\Profiles\ynwhs930.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.20:C:\Documents and Settings\ludo\Application Data\Mozilla\Firefox\Profiles\ynwhs930.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.21:C:\Documents and Settings\ludo\Application Data\Mozilla\Firefox\Profiles\ynwhs930.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.22:C:\Documents and Settings\ludo\Application Data\Mozilla\Firefox\Profiles\ynwhs930.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.23:C:\Documents and Settings\ludo\Application Data\Mozilla\Firefox\Profiles\ynwhs930.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.24:C:\Documents and Settings\ludo\Application Data\Mozilla\Firefox\Profiles\ynwhs930.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.25:C:\Documents and Settings\ludo\Application Data\Mozilla\Firefox\Profiles\ynwhs930.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@promo.casinotropez[2].txt -> TrackingCookie.Casinotropez : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@bilbo.counted[1].txt -> TrackingCookie.Counted : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@dealtime[1].txt -> TrackingCookie.Dealtime : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@stat.dealtime[1].txt -> TrackingCookie.Dealtime : Aucune action entreprise.
C:\Documents and Settings\joelle\Cookies\joelle@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@estat[2].txt -> TrackingCookie.Estat : Aucune action entreprise.
C:\Documents and Settings\joelle\Cookies\joelle@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@mediaplex[2].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@overture[1].txt -> TrackingCookie.Overture : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Aucune action entreprise.
C:\Documents and Settings\joelle\Cookies\joelle@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\joelle\Cookies\joelle@serving-sys[2].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@smartadserver[1].txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@statcounter[2].txt -> TrackingCookie.Statcounter : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
:mozilla.100:C:\Documents and Settings\ludo\Application Data\Mozilla\Firefox\Profiles\ynwhs930.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.99:C:\Documents and Settings\ludo\Application Data\Mozilla\Firefox\Profiles\ynwhs930.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\joelle\Cookies\joelle@weborama[2].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@weborama[2].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\joelle\Cookies\joelle@m.webtrends[2].txt -> TrackingCookie.Webtrends : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@m.webtrends[2].txt -> TrackingCookie.Webtrends : Aucune action entreprise.
C:\Documents and Settings\ludo\Cookies\ludo@m.webtrends[3].txt -> TrackingCookie.Webtrends : Aucune action entreprise.


Fin du rapport

ComboFix 08-02-19.2 - ludo 2008-02-20 19:25:05.6 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.153 [GMT 1:00]
Endroit: C:\Documents and Settings\ludo\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\ludo\Bureau\CFScript.txt..txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color

FILE ::
C:\DOCUME~1\ludo\LOCALS~1\Temp\o1394bul.sys
C:\Documents and Settings\ludo\Application Data\installer_en[1].exe
C:\eden.exe
C:\eden.exe.exe
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\MRT.INI
C:\WINDOWS\system32\rar.exe
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\WinSpooler.exe
C:\WINDOWS\system32\WinUpdating.exe
.

AntiVir PersonalEdition Classic
Report file date: 2008-02-25 17:38

Scanning for 1120425 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: ludo
Computer name: NOM-ANVMB2QXOQA

Version information:
BUILD.DAT : 270 15603 Bytes 2007-09-19 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 2007-08-23 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 2007-08-16 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 2007-08-14 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 2007-08-21 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007-07-18 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 2007-12-14 16:26:17
ANTIVIR2.VDF : 7.0.2.113 1673728 Bytes 2008-02-08 16:26:17
ANTIVIR3.VDF : 7.0.2.180 334848 Bytes 2008-02-22 16:26:18
AVEWIN32.DLL : 7.6.0.67 3293696 Bytes 2008-02-25 16:26:18
AVWINLL.DLL : 1.0.0.7 14376 Bytes 2007-02-26 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 2007-07-18 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-16 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 2008-02-25 16:26:18
AVREG.DLL : 7.0.1.6 30760 Bytes 2007-07-18 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 2007-08-28 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 2007-07-18 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 2007-03-08 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 2007-08-07 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 2007-08-21 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 2007-07-23 09:37:21

