Virus bagle

je ne savait pas et toi tu me conseillerais lequel pour vista et dit moi aussi la marche a suivre pour desactiver completement le pare feu windows j'ai vu cette commande netsh firewall set opmode disable mais peut tu me le confirmer?merci

merci green day pour tes informations mais ca na rien changer toujours la meme chose avec ce rapport ci d'ellibagla:
Fri Mar 14 14:55:09 2008
EliBagle v11.15 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\SROSA.SYS.Muestra EliBagle v11.15
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.15
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
Reinicie para Completar la Limpieza.

Fri Mar 14 14:55:14 2008
EliBagle v11.15 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\WINDOWS\System32\MDELK.EXE --> Acceso Denegado, Bagle (Reiniciar para completar la Limpieza)

Nº Total de Directorios: 14753
Nº Total de Ficheros: 84150
Nº de Ficheros Analizados: 14877
Nº de Ficheros Infectados: 1
Nº de Ficheros Limpiados: 1

Fri Mar 14 14:57:16 2008
EliBagle v11.15 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 753
Nº Total de Ficheros: 7399
Nº de Ficheros Analizados: 1252
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0
Exploración Detenida por el Usuario.

Fri Mar 14 15:33:30 2008
EliBagle v11.15 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
Por favor, envienos una muestra del fichero
C:\Muestras\SROSA.SYS.Muestra EliBagle v11.15
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.15
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
Reinicie para Completar la Limpieza.

Fri Mar 14 15:40:07 2008
EliBagle v11.15 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

Fri Mar 14 15:58:31 2008
EliBagle v11.15 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\SROSA.SYS.Muestra EliBagle v11.15
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.15
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
Reinicie para Completar la Limpieza.

Merci d'avance pour votre aide

Voici le rapport combo green day :ComboFix 08-03-03.15 - mehdi 2008-03-14 15:34:57.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.2044 [GMT 1:00]
Endroit: C:\Users\mehdi\Desktop\Combo-Fix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\drivers\down
C:\Windows\system32\drivers\down\104583.exe
C:\Windows\system32\drivers\down\104801.exe
C:\Windows\system32\drivers\down\105581.exe
C:\Windows\system32\drivers\down\105721.exe
C:\Windows\system32\drivers\down\105862.exe
C:\Windows\system32\drivers\down\106720.exe
C:\Windows\system32\drivers\down\108810.exe
C:\Windows\system32\drivers\down\109824.exe
C:\Windows\system32\drivers\down\110511.exe
C:\Windows\system32\drivers\down\112102.exe
C:\Windows\system32\drivers\down\113911.exe
C:\Windows\system32\drivers\down\114348.exe
C:\Windows\system32\drivers\down\115003.exe
C:\Windows\system32\drivers\down\115518.exe
C:\Windows\system32\drivers\down\116907.exe
C:\Windows\system32\drivers\down\119605.exe
C:\Windows\system32\drivers\down\121555.exe
C:\Windows\system32\drivers\down\122101.exe
C:\Windows\system32\drivers\down\122757.exe
C:\Windows\system32\drivers\down\123724.exe
C:\Windows\system32\drivers\down\124925.exe
C:\Windows\system32\drivers\down\125768.exe
C:\Windows\system32\drivers\down\131852.exe
C:\Windows\system32\drivers\down\131930.exe
C:\Windows\system32\drivers\down\132803.exe
C:\Windows\system32\drivers\down\133490.exe
C:\Windows\system32\drivers\down\135081.exe
C:\Windows\system32\drivers\down\137530.exe
C:\Windows\system32\drivers\down\137873.exe
C:\Windows\system32\drivers\down\138404.exe
C:\Windows\system32\drivers\down\138528.exe
C:\Windows\system32\drivers\down\141976.exe
C:\Windows\system32\drivers\down\144410.exe
C:\Windows\system32\drivers\down\146297.exe
C:\Windows\system32\drivers\down\148668.exe
C:\Windows\system32\drivers\down\149292.exe
C:\Windows\system32\drivers\down\150837.exe
C:\Windows\system32\drivers\down\151617.exe
C:\Windows\system32\drivers\down\153208.exe
C:\Windows\system32\drivers\down\154019.exe
C:\Windows\system32\drivers\down\154191.exe
C:\Windows\system32\drivers\down\154565.exe
C:\Windows\system32\drivers\down\155501.exe
C:\Windows\system32\drivers\down\155969.exe
C:\Windows\system32\drivers\down\156874.exe
C:\Windows\system32\drivers\down\158887.exe
C:\Windows\system32\drivers\down\159979.exe
C:\Windows\system32\drivers\down\160259.exe
C:\Windows\system32\drivers\down\160587.exe
C:\Windows\system32\drivers\down\160977.exe
C:\Windows\system32\drivers\down\161601.exe
C:\Windows\system32\drivers\down\162350.exe
C:\Windows\system32\drivers\down\164050.exe
C:\Windows\system32\drivers\down\164971.exe
C:\Windows\system32\drivers\down\165532.exe
C:\Windows\system32\drivers\down\167857.exe
C:\Windows\system32\drivers\down\169151.exe
C:\Windows\system32\drivers\down\170197.exe
C:\Windows\system32\drivers\down\170961.exe
C:\Windows\system32\drivers\down\171523.exe
C:\Windows\system32\drivers\down\172427.exe
C:\Windows\system32\drivers\down\173831.exe
C:\Windows\system32\drivers\down\175563.exe
C:\Windows\system32\drivers\down\176171.exe
C:\Windows\system32\drivers\down\177201.exe
C:\Windows\system32\drivers\down\178465.exe
C:\Windows\system32\drivers\down\181943.exe
C:\Windows\system32\drivers\down\182567.exe
C:\Windows\system32\drivers\down\183129.exe
C:\Windows\system32\drivers\down\183831.exe
C:\Windows\system32\drivers\down\185812.exe
C:\Windows\system32\drivers\down\186608.exe
C:\Windows\system32\drivers\down\186889.exe
C:\Windows\system32\drivers\down\188168.exe
C:\Windows\system32\drivers\down\188558.exe
C:\Windows\system32\drivers\down\189276.exe
C:\Windows\system32\drivers\down\189447.exe
C:\Windows\system32\drivers\down\190383.exe
C:\Windows\system32\drivers\down\196873.exe
C:\Windows\system32\drivers\down\197247.exe
C:\Windows\system32\drivers\down\199587.exe
C:\Windows\system32\drivers\down\202551.exe
C:\Windows\system32\drivers\down\202629.exe
C:\Windows\system32\drivers\down\204049.exe
C:\Windows\system32\drivers\down\204751.exe
C:\Windows\system32\drivers\down\205390.exe
C:\Windows\system32\drivers\down\209493.exe
C:\Windows\system32\drivers\down\213736.exe
C:\Windows\system32\drivers\down\216700.exe
C:\Windows\system32\drivers\down\217496.exe
C:\Windows\system32\drivers\down\220304.exe
C:\Windows\system32\drivers\down\220944.exe
C:\Windows\system32\drivers\down\223097.exe
C:\Windows\system32\drivers\down\224532.exe
C:\Windows\system32\drivers\down\230429.exe
C:\Windows\system32\drivers\down\238541.exe
C:\Windows\system32\drivers\down\243361.exe
C:\Windows\system32\drivers\down\245639.exe
C:\Windows\system32\drivers\down\249086.exe
C:\Windows\system32\drivers\down\249211.exe
C:\Windows\system32\drivers\down\251146.exe
C:\Windows\system32\drivers\down\253376.exe
C:\Windows\system32\drivers\down\261286.exe
C:\Windows\system32\drivers\down\265404.exe
C:\Windows\system32\drivers\down\269273.exe
C:\Windows\system32\drivers\down\269741.exe
C:\Windows\system32\drivers\down\286605.exe
C:\Windows\system32\drivers\down\293687.exe
C:\Windows\system32\drivers\down\305964.exe
C:\Windows\system32\drivers\down\314076.exe
C:\Windows\system32\drivers\down\324014.exe
C:\Windows\system32\drivers\down\3712215.exe
C:\Windows\system32\drivers\down\3712948.exe
C:\Windows\system32\drivers\down\3718252.exe
C:\Windows\system32\drivers\down\3724601.exe
C:\Windows\system32\drivers\down\3768890.exe
C:\Windows\system32\drivers\down\3774631.exe
C:\Windows\system32\drivers\down\3799263.exe
C:\Windows\system32\drivers\down\3810230.exe
C:\Windows\system32\drivers\down\3814474.exe
C:\Windows\system32\drivers\down\3815612.exe
C:\Windows\system32\drivers\down\3816096.exe
C:\Windows\system32\drivers\down\3819575.exe
C:\Windows\system32\drivers\down\3855081.exe
C:\Windows\system32\drivers\down\3861102.exe
C:\Windows\system32\drivers\down\512010.exe
C:\Windows\system32\drivers\down\514397.exe
C:\Windows\system32\drivers\down\515427.exe
C:\Windows\system32\drivers\down\530028.exe
C:\Windows\system32\drivers\down\53820.exe
C:\Windows\system32\drivers\down\538921.exe
C:\Windows\system32\drivers\down\54615.exe
C:\Windows\system32\drivers\down\565082.exe
C:\Windows\system32\drivers\down\572742.exe
C:\Windows\system32\drivers\down\58157.exe
C:\Windows\system32\drivers\down\59701.exe
C:\Windows\system32\drivers\down\60606.exe
C:\Windows\system32\drivers\down\61557.exe
C:\Windows\system32\drivers\down\62275.exe
C:\Windows\system32\drivers\down\64163.exe
C:\Windows\system32\drivers\down\65130.exe
C:\Windows\system32\drivers\down\65333.exe
C:\Windows\system32\drivers\down\68624.exe
C:\Windows\system32\drivers\down\68952.exe
C:\Windows\system32\drivers\down\69139.exe
C:\Windows\system32\drivers\down\70543.exe
C:\Windows\system32\drivers\down\70574.exe
C:\Windows\system32\drivers\down\71027.exe
C:\Windows\system32\drivers\down\71542.exe
C:\Windows\system32\drivers\down\71557.exe
C:\Windows\system32\drivers\down\72134.exe
C:\Windows\system32\drivers\down\72977.exe
C:\Windows\system32\drivers\down\73164.exe
C:\Windows\system32\drivers\down\74318.exe
C:\Windows\system32\drivers\down\78920.exe
C:\Windows\system32\drivers\down\79388.exe
C:\Windows\system32\drivers\down\80746.exe
C:\Windows\system32\drivers\down\81526.exe
C:\Windows\system32\drivers\down\84068.exe
C:\Windows\system32\drivers\down\89154.exe
C:\Windows\system32\drivers\down\89840.exe
C:\Windows\system32\drivers\down\89903.exe
C:\Windows\system32\drivers\down\90074.exe
C:\Windows\system32\drivers\down\92508.exe
C:\Windows\system32\drivers\down\92789.exe
C:\Windows\system32\drivers\down\93725.exe
C:\Windows\system32\drivers\down\93959.exe
C:\Windows\system32\drivers\down\94489.exe
C:\Windows\system32\drivers\down\94786.exe
C:\Windows\system32\drivers\down\97672.exe
C:\Windows\system32\drivers\down\99372.exe
C:\Windows\system32\drivers\hldrrr.exe
C:\Windows\system32\drivers\srosa.sys
C:\Windows\system32\jusched.exe
C:\Windows\system32\koos.exe
C:\Windows\system32\kprof
C:\Windows\system32\mdelk.exe
C:\Windows\system32\poof
C:\Windows\system32\wintems.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_IDSVIX86
-------\LEGACY_SROSA


