SmitfraudFix peut rien faire contre spywar

slt,
smitfraudfix a supprimé des choses

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\ace16win.dll supprimé
C:\WINDOWS\system32\msole32.exe supprimé
C:\Program Files\Helper\ supprimé

________________

pour finir le travail:

combofix (colle le rapport)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

____________________

colle un rapport hijackthis et dis tes soucis

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

Tout d'abord, merci pour votre réponse !
Alors j'ai fais le scan en premier avec combofix, le fond d'écran est revenu normal et n'apparaît plus avec un fond de message d'alerte de spyware, voici le rapport :

ComboFix 08-02-12.3 - Propriétaire 2008-02-12 18:06:40.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.177 [GMT 1:00]
Endroit: C:\Documents and Settings\Propriétaire\Bureau\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\3721
C:\Program Files\Accoona
C:\Program Files\akl
C:\Program Files\p2pnetworks
C:\WINDOWS\system32\acespy
C:\WINDOWS\system32\drivers\symavc32.sys
.
---- Previous Run -------
.
C:\Documents and Settings\All Users\Application Data.\uvwpmfct.dll
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin1.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin2.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin3.zip
C:\Program Files\3721
C:\Program Files\3721\assist\asbar.dll
C:\Program Files\3721\helper.dll
C:\Program Files\Accoona
C:\Program Files\Accoona\ASearchAssist.dll
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\curlog.htm
C:\Program Files\akl\keylog.txt
C:\Program Files\akl\readme.txt
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.dat
C:\Program Files\akl\unsetup.exe
C:\Program Files\amsys
C:\Program Files\amsys\awmsg.dat
C:\Program Files\amsys\guid.dat
C:\Program Files\amsys\ijl15.dll
C:\Program Files\amsys\mfc42.dll
C:\Program Files\amsys\msvcrt.dll
C:\Program Files\amsys\unins000.dat
C:\Program Files\amsys\unis000.exe
C:\Program Files\amsys\winam.dat
C:\Program Files\e-zshopper
C:\Program Files\e-zshopper\BarLcher.dll
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\amp2pl.exe
C:\Program Files\winperformance
C:\Program Files\winperformance\registry_backup\2008.02.10 23.43.57.rb
C:\Program Files\winperformance\uninstall.exe
C:\WINDOWS\764.exe
C:\WINDOWS\7search.dll
C:\WINDOWS\absolute key logger.lnk
C:\WINDOWS\aconti.exe
C:\WINDOWS\aconti.ini
C:\WINDOWS\aconti.log
C:\WINDOWS\aconti.sdb
C:\WINDOWS\acontidialer.txt
C:\WINDOWS\adbar.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\daxtime.dll
C:\WINDOWS\default.htm
C:\WINDOWS\dp0.dll
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\flt.dll
C:\WINDOWS\hcwprn.exe
C:\WINDOWS\hotporn.exe
C:\WINDOWS\ie_32.exe
C:\WINDOWS\iexplorr23.dll
C:\WINDOWS\jd2002.dll
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\kkcomp.dll
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\kvnab$.exe
C:\WINDOWS\kvnab.dll
C:\WINDOWS\kvnab.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\liqad.dll
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\liqui.dll
C:\WINDOWS\liqui.exe
C:\WINDOWS\ngd.dll
C:\WINDOWS\pbar.dll
C:\WINDOWS\pbsysie.dll
C:\WINDOWS\PerfInfo
C:\WINDOWS\PerfInfo\uO2juZdo7ywp.exe
C:\WINDOWS\settn.dll
C:\WINDOWS\spredirect.dll
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\acespy
C:\WINDOWS\system32\acespy\__acelog.ndx
C:\WINDOWS\system32\acespy\systune.exe
C:\WINDOWS\system32\dbxDgrevCheck.dll
C:\WINDOWS\system32\drivers\HUYK79.sys
C:\WINDOWS\system32\drivers\symavc32.sys . . . . Echec de suppression
C:\WINDOWS\system32\ESHOPEE.exe
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\vxddsk.exe
C:\WINDOWS\system32\wml.exe
C:\WINDOWS\Temp\1202.exe
C:\WINDOWS\vxddsk.exe
C:\WINDOWS\wbeCheck.exe
C:\WINDOWS\wbeInst$.exe
C:\WINDOWS\wml.exe
C:\WINDOWS\xadbrk.dll
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\xadbrk_.exe
C:\WINDOWS\xxxvideo.exe
C:\WINDOWS\yhydmnoj.dll
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_HUYK79

((((((((((((((((((((((((((((( Fichiers créés 2008-01-12 to 2008-02-12 ))))))))))))))))))))))))))))))))))))
.