Configuration settings for the scan:
Jobname..........................: Rootkit search
Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\rootkit.avp
Logging..........................: high
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Scan memory......................: off
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Expanded search settings.........: 0x00300922

Start of the scan: 2008-02-25 17:38

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:51, on 2008-02-25
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Deckard's System Scanner v20071014.68
Run by ludo on 2008-02-26 21:07:24
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
12: 2008-02-26 20:07:32 UTC - RP12 - Deckard's System Scanner Restore Point
11: 2008-02-26 16:59:45 UTC - RP11 - Point de vérification système
10: 2008-02-25 16:23:41 UTC - RP10 - AntiVir PersonalEdition Classic - 2008-02-25 17:23
9: 2008-02-22 20:45:51 UTC - RP9 - Point de vérification système
8: 2008-02-21 19:39:55 UTC - RP8 - Point de vérification système


-- First Restore Point --
1: 2008-02-14 21:14:26 UTC - RP1 - Point de vérification système


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as ludo.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:10, on 2008-02-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\ludo\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\ludo.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

donc winspool.exe est bien la et voici le rapport clean

2008-02-27 a 0:06:55.17

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32

*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !

le pc a redemaré 2 fois puis 2 fenetre ce soont ouverte

1- windows pas de disc
quand j'ai fait anulé 2 fois car je sais pas ce que c'est les 2 fenetre ce sont fermé

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Error: could not execute export batch.
Error code: 0


//////////////////////////////////////////


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\fqdujukk

*******************

Script file located at: \??\C:\WINDOWS\mqljwoqu.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\WinUpdating.exe not found!
Deletion of file C:\WINDOWS\system32\WinUpdating.exe failed!

Could not process line:
C:\WINDOWS\system32\WinUpdating.exe
Status: 0xc0000034



File C:\WINDOWS\system32\tmp.reg not found!
Deletion of file C:\WINDOWS\system32\tmp.reg failed!

Could not process line:
C:\WINDOWS\system32\tmp.reg
Status: 0xc0000034



File C:\Documents and Settings\ludo\Application Data\installer_en[1].exe not found!
Deletion of file C:\Documents and Settings\ludo\Application Data\installer_en[1].exe failed!

Could not process line:
C:\Documents and Settings\ludo\Application Data\installer_en[1].exe
Status: 0xc0000034



File C:\WINDOWS\system32\MRT.INI not found!
Deletion of file C:\WINDOWS\system32\MRT.INI failed!

Could not process line:
C:\WINDOWS\system32\MRT.INI
Status: 0xc0000034



File C:\WINDOWS\imsins.BAK not found!
Deletion of file C:\WINDOWS\imsins.BAK failed!

Could not process line:
C:\WINDOWS\imsins.BAK
Status: 0xc0000034



File C:\eden.exe.exe not found!
Deletion of file C:\eden.exe.exe failed!

Could not process line:
C:\eden.exe.exe
Status: 0xc0000034



File C:\eden.exe not found!
Deletion of file C:\eden.exe failed!

Could not process line:
C:\eden.exe
Status: 0xc0000034



File C:\WINDOWS\system32\WinSpooler.exe not found!
Deletion of file C:\WINDOWS\system32\WinSpooler.exe failed!

Could not process line:
C:\WINDOWS\system32\WinSpooler.exe
Status: 0xc0000034



File C:\WINDOWS\system32\rar.exe not found!
Deletion of file C:\WINDOWS\system32\rar.exe failed!

Could not process line:
C:\WINDOWS\system32\rar.exe
Status: 0xc0000034



File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\DOCUME~1\ludo\LOCALS~1\Temp\o1394bul.sys not found!
Deletion of file C:\DOCUME~1\ludo\LOCALS~1\Temp\o1394bul.sys failed!

Could not process line:
C:\DOCUME~1\ludo\LOCALS~1\Temp\o1394bul.sys
Status: 0xc0000034



Folder C:\VundoFix Backups not found!
Deletion of folder C:\VundoFix Backups failed!

Could not process line:
C:\VundoFix Backups
Status: 0xc0000034



Folder C:\Documents and Settings\All Users\Application Data\SalesMon not found!
Deletion of folder C:\Documents and Settings\All Users\Application Data\SalesMon failed!

Could not process line:
C:\Documents and Settings\All Users\Application Data\SalesMon
Status: 0xc0000034



Folder C:\Documents and Settings\ludo\Application Data\WinAnonymous not found!
Deletion of folder C:\Documents and Settings\ludo\Application Data\WinAnonymous failed!

Could not process line:
C:\Documents and Settings\ludo\Application Data\WinAnonymous
Status: 0xc0000034



Registry key \Registry\Machine\System\CurrentControlSet\Services\o1394bul not found!
Unload of driver o1394bul failed!

Could not process line:
o1394bul
Status: 0xc0000034



Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hldrrr not found!
Deletion of registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hldrrr failed!
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

le pc n'a pas redemaré

ComboFix 08-02-25.3 - ludo 2008-02-27 1:12:40.7 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.106 [GMT 1:00]
Endroit: C:\Documents and Settings\ludo\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\ludo\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\DOCUME~1\ludo\LOCALS~1\Temp\o1394bul.sys
C:\Documents and Settings\ludo\Application Data\installer_en[1].exe
C:\eden.exe
C:\eden.exe.exe
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\MRT.INI
C:\WINDOWS\system32\rar.exe
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\WinSpooler.exe
C:\WINDOWS\system32\WinUpdating.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-01-27 to 2008-02-27 ))))))))))))))))))))))))))))))))))))
.

2008-02-27 00:07 . 2008-02-27 00:07 12,816,478 --a--c--- C:\upload_moi_NOM-ANVMB2QXOQA.tar.gz
2008-02-26 21:46 . 2008-02-26 22:28 <REP> d-------- C:\Program Files\Lopxp
2008-02-26 21:07 . 2008-02-26 21:07 <REP> d----c--- C:\Deckard
2008-02-25 17:24 . 2008-02-25 17:24 <REP> d-------- C:\Program Files\Avira
2008-02-25 17:24 . 2008-02-25 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-02-20 20:37 . 2008-02-20 20:37 <REP> d-------- C:\Program Files\Kerio
2008-02-16 00:18 . 2008-02-16 00:18 <REP> d-------- C:\Documents and Settings\ludo\Application Data\Grisoft
2008-02-16 00:18 . 2008-02-16 00:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-16 00:18 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-15 14:12 . 2008-02-25 19:21 <REP> d-------- C:\Program Files\Fichiers communs\WinAnonymous
2008-02-15 14:12 . 2008-02-15 14:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WinAnonymous
2008-02-14 20:04 . 2008-02-14 20:04 <REP> d-------- C:\Program Files\Panda Security
2008-02-13 22:56 . 2008-02-13 22:56 <REP> d----c--- C:\_OTMoveIt
2008-02-10 22:03 . 2008-02-10 22:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-02-10 10:31 . 2008-02-13 21:42 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-10 10:22 . 2003-09-21 22:00 57,344 --------- C:\WINDOWS\system32\HKLock.dll
2008-02-10 10:22 . 2003-09-21 22:00 57,344 --------- C:\WINDOWS\HKLock.dll
2008-02-10 10:22 . 2003-03-27 13:55 11,776 --a------ C:\WINDOWS\system32\drivers\kbfilter.sys
2008-02-10 10:21 . 2004-10-11 15:28 8,448 --a------ C:\WINDOWS\system32\drivers\moufiltr.sys
2008-02-04 10:39 . 2008-02-27 01:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-04 10:39 . 2008-02-27 01:17 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-31 22:37 . 2008-01-31 22:37 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-01-30 00:27 . 2006-04-10 14:02 162,816 --a------ C:\WINDOWS\system32\drivers\RT25USBAP.SYS
2008-01-30 00:27 . 2004-05-12 13:49 1 --a------ C:\WINDOWS\system32\drivers\RT25USBAP.CAT

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-15 00:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-12 19:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-10 15:01 --------- d-----w C:\Program Files\eMule
2008-02-10 09:28 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-01-31 21:37 --------- d-----w C:\Program Files\Fichiers communs\Real
2008-01-31 09:01 --------- d-----w C:\Documents and Settings\ludo\Application Data\Image Zone Express
2008-01-18 19:10 --------- d-----w C:\Program Files\Alcohol Soft
2008-01-18 18:49 --------- d-----w C:\Program Files\MultiRes
2008-01-18 18:39 1,776,512 ----a-w C:\Program Files\_Alcohol.exe
2008-01-18 16:23 --------- d-----w C:\Documents and Settings\ludo\Application Data\proDAD
2008-01-18 16:22 --------- d-----w C:\Program Files\Pinnacle
2008-01-13 20:39 --------- d-----w C:\Documents and Settings\ludo\Application Data\atitray
2008-01-13 20:25 472,576 ----a-w C:\WINDOWS\Radeon Omega Drivers v4.8.442 Uninstall.exe
2008-01-13 20:25 --------- d-----w C:\Program Files\Radeon Omega Drivers
2008-01-13 14:01 --------- d-----w C:\Program Files\Empire Interactive
2008-01-11 23:42 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-01-11 21:23 --------- d-----w C:\Program Files\Windows Live
2008-01-11 21:21 --------- d-----w C:\Program Files\Microsoft Works
2008-01-11 10:57 --------- d-----w C:\Program Files\MSBuild
2008-01-11 10:55 --------- d-----w C:\Program Files\Microsoft.NET
2008-01-11 10:50 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-05 03:05 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:53 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:53 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 02:48 9,535,488 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:33 1,640,192 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-05 02:19 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:14 180,224 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-11-12 15:43 0 ----a-w C:\Documents and Settings\joelle\z.dat
2007-11-12 15:43 0 ----a-w C:\Documents and Settings\joelle\x.dat
2007-07-29 18:28 12,308 -c--a-w C:\Documents and Settings\ludo\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360]
"Neuf Media Center"="C:\Program Files\Neuf\Media Center\MediaCenter.exe" [2007-10-15 16:57 1025264]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:59 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"AtiPTA"="atiptaxx.exe" [2006-02-22 02:05 344064 C:\WINDOWS\system32\atiptaxx.exe]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-01-31 22:36 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-10-21 20:17 77824]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-25 17:26 249896]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^ludo^Programmes^Démarrage^wkcalrem.LNK]
path=C:\Documents and Settings\All Users\ludo\Programmes\Démarrage\wkcalrem.LNK
backup=C:\WINDOWS\pss\wkcalrem.LNKStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Appstart]
C:\WINDOWS\Downloaded Program Files\Appstart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
--a------ 2004-02-24 13:05 508416 C:\WINDOWS\mHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
--a--c--- 2004-01-07 15:14 2453504 C:\WINDOWS\CMICNFG.CPL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-20 00:09 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dit]
--a--c--- 2004-04-02 12:31 86016 C:\WINDOWS\Dit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a--c--- 2005-05-11 22:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ledpointer]
--a--c--- 2004-02-03 16:15 5794816 C:\WINDOWS\CNYHKey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
--a------ 2006-10-13 16:01 277296 C:\Program Files\Microsoft LifeCam\LifeExp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Magentic]
C:\PROGRA~1\Magentic\bin\Magentic.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
C:\Program Files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
-----c--- 2004-04-05 09:09 61440 C:\Program Files\Home Cinema\PowerCinema\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
C:\WINDOWS\System32\PSDrvCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-10-21 20:17 77824 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2007-03-14 02:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-01-31 22:36 185896 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]
--a------ 2006-10-13 16:04 707376 C:\WINDOWS\vVX1000.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
-----c--- 2006-11-03 09:59 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"InCDsrv"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"C:\\Program Files\\Kerio\\Personal Firewall 4\\kpf4gui.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"C:\Program Files\Neuf\Media Center\httpd\httpd.exe"= C:\Program Files\Neuf\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0,192.168.1.2/255.255.255.255:Enabled:Serveur de partage Media Center (Player Neuf Cegetel)

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46]
R1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [2007-11-05 08:55]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2004-04-15 11:02]
R1 moufiltr;Mouse Filter Driver;C:\WINDOWS\system32\drivers\moufiltr.sys [2004-10-11 15:28]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2006-10-13 16:01]
R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-06-05 10:04]
R3 CardReaderFilter;Card Reader Filter;C:\WINDOWS\system32\Drivers\USBCRFT.SYS [2007-06-05 10:15]
R3 Intels51;Creatix V.9X DSP Data Fax Modem;C:\WINDOWS\system32\DRIVERS\ctxs51.sys [2003-05-22 19:44]
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2003-06-12 10:47]
R3 PRISM_A00;PRISM 802.11g Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2004-01-16 09:31]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08]
R3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-10-13 16:04]
R3 wbscr;Winbond Smartcard Reader for I/O;C:\WINDOWS\system32\drivers\wbscr.sys [2002-04-24 12:07]
S3 UKBFLT;UKBFLT;C:\WINDOWS\system32\DRIVERS\UKBFLT.sys [2003-12-19 16:13]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-26 23:29:00 C:\WINDOWS\Tasks\WebReg psc 1500 series.job"
- C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-27 01:17:45
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-02-27 1:21:15
.
2008-02-15 00:06:35 --- E O F ---

bonjour,

ci dessous le rapport de tclean

-->- Recherche:

C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\ludo\Recent\MSNFix.lnk: trouvé !
C:\Documents and Settings\ludo\Recent\HijackThis.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\QooBox\Quarantine\C\Combofix: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\tar.exe: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\remove.reg: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\pskill.exe: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\LFiles.exe: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\gzip.exe: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\delsiri.cmd: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\delr.cmd: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\del3.cmd: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\del2.cmd: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\clean.cmd: trouvé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\cherche.cmd: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\ludo\Recent\MSNFix.lnk: supprimé !
C:\Documents and Settings\ludo\Recent\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\tar.exe: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\remove.reg: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\pskill.exe: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\LFiles.exe: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\gzip.exe: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\delsiri.cmd: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\delr.cmd: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\del3.cmd: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\del2.cmd: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\clean.cmd: supprimé !
C:\RECYCLER\S-1-5-21-3981431342-3666742150-4149584315-1008\Dc6\clean\cherche.cmd: supprimé !
C:\Combofix: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

bonsoir excuse moi g oublié de le noté
c'est pour regcleaner
j'ai suivi la manip. du tuto que tu ma donné
et dès que le scan commence ça trouve quelque clef de registre puis le programme ce ferme automatiquement
j'ai un message d'erreur qui s'affiche et qui dit que "windows ne peut pas accedé a ce péripherique ,vous n'avez peut-etre pas les aotorisation approprier pour avoir acces a ces élément"
c'est une fenetre rundll32 qui souvre defois si je vais sur le panneau de configuration et tous le temp quand je vais sur "configuré les programme par défaut"
pourtant je suis en administrateur.

bonsoir
j'ai fait la manip. zeb restore etc'est toujour pareil
en ce qui concerne regcleaner au bout de 2 minutes j'ai un message d'érreur

--Error report-----
Error message: Cannot create file

--Addition information-----
RegCleaner version = RegCleaner 4.3, Build: 780
Idler.Enabled = True
Section = Registry Cleanup
System mode = Normal
Cleanup mode = All
NT Mode = True
Win2k Mode = True
Administrator = True
Debug mode = False

--Action Log-----
Start 0
Start 1
Start 2
Start 3
Select lang
Language: C:\Program Files\RegCleaner\languages\English.rlg
Column mode change
Start 4
Section: Software
DeleteDupes
Column click
Started
LoadColumnWidths
Done button
LoadColumnWidths
Cleanup Start
LoadColumnWidths
Cleanupform Pause
Remove
RemRegCleanup