((((((((((((((((((((((((((((( Fichiers créés 2008-02-14 to 2008-03-14 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-14 14:30 --------- d-----w C:\Program Files\Unlocker
2008-03-14 13:34 --------- d-----w C:\Program Files\Dvd-to-avi
2008-03-14 11:58 --------- d-----w C:\Program Files\CCleaner
2008-03-14 11:41 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-03-14 11:40 --------- d-----w C:\PROGRA~2\Microsoft Help
2008-03-13 21:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-13 21:24 --------- d-----w C:\Program Files\Defenza
2008-03-13 16:02 174 --sha-w C:\Program Files\desktop.ini
2008-03-13 15:42 --------- d-----w C:\Program Files\Alwil Software
2008-03-13 15:33 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-13 15:29 --------- d-----w C:\PROGRA~2\Symantec
2008-03-13 14:14 --------- d-----w C:\Program Files\DivX
2008-03-13 11:59 --------- d-----w C:\Users\mehdi\AppData\Roaming\SlySoft
2008-03-13 11:32 --------- d-----w C:\Program Files\WinXMedia
2008-03-12 15:01 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-03-12 13:03 --------- d-----w C:\Users\mehdi\AppData\Roaming\AVS4YOU
2008-03-12 11:15 --------- d-----w C:\Program Files\Windows Mail
2008-03-11 21:34 --------- d-----w C:\Users\mehdi\AppData\Roaming\dvdcss
2008-03-11 19:41 --------- d-----w C:\Users\mehdi\AppData\Roaming\Download Manager
2008-03-11 18:31 --------- d-----w C:\Users\mehdi\AppData\Roaming\DVD2AVI Ripper
2008-03-10 20:17 --------- d-----w C:\PROGRA~2\AVS4YOU
2008-03-10 18:23 --------- d-----w C:\Users\mehdi\AppData\Roaming\DivX
2008-03-10 18:21 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-03-09 13:26 --------- d-----w C:\Users\mehdi\AppData\Roaming\LimeWire
2008-02-29 16:15 --------- d-----w C:\Program Files\Astonsoft
2008-02-29 15:55 --------- d-----w C:\Users\mehdi\AppData\Roaming\DeepBurner
2008-02-29 15:41 --------- d-----w C:\Program Files\CDBurnerXP
2008-02-29 13:48 --------- d-----w C:\Users\mehdi\AppData\Roaming\vlc
2008-02-29 13:48 --------- d-----w C:\Program Files\VideoLAN
2008-02-29 12:31 --------- d-----w C:\Program Files\Common Files\Real
2008-02-29 11:20 --------- d-----w C:\Users\mehdi\AppData\Roaming\uTorrent
2008-02-28 15:02 --------- d-----w C:\Users\mehdi\AppData\Roaming\EoRezo
2008-02-28 11:24 --------- d-----w C:\Users\mehdi\AppData\Roaming\ItsLabel
2008-02-28 11:22 --------- d-----w C:\Program Files\Veoh Networks
2008-02-26 13:04 --------- d-----w C:\PROGRA~2\Roxio
2008-02-26 11:05 --------- d-----w C:\PROGRA~2\WLInstaller
2008-02-26 10:55 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-26 10:55 --------- d-----w C:\Program Files\Windows Live
2008-02-23 16:06 --------- d-----w C:\Users\mehdi\AppData\Roaming\Roxio
2008-02-19 09:23 --------- d-----w C:\PROGRA~2\LightScribe
2008-02-19 09:14 --------- d-----w C:\Users\mehdi\AppData\Roaming\Nero
2008-02-19 09:13 --------- d-----w C:\Program Files\Common Files\Nero
2008-02-18 21:33 --------- d-----w C:\Program Files\Common Files\Ahead
2008-02-18 19:34 --------- d-----w C:\Users\mehdi\AppData\Roaming\Ahead
2008-02-18 19:19 --------- d-----w C:\PROGRA~2\Ahead
2008-02-18 19:07 --------- d-----w C:\PROGRA~2\Sonic
2008-02-16 02:02 --------- d-----w C:\Program Files\Windows Calendar
2008-02-15 20:51 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-15 17:34 --------- d-----w C:\Program Files\Google
2008-02-15 16:05 --------- d-----w C:\PROGRA~2\Lavasoft
2008-02-15 16:04 --------- d-----w C:\Program Files\Lavasoft
2008-02-15 16:04 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-14 17:10 --------- d-----w C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
2008-02-14 17:10 --------- d-----w C:\PROGRA~2\{B3C2C1CD-6B77-4A96-B670-F734AC2A1CBC}
2008-02-14 17:08 --------- d-----w C:\Program Files\Microsoft Works
2008-02-14 17:07 --------- d-----w C:\Program Files\Microsoft.NET
2008-02-14 10:27 --------- d-----w C:\Program Files\EasyBits For Kids
2008-02-13 19:01 --------- d-----w C:\Program Files\uTorrent
2008-02-13 02:19 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-13 02:12 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-02-13 02:12 2,923,520 ----a-w C:\Windows\explorer.exe
2008-02-13 02:11 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-13 02:10 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-02-13 02:10 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-02-13 02:10 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-02-13 02:10 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-02-13 02:10 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-02-13 02:10 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-02-13 02:07 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-02-13 02:07 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-13 02:07 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-02-13 02:07 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-02-13 02:07 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-13 02:07 17,464 ----a-w C:\Windows\system32\drivers\intelide.sys
2008-02-13 02:07 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-13 02:07 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-02-13 02:07 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-13 02:06 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-13 02:06 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-13 02:04 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 02:04 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 02:04 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 02:04 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-13 02:03 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-02-13 02:03 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-02-13 02:03 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-02-13 02:03 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-02-13 02:02 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-13 02:01 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-12 23:25 --------- d-----w C:\PROGRA~2\Yahoo! Companion
2008-02-12 22:51 --------- d-----w C:\Users\mehdi\AppData\Roaming\Media Player Classic
2008-02-12 22:49 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-02-12 21:52 --------- d-----w C:\Program Files\Yahoo!
2008-02-12 21:37 --------- d-----w C:\Program Files\LimeWire
2008-02-12 20:36 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-02-12 20:36 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-02-12 14:29 --------- d-----w C:\Users\mehdi\AppData\Roaming\InstallShield
2008-02-12 14:29 --------- d-----w C:\Program Files\SAGEM
2008-02-12 12:56 --------- d-----w C:\PROGRA~2\Hewlett-Packard
2008-02-12 12:55 --------- d-----w C:\Users\mehdi\AppData\Roaming\Hewlett-Packard
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\Program Files\Alwil Software\Avast4\ashDisp.exe" [2008-03-14 15:35 79224]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E54729E8-BB3D-4270-9D49-7389EA579090}"= C:\Windows\system32\EZUPBH~1.DLL [2008-02-14 11:21 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3051918539-1774051585-2273590999-1001]
"EnableNotificationsRef"=dword:00000004

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C811BB3A-C6BF-48F1-A9B2-9E3A25CD7478}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{EF6CA61F-9863-45F4-8549-FD48443B7E7E}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{AD63F5DE-D4D5-42A6-8136-9102C7EF05E3}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{0AB6ED54-0E52-40D4-9621-20AB7D749574}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{66FF50A4-40D9-4C3E-A4CD-BC4C3A933208}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{DBCB39EF-C1D7-4419-9ECE-DE15D7C52483}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{2B83BC5B-2FC0-449C-91AE-F09F87BA0CCF}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{069B212C-2947-402F-BD6A-6350E37F07BA}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"TCP Query User{01FEE6C2-EA04-4A0A-B745-1783342ADA5C}C:\program files\limewire\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire|Desc=LimeWire
"UDP Query User{7B220E0A-276E-4115-B6D3-68CC07F3E536}C:\program files\limewire\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire|Desc=LimeWire
"TCP Query User{762BE115-B21E-4903-AB8A-46656039DCA3}C:\program files\utorrent\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent|Desc=uTorrent
"UDP Query User{A17D668C-33F2-44AF-9CC1-BEB0306E9B03}C:\program files\utorrent\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent|Desc=uTorrent
"{16C414C0-739C-4CF7-BF24-4861B12818D5}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{55D46A57-A986-4E93-80E2-A432520AE74C}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{1E40E234-AFBC-4FB3-A5D0-83D440A50090}C:\program files\internet explorer\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer|Desc=Internet Explorer
"UDP Query User{70D71B16-A4C6-4954-BBB6-D1671050DD20}C:\program files\internet explorer\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer|Desc=Internet Explorer
"TCP Query User{C972DA92-BAF9-44EB-B896-B2C2689B1A34}C:\users\mehdi\documents\emule\emule.exe"= UDP:C:\users\mehdi\documents\emule\emule.exe:emule.exe|Desc=emule.exe
"UDP Query User{41F39932-9771-450A-AEC2-F34BAF58E71D}C:\users\mehdi\documents\emule\emule.exe"= TCP:C:\users\mehdi\documents\emule\emule.exe:emule.exe|Desc=emule.exe
"{904BC2DD-EF98-401D-B2F7-0F9DA514B9E8}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)|Edge=TRUE|
"TCP Query User{2A5FA4F0-3567-467F-83C9-47AE2276BDB7}C:\users\mehdi\program files\utorrent\utorrent.exe"= UDP:C:\users\mehdi\program files\utorrent\utorrent.exe:utorrent.exe|Desc=utorrent.exe
"UDP Query User{0EED8977-5CFF-4913-820E-0620A5715339}C:\users\mehdi\program files\utorrent\utorrent.exe"= TCP:C:\users\mehdi\program files\utorrent\utorrent.exe:utorrent.exe|Desc=utorrent.exe
"TCP Query User{CEB3A5E4-84B5-44DA-ABCF-E91146A01D08}C:\program files\veoh networks\veoh\veohclient.exe"= UDP:C:\program files\veoh networks\veoh\veohclient.exe:Veoh Client|Desc=Veoh Client
"UDP Query User{F4B8A785-58AB-426C-9DEB-2B03AB3F5284}C:\program files\veoh networks\veoh\veohclient.exe"= TCP:C:\program files\veoh networks\veoh\veohclient.exe:Veoh Client|Desc=Veoh Client
"TCP Query User{22468C28-E977-4843-B6AC-E3BE8F54647D}C:\program files\real\realplayer\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer|Desc=RealPlayer
"UDP Query User{3ABC085A-B971-4CD1-B628-229EB0BAEE2C}C:\program files\real\realplayer\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer|Desc=RealPlayer
"TCP Query User{9BA11ECA-F2F9-475E-B5C0-51347EC72262}C:\program files\mozilla firefox\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox
"UDP Query User{B1801739-1447-4F47-BBCF-01810D4F3CB5}C:\program files\mozilla firefox\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
R2 DQLWinService;DQLWinService;"C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe" [2006-09-03 09:32]
R2 ezntsvc;EasyBits Magic Desktop Services for Windows NT;C:\Windows\system32\ezNTSvc.exe [2008-02-14 11:21]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 08:34]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-07-10 01:35]
S2 IntelDHSvcConf;Intel DH Service;"C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe" [2006-05-10 08:13]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-14 15:40:12
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\msiexec.exe
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
C:\Windows\system32\conime.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-14 15:41:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-14 14:41:39
.
2008-03-14 11:41:36 --- E O F ---
merci d'avance

salut green day je ne suis pa sur que tu es recu mon rapport don je te le remets ente remerciant beaucoupComboFix 08-03-03.15 - mehdi 2008-03-14 15:34:57.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.2044 [GMT 1:00]
Endroit: C:\Users\mehdi\Desktop\Combo-Fix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\drivers\down
C:\Windows\system32\drivers\down\104583.exe
C:\Windows\system32\drivers\down\104801.exe
C:\Windows\system32\drivers\down\105581.exe
C:\Windows\system32\drivers\down\105721.exe
C:\Windows\system32\drivers\down\105862.exe
C:\Windows\system32\drivers\down\106720.exe
C:\Windows\system32\drivers\down\108810.exe
C:\Windows\system32\drivers\down\109824.exe
C:\Windows\system32\drivers\down\110511.exe
C:\Windows\system32\drivers\down\112102.exe
C:\Windows\system32\drivers\down\113911.exe
C:\Windows\system32\drivers\down\114348.exe
C:\Windows\system32\drivers\down\115003.exe
C:\Windows\system32\drivers\down\115518.exe
C:\Windows\system32\drivers\down\116907.exe
C:\Windows\system32\drivers\down\119605.exe
C:\Windows\system32\drivers\down\121555.exe
C:\Windows\system32\drivers\down\122101.exe
C:\Windows\system32\drivers\down\122757.exe
C:\Windows\system32\drivers\down\123724.exe
C:\Windows\system32\drivers\down\124925.exe
C:\Windows\system32\drivers\down\125768.exe
C:\Windows\system32\drivers\down\131852.exe
C:\Windows\system32\drivers\down\131930.exe
C:\Windows\system32\drivers\down\132803.exe
C:\Windows\system32\drivers\down\133490.exe
C:\Windows\system32\drivers\down\135081.exe
C:\Windows\system32\drivers\down\137530.exe
C:\Windows\system32\drivers\down\137873.exe
C:\Windows\system32\drivers\down\138404.exe
C:\Windows\system32\drivers\down\138528.exe
C:\Windows\system32\drivers\down\141976.exe
C:\Windows\system32\drivers\down\144410.exe
C:\Windows\system32\drivers\down\146297.exe
C:\Windows\system32\drivers\down\148668.exe
C:\Windows\system32\drivers\down\149292.exe
C:\Windows\system32\drivers\down\150837.exe
C:\Windows\system32\drivers\down\151617.exe
C:\Windows\system32\drivers\down\153208.exe
C:\Windows\system32\drivers\down\154019.exe
C:\Windows\system32\drivers\down\154191.exe
C:\Windows\system32\drivers\down\154565.exe
C:\Windows\system32\drivers\down\155501.exe
C:\Windows\system32\drivers\down\155969.exe
C:\Windows\system32\drivers\down\156874.exe
C:\Windows\system32\drivers\down\158887.exe
C:\Windows\system32\drivers\down\159979.exe
C:\Windows\system32\drivers\down\160259.exe
C:\Windows\system32\drivers\down\160587.exe
C:\Windows\system32\drivers\down\160977.exe
C:\Windows\system32\drivers\down\161601.exe
C:\Windows\system32\drivers\down\162350.exe
C:\Windows\system32\drivers\down\164050.exe
C:\Windows\system32\drivers\down\164971.exe
C:\Windows\system32\drivers\down\165532.exe
C:\Windows\system32\drivers\down\167857.exe
C:\Windows\system32\drivers\down\169151.exe
C:\Windows\system32\drivers\down\170197.exe
C:\Windows\system32\drivers\down\170961.exe
C:\Windows\system32\drivers\down\171523.exe
C:\Windows\system32\drivers\down\172427.exe
C:\Windows\system32\drivers\down\173831.exe
C:\Windows\system32\drivers\down\175563.exe
C:\Windows\system32\drivers\down\176171.exe
C:\Windows\system32\drivers\down\177201.exe
C:\Windows\system32\drivers\down\178465.exe
C:\Windows\system32\drivers\down\181943.exe
C:\Windows\system32\drivers\down\182567.exe
C:\Windows\system32\drivers\down\183129.exe
C:\Windows\system32\drivers\down\183831.exe
C:\Windows\system32\drivers\down\185812.exe
C:\Windows\system32\drivers\down\186608.exe
C:\Windows\system32\drivers\down\186889.exe
C:\Windows\system32\drivers\down\188168.exe
C:\Windows\system32\drivers\down\188558.exe
C:\Windows\system32\drivers\down\189276.exe
C:\Windows\system32\drivers\down\189447.exe
C:\Windows\system32\drivers\down\190383.exe
C:\Windows\system32\drivers\down\196873.exe
C:\Windows\system32\drivers\down\197247.exe
C:\Windows\system32\drivers\down\199587.exe
C:\Windows\system32\drivers\down\202551.exe
C:\Windows\system32\drivers\down\202629.exe
C:\Windows\system32\drivers\down\204049.exe
C:\Windows\system32\drivers\down\204751.exe
C:\Windows\system32\drivers\down\205390.exe
C:\Windows\system32\drivers\down\209493.exe
C:\Windows\system32\drivers\down\213736.exe
C:\Windows\system32\drivers\down\216700.exe
C:\Windows\system32\drivers\down\217496.exe
C:\Windows\system32\drivers\down\220304.exe
C:\Windows\system32\drivers\down\220944.exe
C:\Windows\system32\drivers\down\223097.exe
C:\Windows\system32\drivers\down\224532.exe
C:\Windows\system32\drivers\down\230429.exe
C:\Windows\system32\drivers\down\238541.exe
C:\Windows\system32\drivers\down\243361.exe
C:\Windows\system32\drivers\down\245639.exe
C:\Windows\system32\drivers\down\249086.exe
C:\Windows\system32\drivers\down\249211.exe
C:\Windows\system32\drivers\down\251146.exe
C:\Windows\system32\drivers\down\253376.exe
C:\Windows\system32\drivers\down\261286.exe
C:\Windows\system32\drivers\down\265404.exe
C:\Windows\system32\drivers\down\269273.exe
C:\Windows\system32\drivers\down\269741.exe
C:\Windows\system32\drivers\down\286605.exe
C:\Windows\system32\drivers\down\293687.exe
C:\Windows\system32\drivers\down\305964.exe
C:\Windows\system32\drivers\down\314076.exe
C:\Windows\system32\drivers\down\324014.exe
C:\Windows\system32\drivers\down\3712215.exe
C:\Windows\system32\drivers\down\3712948.exe
C:\Windows\system32\drivers\down\3718252.exe
C:\Windows\system32\drivers\down\3724601.exe
C:\Windows\system32\drivers\down\3768890.exe
C:\Windows\system32\drivers\down\3774631.exe
C:\Windows\system32\drivers\down\3799263.exe
C:\Windows\system32\drivers\down\3810230.exe
C:\Windows\system32\drivers\down\3814474.exe
C:\Windows\system32\drivers\down\3815612.exe
C:\Windows\system32\drivers\down\3816096.exe
C:\Windows\system32\drivers\down\3819575.exe
C:\Windows\system32\drivers\down\3855081.exe
C:\Windows\system32\drivers\down\3861102.exe
C:\Windows\system32\drivers\down\512010.exe
C:\Windows\system32\drivers\down\514397.exe
C:\Windows\system32\drivers\down\515427.exe
C:\Windows\system32\drivers\down\530028.exe
C:\Windows\system32\drivers\down\53820.exe
C:\Windows\system32\drivers\down\538921.exe
C:\Windows\system32\drivers\down\54615.exe
C:\Windows\system32\drivers\down\565082.exe
C:\Windows\system32\drivers\down\572742.exe
C:\Windows\system32\drivers\down\58157.exe
C:\Windows\system32\drivers\down\59701.exe
C:\Windows\system32\drivers\down\60606.exe
C:\Windows\system32\drivers\down\61557.exe
C:\Windows\system32\drivers\down\62275.exe
C:\Windows\system32\drivers\down\64163.exe
C:\Windows\system32\drivers\down\65130.exe
C:\Windows\system32\drivers\down\65333.exe
C:\Windows\system32\drivers\down\68624.exe
C:\Windows\system32\drivers\down\68952.exe
C:\Windows\system32\drivers\down\69139.exe
C:\Windows\system32\drivers\down\70543.exe
C:\Windows\system32\drivers\down\70574.exe
C:\Windows\system32\drivers\down\71027.exe
C:\Windows\system32\drivers\down\71542.exe
C:\Windows\system32\drivers\down\71557.exe
C:\Windows\system32\drivers\down\72134.exe
C:\Windows\system32\drivers\down\72977.exe
C:\Windows\system32\drivers\down\73164.exe
C:\Windows\system32\drivers\down\74318.exe
C:\Windows\system32\drivers\down\78920.exe
C:\Windows\system32\drivers\down\79388.exe
C:\Windows\system32\drivers\down\80746.exe
C:\Windows\system32\drivers\down\81526.exe
C:\Windows\system32\drivers\down\84068.exe
C:\Windows\system32\drivers\down\89154.exe
C:\Windows\system32\drivers\down\89840.exe
C:\Windows\system32\drivers\down\89903.exe
C:\Windows\system32\drivers\down\90074.exe
C:\Windows\system32\drivers\down\92508.exe
C:\Windows\system32\drivers\down\92789.exe
C:\Windows\system32\drivers\down\93725.exe
C:\Windows\system32\drivers\down\93959.exe
C:\Windows\system32\drivers\down\94489.exe
C:\Windows\system32\drivers\down\94786.exe
C:\Windows\system32\drivers\down\97672.exe
C:\Windows\system32\drivers\down\99372.exe
C:\Windows\system32\drivers\hldrrr.exe
C:\Windows\system32\drivers\srosa.sys
C:\Windows\system32\jusched.exe
C:\Windows\system32\koos.exe
C:\Windows\system32\kprof
C:\Windows\system32\mdelk.exe
C:\Windows\system32\poof
C:\Windows\system32\wintems.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_IDSVIX86
-------\LEGACY_SROSA


((((((((((((((((((((((((((((( Fichiers créés 2008-02-14 to 2008-03-14 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-14 14:30 --------- d-----w C:\Program Files\Unlocker
2008-03-14 13:34 --------- d-----w C:\Program Files\Dvd-to-avi
2008-03-14 11:58 --------- d-----w C:\Program Files\CCleaner
2008-03-14 11:41 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-03-14 11:40 --------- d-----w C:\PROGRA~2\Microsoft Help
2008-03-13 21:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-13 21:24 --------- d-----w C:\Program Files\Defenza
2008-03-13 16:02 174 --sha-w C:\Program Files\desktop.ini
2008-03-13 15:42 --------- d-----w C:\Program Files\Alwil Software
2008-03-13 15:33 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-13 15:29 --------- d-----w C:\PROGRA~2\Symantec
2008-03-13 14:14 --------- d-----w C:\Program Files\DivX
2008-03-13 11:59 --------- d-----w C:\Users\mehdi\AppData\Roaming\SlySoft
2008-03-13 11:32 --------- d-----w C:\Program Files\WinXMedia
2008-03-12 15:01 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-03-12 13:03 --------- d-----w C:\Users\mehdi\AppData\Roaming\AVS4YOU
2008-03-12 11:15 --------- d-----w C:\Program Files\Windows Mail
2008-03-11 21:34 --------- d-----w C:\Users\mehdi\AppData\Roaming\dvdcss
2008-03-11 19:41 --------- d-----w C:\Users\mehdi\AppData\Roaming\Download Manager
2008-03-11 18:31 --------- d-----w C:\Users\mehdi\AppData\Roaming\DVD2AVI Ripper
2008-03-10 20:17 --------- d-----w C:\PROGRA~2\AVS4YOU
2008-03-10 18:23 --------- d-----w C:\Users\mehdi\AppData\Roaming\DivX
2008-03-10 18:21 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-03-09 13:26 --------- d-----w C:\Users\mehdi\AppData\Roaming\LimeWire
2008-02-29 16:15 --------- d-----w C:\Program Files\Astonsoft
2008-02-29 15:55 --------- d-----w C:\Users\mehdi\AppData\Roaming\DeepBurner
2008-02-29 15:41 --------- d-----w C:\Program Files\CDBurnerXP
2008-02-29 13:48 --------- d-----w C:\Users\mehdi\AppData\Roaming\vlc
2008-02-29 13:48 --------- d-----w C:\Program Files\VideoLAN
2008-02-29 12:31 --------- d-----w C:\Program Files\Common Files\Real
2008-02-29 11:20 --------- d-----w C:\Users\mehdi\AppData\Roaming\uTorrent
2008-02-28 15:02 --------- d-----w C:\Users\mehdi\AppData\Roaming\EoRezo
2008-02-28 11:24 --------- d-----w C:\Users\mehdi\AppData\Roaming\ItsLabel
2008-02-28 11:22 --------- d-----w C:\Program Files\Veoh Networks
2008-02-26 13:04 --------- d-----w C:\PROGRA~2\Roxio
2008-02-26 11:05 --------- d-----w C:\PROGRA~2\WLInstaller
2008-02-26 10:55 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-26 10:55 --------- d-----w C:\Program Files\Windows Live
2008-02-23 16:06 --------- d-----w C:\Users\mehdi\AppData\Roaming\Roxio
2008-02-19 09:23 --------- d-----w C:\PROGRA~2\LightScribe
2008-02-19 09:14 --------- d-----w C:\Users\mehdi\AppData\Roaming\Nero
2008-02-19 09:13 --------- d-----w C:\Program Files\Common Files\Nero
2008-02-18 21:33 --------- d-----w C:\Program Files\Common Files\Ahead
2008-02-18 19:34 --------- d-----w C:\Users\mehdi\AppData\Roaming\Ahead
2008-02-18 19:19 --------- d-----w C:\PROGRA~2\Ahead
2008-02-18 19:07 --------- d-----w C:\PROGRA~2\Sonic
2008-02-16 02:02 --------- d-----w C:\Program Files\Windows Calendar
2008-02-15 20:51 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-15 17:34 --------- d-----w C:\Program Files\Google
2008-02-15 16:05 --------- d-----w C:\PROGRA~2\Lavasoft
2008-02-15 16:04 --------- d-----w C:\Program Files\Lavasoft
2008-02-15 16:04 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-14 17:10 --------- d-----w C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
2008-02-14 17:10 --------- d-----w C:\PROGRA~2\{B3C2C1CD-6B77-4A96-B670-F734AC2A1CBC}
2008-02-14 17:08 --------- d-----w C:\Program Files\Microsoft Works
2008-02-14 17:07 --------- d-----w C:\Program Files\Microsoft.NET
2008-02-14 10:27 --------- d-----w C:\Program Files\EasyBits For Kids
2008-02-13 19:01 --------- d-----w C:\Program Files\uTorrent
2008-02-13 02:19 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-13 02:12 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-02-13 02:12 2,923,520 ----a-w C:\Windows\explorer.exe
2008-02-13 02:11 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-13 02:10 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-02-13 02:10 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-02-13 02:10 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-02-13 02:10 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-02-13 02:10 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-02-13 02:10 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-02-13 02:07 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-02-13 02:07 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-13 02:07 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-02-13 02:07 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-02-13 02:07 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-13 02:07 17,464 ----a-w C:\Windows\system32\drivers\intelide.sys
2008-02-13 02:07 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-13 02:07 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-02-13 02:07 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-13 02:06 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-13 02:06 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-13 02:04 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 02:04 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 02:04 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 02:04 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-13 02:03 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-02-13 02:03 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-02-13 02:03 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-02-13 02:03 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-02-13 02:02 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-13 02:01 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-12 23:25 --------- d-----w C:\PROGRA~2\Yahoo! Companion
2008-02-12 22:51 --------- d-----w C:\Users\mehdi\AppData\Roaming\Media Player Classic
2008-02-12 22:49 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-02-12 21:52 --------- d-----w C:\Program Files\Yahoo!
2008-02-12 21:37 --------- d-----w C:\Program Files\LimeWire
2008-02-12 20:36 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-02-12 20:36 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-02-12 14:29 --------- d-----w C:\Users\mehdi\AppData\Roaming\InstallShield
2008-02-12 14:29 --------- d-----w C:\Program Files\SAGEM
2008-02-12 12:56 --------- d-----w C:\PROGRA~2\Hewlett-Packard
2008-02-12 12:55 --------- d-----w C:\Users\mehdi\AppData\Roaming\Hewlett-Packard
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\Program Files\Alwil Software\Avast4\ashDisp.exe" [2008-03-14 15:35 79224]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E54729E8-BB3D-4270-9D49-7389EA579090}"= C:\Windows\system32\EZUPBH~1.DLL [2008-02-14 11:21 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3051918539-1774051585-2273590999-1001]
"EnableNotificationsRef"=dword:00000004

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C811BB3A-C6BF-48F1-A9B2-9E3A25CD7478}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{EF6CA61F-9863-45F4-8549-FD48443B7E7E}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{AD63F5DE-D4D5-42A6-8136-9102C7EF05E3}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{0AB6ED54-0E52-40D4-9621-20AB7D749574}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{66FF50A4-40D9-4C3E-A4CD-BC4C3A933208}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{DBCB39EF-C1D7-4419-9ECE-DE15D7C52483}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{2B83BC5B-2FC0-449C-91AE-F09F87BA0CCF}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{069B212C-2947-402F-BD6A-6350E37F07BA}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"TCP Query User{01FEE6C2-EA04-4A0A-B745-1783342ADA5C}C:\program files\limewire\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire|Desc=LimeWire
"UDP Query User{7B220E0A-276E-4115-B6D3-68CC07F3E536}C:\program files\limewire\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire|Desc=LimeWire
"TCP Query User{762BE115-B21E-4903-AB8A-46656039DCA3}C:\program files\utorrent\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent|Desc=uTorrent
"UDP Query User{A17D668C-33F2-44AF-9CC1-BEB0306E9B03}C:\program files\utorrent\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent|Desc=uTorrent
"{16C414C0-739C-4CF7-BF24-4861B12818D5}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{55D46A57-A986-4E93-80E2-A432520AE74C}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{1E40E234-AFBC-4FB3-A5D0-83D440A50090}C:\program files\internet explorer\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer|Desc=Internet Explorer
"UDP Query User{70D71B16-A4C6-4954-BBB6-D1671050DD20}C:\program files\internet explorer\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer|Desc=Internet Explorer
"TCP Query User{C972DA92-BAF9-44EB-B896-B2C2689B1A34}C:\users\mehdi\documents\emule\emule.exe"= UDP:C:\users\mehdi\documents\emule\emule.exe:emule.exe|Desc=emule.exe
"UDP Query User{41F39932-9771-450A-AEC2-F34BAF58E71D}C:\users\mehdi\documents\emule\emule.exe"= TCP:C:\users\mehdi\documents\emule\emule.exe:emule.exe|Desc=emule.exe
"{904BC2DD-EF98-401D-B2F7-0F9DA514B9E8}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)|Edge=TRUE|
"TCP Query User{2A5FA4F0-3567-467F-83C9-47AE2276BDB7}C:\users\mehdi\program files\utorrent\utorrent.exe"= UDP:C:\users\mehdi\program files\utorrent\utorrent.exe:utorrent.exe|Desc=utorrent.exe
"UDP Query User{0EED8977-5CFF-4913-820E-0620A5715339}C:\users\mehdi\program files\utorrent\utorrent.exe"= TCP:C:\users\mehdi\program files\utorrent\utorrent.exe:utorrent.exe|Desc=utorrent.exe
"TCP Query User{CEB3A5E4-84B5-44DA-ABCF-E91146A01D08}C:\program files\veoh networks\veoh\veohclient.exe"= UDP:C:\program files\veoh networks\veoh\veohclient.exe:Veoh Client|Desc=Veoh Client
"UDP Query User{F4B8A785-58AB-426C-9DEB-2B03AB3F5284}C:\program files\veoh networks\veoh\veohclient.exe"= TCP:C:\program files\veoh networks\veoh\veohclient.exe:Veoh Client|Desc=Veoh Client
"TCP Query User{22468C28-E977-4843-B6AC-E3BE8F54647D}C:\program files\real\realplayer\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer|Desc=RealPlayer
"UDP Query User{3ABC085A-B971-4CD1-B628-229EB0BAEE2C}C:\program files\real\realplayer\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer|Desc=RealPlayer
"TCP Query User{9BA11ECA-F2F9-475E-B5C0-51347EC72262}C:\program files\mozilla firefox\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox
"UDP Query User{B1801739-1447-4F47-BBCF-01810D4F3CB5}C:\program files\mozilla firefox\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox|Desc=Firefox

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
R2 DQLWinService;DQLWinService;"C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe" [2006-09-03 09:32]
R2 ezntsvc;EasyBits Magic Desktop Services for Windows NT;C:\Windows\system32\ezNTSvc.exe [2008-02-14 11:21]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 08:34]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-07-10 01:35]
S2 IntelDHSvcConf;Intel DH Service;"C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe" [2006-05-10 08:13]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-14 15:40:12
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\msiexec.exe
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
C:\Windows\system32\conime.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-14 15:41:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-14 14:41:39
.
2008-03-14 11:41:36 --- E O F ---

voila le rapport green day et merci pour ton tempsGMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-03-14 17:51:01
Windows 5.1.2600 Service Pack 2


---- Kernel code sections - GMER 1.0.14 ----

? C:\Windows\system32\Drivers\PROCEXP90.SYS Le fichier spécifié est introuvable. !

---- User IAT/EAT - GMER 1.0.14 ----

IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCloneImage] [7021FE0C] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDrawImageRectI] [701EC53D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipSetInterpolationMode] [701DA31F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipSetCompositingMode] [701DCBEF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCreateFromHDC] [701D8AAA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCreateBitmapFromStream] [701EDAB8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipGetImageHeight] [701D7D8D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipGetImageWidth] [701D7CF4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDisposeImage] [701D6A4E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipLoadImageFromFileICM] [7026BE7C] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipLoadImageFromFile] [701F8A5E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDeleteGraphics] [701D90CD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipFree] [701E2248] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipAlloc] [701E2273] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdiplusShutdown] [701E7724] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdiplusStartup] [701E7546] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[3244] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCreateBitmapFromStreamICM] [7021861D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Registry - GMER 1.0.14 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion@CurrentVersion 6.0
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion@CurrentBuildNumber 6000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion@ProductName Windows Vista (TM) Home Premium
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@LoadAppInit_DLLs 0
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@IconServiceLib IconCodecService.dll
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DdeSendTimeout 0
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DesktopHeapLogging 1
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@ShutdownWarningDialogTimeout -1
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERPostMessageLimit 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@ mnmsrvc
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90

---- EOF - GMER 1.0.14 ----

Salut

merci de créer ton propre poste ! ;-)

celui-ci est déjà en cours !



++

Merci beaucoup pour ta reponse papimarcel en fait j'etais infecté par bagle c vrai je ne sais pas si tume dis ca pour mon probleme de mise a jour d'antivir ou pour les autres messages.Suite a mon infection j'ai fait une restauration systeme a une date anterieur(15 jours) donc je pense que c reglé mais la tu m'inquiete j'ai fait des recherches sur ANTIVIR et dans leur site il disent que c un defaut de la version grtuite et qu'il y a un correctif a appliquer.
J'ai quand meme procedé comme tu m'a indiqué mais je n'arrive pas a purger les restauration systeme.Jesuis sous vista et dans le panneau de configuration il n'y a pas cet option.Pourrez tu m'en dire plus Merci d'avance.Je te fourni quand meme les rapports:03/16/08 14:08:25 [Info]: BlackLight Engine 1.0.67 initialized
03/16/08 14:08:25 [Info]: OS: 6.0 build 6000 ()
03/16/08 14:08:25 [Note]: 7019 4
03/16/08 14:08:25 [Note]: 7005 0
03/16/08 14:08:30 [Note]: 7006 0
03/16/08 14:08:30 [Note]: 7027 0
03/16/08 14:08:30 [Note]: 7026 0
03/16/08 14:08:31 [Note]: 7026 0
03/16/08 14:08:32 [Note]: FSRAW library version 1.7.1024
03/16/08 14:12:22 [Note]: 7007 0

ComboFix 08-03-14.4 - mehdi 2008-03-16 14:00:22.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.2186 [GMT 1:00]
Endroit: C:\Users\mehdi\Desktop\Combo-Fix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\jusched.exe
C:\Windows\system32\koos.exe
C:\Windows\system32\kprof
C:\Windows\system32\poof

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\LEGACY_IDSVIX86


((((((((((((((((((((((((((((( Fichiers créés 2008-02-16 to 2008-03-16 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 01:54 --------- d-----w C:\Program Files\Avira
2008-03-14 22:07 --------- d-----w C:\Program Files\Windows Mail
2008-03-14 21:58 --------- d-----w C:\PROGRA~2\Microsoft Help
2008-03-14 21:40 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-14 21:09 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-14 21:09 --------- d-----w C:\Users\mehdi\AppData\Roaming\uTorrent
2008-03-14 21:09 --------- d-----w C:\Users\mehdi\AppData\Roaming\EoRezo
2008-03-14 21:09 --------- d-----w C:\Users\mehdi\AppData\Roaming\dvdcss
2008-03-14 21:09 --------- d-----w C:\Users\mehdi\AppData\Roaming\DeepBurner
2008-03-14 21:09 --------- d-----w C:\Program Files\Microsoft Works
2008-03-14 21:09 --------- d-----w C:\Program Files\Google
2008-03-14 21:09 --------- d-----w C:\Program Files\EoRezo
2008-03-14 21:09 --------- d-----w C:\Program Files\DivX
2008-03-14 21:09 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2008-03-14 21:09 --------- d-----w C:\Program Files\CCleaner
2008-03-14 20:57 --------- d-----w C:\PROGRA~2\Spybot - Search & Destroy
2008-03-14 20:45 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-14 11:41 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-03-13 21:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-13 11:59 --------- d-----w C:\Users\mehdi\AppData\Roaming\SlySoft
2008-03-12 15:01 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-03-12 13:03 --------- d-----w C:\Users\mehdi\AppData\Roaming\AVS4YOU
2008-03-11 19:41 --------- d-----w C:\Users\mehdi\AppData\Roaming\Download Manager
2008-03-11 18:31 --------- d-----w C:\Users\mehdi\AppData\Roaming\DVD2AVI Ripper
2008-03-10 20:17 --------- d-----w C:\PROGRA~2\AVS4YOU
2008-03-10 18:23 --------- d-----w C:\Users\mehdi\AppData\Roaming\DivX
2008-03-10 18:21 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-03-09 13:26 --------- d-----w C:\Users\mehdi\AppData\Roaming\LimeWire
2008-02-29 15:41 --------- d-----w C:\Program Files\CDBurnerXP
2008-02-29 13:48 --------- d-----w C:\Users\mehdi\AppData\Roaming\vlc
2008-02-29 13:48 --------- d-----w C:\Program Files\VideoLAN
2008-02-29 12:31 --------- d-----w C:\Program Files\Common Files\Real
2008-02-28 11:24 --------- d-----w C:\Users\mehdi\AppData\Roaming\ItsLabel
2008-02-28 11:22 --------- d-----w C:\Program Files\Veoh Networks
2008-02-26 13:04 --------- d-----w C:\PROGRA~2\Roxio
2008-02-26 11:05 --------- d-----w C:\PROGRA~2\WLInstaller
2008-02-26 10:55 --------- d-----w C:\Program Files\Windows Live
2008-02-23 16:06 --------- d-----w C:\Users\mehdi\AppData\Roaming\Roxio
2008-02-19 09:23 --------- d-----w C:\PROGRA~2\LightScribe
2008-02-19 09:14 --------- d-----w C:\Users\mehdi\AppData\Roaming\Nero
2008-02-19 09:13 --------- d-----w C:\Program Files\Common Files\Nero
2008-02-18 21:33 --------- d-----w C:\Program Files\Common Files\Ahead
2008-02-18 19:34 --------- d-----w C:\Users\mehdi\AppData\Roaming\Ahead
2008-02-18 19:19 --------- d-----w C:\PROGRA~2\Ahead
2008-02-18 19:07 --------- d-----w C:\PROGRA~2\Sonic
2008-02-16 02:04 174 --sha-w C:\Program Files\desktop.ini
2008-02-16 02:02 --------- d-----w C:\Program Files\Windows Calendar
2008-02-15 20:51 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-15 16:05 --------- d-----w C:\PROGRA~2\Lavasoft
2008-02-15 16:04 --------- d-----w C:\Program Files\Lavasoft
2008-02-15 16:04 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-14 17:10 --------- d-----w C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
2008-02-14 17:10 --------- d-----w C:\PROGRA~2\{B3C2C1CD-6B77-4A96-B670-F734AC2A1CBC}
2008-02-14 17:07 --------- d-----w C:\Program Files\Microsoft.NET
2008-02-14 10:27 --------- d-----w C:\Program Files\EasyBits For Kids
2008-02-13 19:01 --------- d-----w C:\Program Files\uTorrent
2008-02-13 02:19 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-13 02:12 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-02-13 02:12 2,923,520 ----a-w C:\Windows\explorer.exe
2008-02-13 02:11 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-13 02:10 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-02-13 02:10 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-02-13 02:10 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-02-13 02:10 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-02-13 02:10 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-02-13 02:10 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-02-13 02:07 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-02-13 02:07 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-13 02:07 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-02-13 02:07 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-02-13 02:07 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-13 02:07 17,464 ----a-w C:\Windows\system32\drivers\intelide.sys
2008-02-13 02:07 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-13 02:07 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-02-13 02:07 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-13 02:06 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-13 02:06 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-13 02:04 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 02:04 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 02:04 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 02:04 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-13 02:03 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-02-13 02:03 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-02-13 02:03 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-02-13 02:03 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-02-13 02:02 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-13 02:01 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-12 23:25 --------- d-----w C:\PROGRA~2\Yahoo! Companion
2008-02-12 22:51 --------- d-----w C:\Users\mehdi\AppData\Roaming\Media Player Classic
2008-02-12 22:49 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-02-12 21:52 --------- d-----w C:\Program Files\Yahoo!
2008-02-12 21:37 --------- d-----w C:\Program Files\LimeWire
2008-02-12 20:36 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-02-12 20:36 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-02-12 14:29 --------- d-----w C:\Users\mehdi\AppData\Roaming\InstallShield
2008-02-12 14:29 --------- d-----w C:\Program Files\SAGEM
2008-02-12 12:56 --------- d-----w C:\PROGRA~2\Hewlett-Packard
2008-02-12 12:55 --------- d-----w C:\Users\mehdi\AppData\Roaming\Hewlett-Packard
2008-02-12 12:55 --------- d-----w C:\Users\mehdi\AppData\Roaming\ATI
2008-02-12 12:50 1,820 --sha-r C:\Windows\system32\drivers\103C_HP_CPC_GX598AA-ABF a6221.fr_YC_0Pavi_QCNX737_E74FRv3PrA1_49_ILeonite2_SASUSTek Computer INC._V6.00_B5.21_T070727_WUH0_L40C_M3070_J360_7Intel_8Core2 Duo E4400_92_#071123_N808627DC_Z_G100294C3.MRK
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\System32\msconfig.exe" [2006-11-02 10:45 222208]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 12:25 249896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E54729E8-BB3D-4270-9D49-7389EA579090}"= C:\Windows\system32\EZUPBH~1.DLL [2008-02-14 11:21 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C811BB3A-C6BF-48F1-A9B2-9E3A25CD7478}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{EF6CA61F-9863-45F4-8549-FD48443B7E7E}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{AD63F5DE-D4D5-42A6-8136-9102C7EF05E3}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{0AB6ED54-0E52-40D4-9621-20AB7D749574}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{66FF50A4-40D9-4C3E-A4CD-BC4C3A933208}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{DBCB39EF-C1D7-4419-9ECE-DE15D7C52483}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{2B83BC5B-2FC0-449C-91AE-F09F87BA0CCF}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{069B212C-2947-402F-BD6A-6350E37F07BA}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"TCP Query User{01FEE6C2-EA04-4A0A-B745-1783342ADA5C}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{7B220E0A-276E-4115-B6D3-68CC07F3E536}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{762BE115-B21E-4903-AB8A-46656039DCA3}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{A17D668C-33F2-44AF-9CC1-BEB0306E9B03}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{16C414C0-739C-4CF7-BF24-4861B12818D5}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{55D46A57-A986-4E93-80E2-A432520AE74C}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{1E40E234-AFBC-4FB3-A5D0-83D440A50090}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{70D71B16-A4C6-4954-BBB6-D1671050DD20}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{C972DA92-BAF9-44EB-B896-B2C2689B1A34}C:\\users\\mehdi\\documents\\emule\\emule.exe"= UDP:C:\users\mehdi\documents\emule\emule.exe:emule.exe
"UDP Query User{41F39932-9771-450A-AEC2-F34BAF58E71D}C:\\users\\mehdi\\documents\\emule\\emule.exe"= TCP:C:\users\mehdi\documents\emule\emule.exe:emule.exe
"{904BC2DD-EF98-401D-B2F7-0F9DA514B9E8}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{2A5FA4F0-3567-467F-83C9-47AE2276BDB7}C:\\users\\mehdi\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\mehdi\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{0EED8977-5CFF-4913-820E-0620A5715339}C:\\users\\mehdi\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\mehdi\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{CEB3A5E4-84B5-44DA-ABCF-E91146A01D08}C:\\program files\\veoh networks\\veoh\\veohclient.exe"= UDP:C:\program files\veoh networks\veoh\veohclient.exe:Veoh Client
"UDP Query User{F4B8A785-58AB-426C-9DEB-2B03AB3F5284}C:\\program files\\veoh networks\\veoh\\veohclient.exe"= TCP:C:\program files\veoh networks\veoh\veohclient.exe:Veoh Client
"TCP Query User{22468C28-E977-4843-B6AC-E3BE8F54647D}C:\\program files\\real\\realplayer\\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{3ABC085A-B971-4CD1-B628-229EB0BAEE2C}C:\\program files\\real\\realplayer\\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"TCP Query User{9BA11ECA-F2F9-475E-B5C0-51347EC72262}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{B1801739-1447-4F47-BBCF-01810D4F3CB5}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"{2AC2C593-7B85-4A20-9530-2250D86ACA46}"= UDP:C:\Program Files\Lavasoft\Ad-Aware 2007\lsupdatemanager.exe:Ad-Aware Update Manager
"{80C737BA-6350-4B4F-9676-DA51AADCFDB6}"= TCP:C:\Program Files\Lavasoft\Ad-Aware 2007\lsupdatemanager.exe:Ad-Aware Update Manager
"{D352D743-2BF9-4BB5-AD06-A5FE864ED63F}"= UDP:C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe:Start AntiVir PersonalEdition Classic
"{E84D491A-DDC7-4B01-ABC4-57AA32E88BDA}"= TCP:C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe:Start AntiVir PersonalEdition Classic
"{52CA1581-B3CD-49EC-96AF-C03833FF483B}"= UDP:C:\Program Files\HP\HP Software Update\HPWUCli.exe:HP Update
"{7E0F5BFF-63AA-4A18-A981-16B504715D3B}"= TCP:C:\Program Files\HP\HP Software Update\HPWUCli.exe:HP Update
"{E29FB8C1-9AAC-4B2B-9A21-5B2D346C6CCB}"= UDP:C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe:HP Total Care Advisor
"{3C300358-E241-4D48-9346-D5BEF92542EA}"= TCP:C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe:HP Total Care Advisor

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R2 DQLWinService;DQLWinService;"C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe" [2006-09-03 09:32]
R2 ezntsvc;EasyBits Magic Desktop Services for Windows NT;C:\Windows\system32\ezNTSvc.exe [2008-02-14 11:21]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 08:34]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-07-10 01:35]
S2 IntelDHSvcConf;Intel DH Service;"C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe" [2006-05-10 08:13]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-16 14:04:41
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Merci green day pour tes réponses mais ca y est c'est vraiment reglé je pense mais je vais quand meme te laisser un rapport hidjackisLogfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:23:46, on 21/03/2008
Platform: Windows Vista (WinNT 6.00.1904)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\mehdi\Documents\eMule\eMule.exe
C:\Windows\system32\conime.exe
C:\PROGRA~1\MOZILLA FIREFOX\FIREFOX.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\mehdi\Documents\Cleaner\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - (no file)
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{964D3745-F1C8-4E7F-861E-978030E6B686}: NameServer = 80.10.246.2,80.10.246.129
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (Audiosrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dhcpcsvc.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: @%SystemRoot%\ehome\ehrecvr.exe,-101 (ehRecvr) - Unknown owner - C:\Windows\ehome\ehRecvr.exe
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (Eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\System32\hidserv.dll,-101 (hidserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Assistance NetBIOS sur TCP/IP (lmhosts) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\netman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\netprof.dll,-246 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\nlasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: @%SystemRoot%\system32\nsisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\ipnathlp.dll,-106 (SharedAccess) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe
O23 - Service: @%SystemRoot%\system32\SLUINotify.dll,-103 (SLUINotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe
O23 - Service: @%systemroot%\system32\ssdpsrv.dll,-100 (SSDPSRV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (stisvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: stllssvr - Unknown owner - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tbssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe
O23 - Service: @%systemroot%\system32\upnphost.dll,-213 (upnphost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe
O23 - Service: @%SystemRoot%\system32\w32time.dll,-200 (W32Time) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe

Salut green day merci encore d'approffondir mais il y a un probleme je viens de retelecharger elibaglia je l'ai lancé deux fois mais il ne me génére plus de rapport.Je ne sais pas si c'est normal peut etre parce qu'il ne m'a pas trouvé d'erreur donc je ne sais pas je vais attendre que tu répondes et on verra et encore merci

Ca y est je l'ai trouvé le voila:

Fri Mar 21 22:51:04 2008
EliBagle v11.18 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

Fri Mar 21 22:51:06 2008
EliBagle v11.18 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 14011
Nº Total de Ficheros: 80350
Nº de Ficheros Analizados: 14630
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

j'attends ta réponse green day merci

J'ai bien executer (findstr /S /I /M /L "Themida" C:\*.exe>>"%userprofile%\bureau\Startvir.txt") mais il ne m'a pas crée de rapport meme en temps qu'administrateur le fichier startvir.txt n'existe pas donc je préfere attendre tes conseils je ne pas envie de faire nimporte quoi merci

Je viens d'essayer mais pareil j'ai une fenetre noire qui vient puis repare aussitot meme en tant qu'administrateur ca ne passe pas.Ne faudrait il pas l'inscrire directement dans l'invité de commandes ?j'attends pour voir ce que tu vas dire.

Non dans c:/ iln'y a pas de startvir.txt j'ai meme fait une recherche dans rechercher il n'y a rien je viens meme d'essayer avec le pare -feu désactivé sait on jamais.

Ca y est j'aigaleré parce que je ne retrouvé pas le rapport le voila et desolé pour l'attente par contre j'ai executer la commande SFC /verifyonly et il me dit qu'il a trouvé des violations dintégritée du registre.Est ce que ca peut etre les quelques ameliorations apportés aux clés du registre ou autres choses il me donne un exemple en me disant qu'il existe un rapport mais pareil introuvable (CBSlog windir\logs\CBS\CBS.log.) et merci

malwarebytes' Anti-Malware 1.09
Version de la base de données: 521

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Eléments examinés: 128682
Temps écoulé: 13 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Oui c'est ANTIVIR et il est a jour mais que pense tu du message que le rapport de la commande SFC /verifyonly me donne Peut tu m'endire un peu plus ou je ne dois pas faire attention?

Oui ca je l'ai déja fait il m'a trouvé des violations d'intégritée mais avec SFC /scannow il a pu reparé les erreurs donc plus de problemes merci

Ca y est merci mais tu n'aurais un tuto sur la configuration de zone alarme?

a oui encore merci salut