2008-02-12 16:10 . 2008-02-12 16:10 129,920 --a------ C:\WINDOWS\system32\diperto29e2-6840.sys
2008-02-12 16:10 . 2008-02-12 18:06 41,656 --a------ C:\WINDOWS\system32\diperto.ini
2008-02-11 10:57 . 2004-01-02 03:31 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2008-02-11 10:57 . 2004-01-02 01:28 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-02-11 10:57 . 2004-01-02 01:28 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-02-11 10:57 . 2004-10-05 00:33 <REP> d---s---- C:\Documents and Settings\Administrateur\UserData
2008-02-11 10:57 . 2004-11-08 19:13 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-02-11 10:57 . 2004-11-08 19:10 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-02-11 10:57 . 2004-11-08 19:10 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-02-11 10:57 . 2004-11-08 19:10 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-02-11 10:57 . 2005-12-02 11:04 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-02-11 10:57 . 2004-10-05 09:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Webroot
2008-02-11 10:57 . 2004-10-05 09:38 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\TuneUp Software
2008-02-11 10:57 . 2004-10-11 13:58 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Thunderbird
2008-02-11 10:57 . 2004-10-11 13:55 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Talkback
2008-02-11 10:57 . 2004-01-02 00:43 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-02-11 10:57 . 2004-01-02 03:25 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sonic
2008-02-11 10:57 . 2004-01-02 04:05 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SampleView
2008-02-11 10:57 . 2004-10-26 09:25 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\HP
2008-02-11 10:57 . 2004-10-22 00:20 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Canon
2008-02-11 10:57 . 2004-11-28 21:49 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Azureus
2008-02-11 10:57 . 2004-10-25 13:06 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Ahead
2008-02-11 10:57 . 2004-10-30 13:57 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\AdobeUM
2008-02-11 10:57 . 2004-10-11 10:00 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Acoustica
2008-02-11 10:48 . 2008-02-12 16:19 2,358 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-11 00:37 . 2008-02-11 00:43 691,545 --a------ C:\WINDOWS\unins000.exe
2008-02-11 00:37 . 2008-02-11 00:45 6,464 --a------ C:\WINDOWS\unins000.dat
2008-02-11 00:26 . 2008-02-11 00:52 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-10 23:13 . 2008-02-10 23:15 3,584 --a------ C:\qrwkjyd.exe
2008-02-10 23:12 . 2008-02-10 23:12 <REP> d-------- C:\WINDOWS\naoufgfm
2008-02-10 23:12 . 2008-02-10 23:12 2,818,029 --a------ C:\WINDOWS\uO2juZdo7y.exe.bak
2008-02-10 23:12 . 2008-02-10 23:12 184,832 --a------ C:\WINDOWS\oxchsdqb.dll
2008-02-10 23:12 . 2008-02-10 23:12 91,667 --a------ C:\WINDOWS\system32\rxjddnvj.exe
2008-02-10 23:12 . 2008-02-10 23:12 91,667 --a------ C:\WINDOWS\nalefejo.exe
2008-02-10 23:12 . 2008-02-12 15:58 4 --a------ C:\WINDOWS\system32\winfrun32.bin
2008-02-10 23:11 . 2008-02-10 23:15 58,368 --a------ C:\wpohl.exe
2008-02-10 23:11 . 2008-02-10 23:11 54,764 --a------ C:\WINDOWS\system32\4fdw.dll
2008-02-10 23:11 . 2008-02-10 23:11 51,712 --a------ C:\WINDOWS\udgxafyd.exe~
2008-02-10 23:11 . 2008-02-10 23:11 38,400 -r-hs---- C:\WINDOWS\system32\a15f.exe
2008-02-10 23:11 . 2008-02-10 23:15 28,160 --a------ C:\jupss.exe
2008-02-10 23:11 . 2008-02-12 16:10 145 --a-s---- C:\WINDOWS\system32\2910306104.dat
2008-02-10 23:11 . 2008-02-10 23:15 2 --a------ C:\-995422245
2008-01-17 22:31 . 2008-01-17 22:31 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\JAlbum
2008-01-17 22:31 . 2008-01-17 22:31 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\JAlbum
2008-01-17 22:27 . 2008-01-17 22:28 <REP> d-------- C:\Program Files\JAlbumWin

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-12 16:45 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\MegauploadToolbar
2008-02-12 16:45 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\MegauploadToolbar
2008-02-11 09:25 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Lavasoft
2008-02-11 09:25 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Lavasoft
2008-02-10 23:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-04 21:16 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-02-01 11:43 --------- d-----w C:\Program Files\adslTV
2008-01-25 10:55 --------- d-----w C:\Program Files\Group Mail
2008-01-16 18:17 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 2
2008-01-10 17:38 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-01-02 21:27 --------- d-----w C:\Program Files\Safari
2008-01-02 21:27 --------- d-----w C:\Program Files\Bonjour
2008-01-02 21:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-02 13:03 --------- d-----w C:\Program Files\eMule
2008-01-02 12:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-26 20:13 --------- d-----w C:\Program Files\MegauploadToolbar
2007-12-18 22:03 --------- d-----w C:\Program Files\Veoh Networks
2007-12-17 22:22 --------- d-----w C:\Program Files\MediaCoder
2007-12-12 16:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-10 14:30 91,488 ----a-w C:\WINDOWS\system32\sayradioplayer.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-15 13:06 724,992 ----a-w C:\WINDOWS\iun6002.exe
2004-10-05 09:10 76 ---ha-w C:\Program Files\Desktop.ini
2004-08-19 23:09 60,416 --sha-w C:\WINDOWS\BricoPacks\SysFiles\62_msimn.exe
2004-08-19 23:09 60,416 --sha-w C:\WINDOWS\Packs\SysFiles\6_msimn.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acme.PCHButton"="C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\pchbutton.exe" [2004-01-02 03:51 155648]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-01-19 12:49 4670968]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-01-30 13:11 3497984]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-12-05 19:50 3022848]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 20:35 50176 C:\WINDOWS\ALCXMNTR.EXE]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\QTSystem\qttask.exe" [2007-05-22 13:27 282624]

C:\Documents and Settings\Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
Stardock ObjectDock.lnk - C:\Program Files\Longhorn Inspirat\ObjectDock\ObjectDock.exe [2005-02-21 14:56:00 1826885]

C:\Documents and Settings\Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
Stardock ObjectDock.lnk - C:\Program Files\Longhorn Inspirat\ObjectDock\ObjectDock.exe [2005-02-21 14:56:00 1826885]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Window Washer"=C:\Program Files\Webroot\Washer\wwDisp.exe
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"VPSKEYS"=C:\Program Files\Vpskeys\vpskeys.exe
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"KBD"=C:\HP\KBD\KBD.EXE
"hpsysdrv"=c:\windows\system\hpsysdrv.exe
"Recguard"=C:\WINDOWS\SMINST\RECGUARD.EXE
"nwiz"=nwiz.exe /installquiet /keeploaded /nodetect
"UserFaultCheck"=%systemroot%\system32\dumprep 0 -u
"Easy-PrintToolBox"=C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"Sunkist2k"=C:\Program Files\Multimedia Card Reader\shwicon2k.exe
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"
"PS2"=C:\WINDOWS\system32\ps2.exe
"RoxWatchTray"="C:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxWatchTray.exe"
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\QTSystem\qttask.exe" -atboottime
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

R2 diperto29e2-6840;diperto29e2-6840;C:\WINDOWS\system32\diperto29e2-6840.sys [2008-02-12 16:10]
R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe [2004-08-20 00:10]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 07:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08]
S2 RemoteAccessSpooler;Routage et accès distant RemoteAccessSpooler;C:\WINDOWS\system32\a15f.exe srv []
S3 archbus;NEC WMC USB_BJ1 Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\archbus.sys [2005-08-30 12:17]
S3 archmdfl;NEC WMC USB_BJ1 Modem Filter;C:\WINDOWS\system32\DRIVERS\archmdfl.sys [2005-08-30 12:17]
S3 archmdm;NEC WMC USB_BJ1 Modem Drivers;C:\WINDOWS\system32\DRIVERS\archmdm.sys [2005-08-30 12:17]
S3 AVCSTRM;AVC Streaming Filter Driver;C:\WINDOWS\system32\DRIVERS\avcstrm.sys [2004-08-04 08:09]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;C:\WINDOWS\system32\DRIVERS\fbxusb32.sys [2004-10-20 14:23]
S3 MSTAPE;Microsoft AV/C Tape Subunit Device;C:\WINDOWS\system32\DRIVERS\mstape.sys [2004-08-04 08:09]
S3 ovt530;Webcam Deluxe;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 16:04]
S3 p2pgasvc;Authentification de groupe réseau homologue;C:\WINDOWS\System32\svchost.exe [2004-08-20 00:10]
S3 p2pimsvc;Gestionnaire d'identité réseau homologue;C:\WINDOWS\System32\svchost.exe [2004-08-20 00:10]
S3 p2psvc;Réseau homologue;C:\WINDOWS\System32\svchost.exe [2004-08-20 00:10]
S3 PNRPSvc;Protocole de résolution de noms d'homologues;C:\WINDOWS\System32\svchost.exe [2004-08-20 00:10]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\Info.exe folder.htt 480 480

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-12-14 16:19:41 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
"2008-01-30 21:26:09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2005-01-07 10:07:05 C:\WINDOWS\Tasks\Connexion Facile à Internet.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2007-12-14 16:15:02 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2004\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-12 18:11:59
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-02-12 18:14:09
ComboFix-quarantined-files.txt 2008-02-12 17:14:07
.
2008-01-09 08:33:56 --- E O F ---

Puis j'ai fais avec hijackthis, voici le rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:15:51, on 12/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\pchbutton.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Nouveau dossier\eden.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8992ee2a-1dd2-11b2-83ae-98bf61dd92f8} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\QTSystem\qttask.exe" -atboottime
O4 - HKLM\..\Run: [uvwpmfct] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\uvwpmfct.dll"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Longhorn Inspirat\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Télécharger Avec &BitSpirit
- C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099917682468
O16 - DPF: {C958BCD3-2C8A-432D-92B8-632EE672ACFD} (fmplay Class) - http://dl.sayclub.com/sayclub/sayctl/sayradioplayer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Routage et accès distant RemoteAccessSpooler (RemoteAccessSpooler) - Unknown owner - C:\WINDOWS\system32\a15f.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe