Pubs intempestives

désolé d' insister mais je ne trouve pas de solution sur quelques sites ou forum que se soit.....

je suis trés mal car cela commence à couper l'explorateur quand je navigue sur le net... help
merci

bonsoir à toi ..... et merci de cette rapidité!!!!

voilà le rapport demandé !

ComboFix 08-03-25.4 - Administrateur 2008-03-26 21:57:46.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1759 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM83fc7a4a.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\ayinmvub.dll
C:\WINDOWS\system32\clvqwebm.dll
C:\WINDOWS\system32\cmdhbrmw.dll
C:\WINDOWS\system32\ctynarno.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\gwlscydg.dll
C:\WINDOWS\system32\hjnftftv.dll
C:\WINDOWS\system32\ilnduqwy.dll
C:\WINDOWS\system32\itjmtrpv.dll
C:\WINDOWS\system32\iuywtocj.dll
C:\WINDOWS\system32\jcotwyui.ini
C:\WINDOWS\system32\jgdvkeyn.ini
C:\WINDOWS\system32\napmatln.dll
C:\WINDOWS\system32\nurbvkvx.dll
C:\WINDOWS\system32\nyekvdgj.dll
C:\WINDOWS\system32\ovtbajmm.dll
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\sjdvxjdl.dll
C:\WINDOWS\system32\ssqnnlj.dll
C:\WINDOWS\system32\ussugpnn.dll
C:\WINDOWS\system32\vifdxooq.dll
C:\WINDOWS\system32\ygxadnfi.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.

2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-26 21:56 . 2008-02-05 23:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-26 21:56 . 2008-02-05 22:49 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-03-26 21:56 . 2008-03-26 21:59 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-25 20:05 . 2008-03-25 20:05 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Media Player Classic
2008-03-20 23:55 . 2008-03-20 23:55 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-20 23:51 . 2008-03-26 21:04 1,426 --a------ C:\rollback.ini
2008-03-20 23:43 . 2008-03-20 23:43 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-20 23:20 . 2008-03-20 23:20 <REP> d-------- C:\Documents and Settings\Fred\Application Data\MailFrontier
2008-03-20 23:17 . 2008-03-26 22:01 3,483,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 23:17 . 2008-03-26 21:52 53,828 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 23:13 . 2008-03-21 07:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-20 23:11 . 2008-03-26 20:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-03-20 00:01 . 2008-03-20 19:01 1,501,269 ---hs---- C:\WINDOWS\system32\nbqidoup.ini
2008-03-19 20:27 . 2008-03-19 23:55 1,501,020 ---hs---- C:\WINDOWS\system32\bhsayfaq.ini
2008-03-19 19:52 . 2008-03-19 20:19 1,500,720 ---hs---- C:\WINDOWS\system32\jthinvat.ini
2008-03-18 16:51 . 2008-03-19 19:47 2,031,076 ---hs---- C:\WINDOWS\system32\nhnigetp.ini
2008-03-17 21:58 . 2008-03-18 16:50 1,358,947 ---hs---- C:\WINDOWS\system32\wkvfreyp.ini
2008-03-17 21:04 . 2008-03-17 21:04 <REP> d-------- C:\Program Files\MSXML 4.0
2008-03-17 18:10 . 2008-03-17 18:22 1,355,220 ---hs---- C:\WINDOWS\system32\xcgxlnyn.ini
2008-03-17 12:44 . 2008-03-17 18:05 654 ---hs---- C:\WINDOWS\system32\govivmke.ini
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\Fred\Application Data\SUPERAntiSpyware.com
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-17 07:48 . 2008-03-17 07:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-17 07:28 . 2008-03-17 18:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-17 07:23 . 2007-07-09 14:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-16 20:15 . 2008-03-19 23:57 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-03-16 20:15 . 2007-02-09 12:10 574,464 -----c--- C:\WINDOWS\system32\dllcache\ntfs.sys
2008-03-16 20:15 . 2006-08-14 11:34 332,928 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-03-16 20:15 . 2006-06-26 18:41 148,480 -----c--- C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-03-16 20:15 . 2006-05-19 14:23 112,128 -----c--- C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
2008-03-16 20:15 . 2006-05-19 14:23 95,744 -----c--- C:\WINDOWS\system32\dllcache\iphlpapi.dll
2008-03-16 20:14 . 2008-03-17 07:47 534 ---hs---- C:\WINDOWS\system32\kvetpuje.ini
2008-03-16 11:27 . 2008-03-16 12:08 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Image Zone Express
2008-03-15 12:38 . 2008-03-16 20:14 1,366,983 ---hs---- C:\WINDOWS\system32\lvhhpnyu.ini
2008-03-14 12:43 . 2008-03-14 23:32 1,350,975 ---hs---- C:\WINDOWS\system32\nestoxvd.ini
2008-03-13 00:03 . 2008-03-13 00:03 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-13 00:03 . 2008-03-13 00:03 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-10 23:44 . 2008-03-10 23:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
2008-03-10 23:40 . 2008-03-10 23:40 <REP> dr-h----- C:\Documents and Settings\Fred\Application Data\SecuROM
2008-03-10 23:40 . 2008-03-10 23:40 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-06 00:19 . 2008-03-06 00:19 319 --a------ C:\WINDOWS\game.ini
2008-03-06 00:14 . 2008-03-06 00:14 <REP> d-------- C:\Program Files\Activision
2008-03-05 23:36 . 2008-03-05 23:36 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-02-26 07:41 . 2007-02-03 19:30 1,507,232 -ra------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2008-02-26 07:41 . 2008-03-26 22:00 0 --a------ C:\WINDOWS\system32\drivers\lvuvc.hs
2008-02-26 07:40 . 2007-02-03 19:32 1,939,360 -ra------ C:\WINDOWS\system32\drivers\lvuvc.sys
2008-02-26 07:40 . 2007-02-03 19:32 527,136 -ra------ C:\WINDOWS\system32\LVUI2RC.dll
2008-02-26 07:40 . 2003-02-21 13:42 348,160 -ra------ C:\WINDOWS\system\msvcr71.dll
2008-02-26 07:40 . 2007-02-03 19:29 264,992 -ra------ C:\WINDOWS\system32\lvcodec2.dll
2008-02-26 07:40 . 2007-02-03 19:32 215,840 -ra------ C:\WINDOWS\system32\LVUI2.dll
2008-02-26 07:40 . 2007-02-03 19:29 129,824 -ra------ C:\WINDOWS\system32\lvci1051.dll
2008-02-26 07:40 . 2007-02-03 17:59 50,127 -ra------ C:\WINDOWS\system32\lvcoinst.ini
2008-02-26 07:40 . 2007-02-03 19:32 41,504 -ra------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-02-26 07:40 . 2007-02-03 19:32 22,560 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2008-02-26 07:40 . 2007-02-03 18:01 13,398 -ra------ C:\WINDOWS\system32\Repository.reg
2008-02-26 07:30 . 2008-02-26 07:30 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-02-26 07:28 . 2008-02-26 07:30 <REP> d-------- C:\Program Files\Logitech
2008-02-26 07:28 . 2008-02-26 07:40 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 23:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 11:20 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-01 15:34 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-29 19:24 --------- d-----w C:\Documents and Settings\Rudy\Application Data\HPAppData
2008-02-15 19:24 --------- d-----w C:\Documents and Settings\Fred\Application Data\HP
2008-02-13 00:19 --------- d-----w C:\Program Files\Ubi Soft
2008-02-12 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\Ahead
2008-02-12 23:33 --------- d-----w C:\Program Files\Nero
2008-02-12 23:33 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-02-11 19:40 --------- d-----w C:\Documents and Settings\Rudy\Application Data\Grisoft
2008-02-09 21:56 --------- d-----w C:\Documents and Settings\Fred\Application Data\CyberLink
2008-02-08 19:19 --------- d-----w C:\Program Files\QuickTime
2008-02-07 19:18 --------- d-----w C:\Program Files\HP
2008-02-06 23:42 --------- d-----w C:\Documents and Settings\Fred\Application Data\Snapfish
2008-02-06 21:31 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-06 21:31 --------- d-----w C:\Program Files\installations
2008-02-06 21:05 --------- d-----w C:\Documents and Settings\Fred\Application Data\eu
2008-02-06 21:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-06 00:14 --------- d-----w C:\Program Files\MSN Messenger
2008-02-05 23:55 --------- d-----w C:\Program Files\CyberLink
2008-02-05 23:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-05 23:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-02-05 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 23:52 --------- d-----w C:\Program Files\Microsoft Works
2008-02-05 23:47 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools
2008-02-05 23:40 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 23:37 --------- d-----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-02-05 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools Pro
2008-02-05 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 23:14 --------- d-----w C:\Program Files\Roxio
2008-02-05 23:14 --------- d-----w C:\Program Files\Fichiers communs\SureThing Shared
2008-02-05 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WEBREG
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\Fred\Application Data\HPAppData
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-02-05 23:05 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-05 22:45 --------- d-----w C:\Program Files\Realtek
2008-02-05 22:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 22:08 --------- d-----w C:\Program Files\Services en ligne
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"SUPERAntiSpyware"="C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 06:19 7626752]
"nwiz"="nwiz.exe" [2006-07-12 06:19 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 06:19 86016]
"avast!"="C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13 774168]
"devenv"="C:\WINDOWS\system\smvss.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe" [2007-12-13 19:27 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\installations\logiciels\superantispyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnnlj]
ssqnnlj.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\installations\logiciels\adobe acrobat\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 16:09 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 11:02 482760 C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"=

R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc []
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 10:23]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-14 13:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\Documents
"2008-03-14 19:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\Documents
"2008-03-14 07:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\Documents
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 22:01:16
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-26 22:04:01 - machine was rebooted [Fred]
ComboFix-quarantined-files.txt 2008-03-26 21:03:55
.
2008-03-17 20:11:14 --- E O F ---

merci merci merci !

bonsoir à toi ..... et merci de cette rapidité!!!!

voilà le rapport demandé !

ComboFix 08-03-25.4 - Administrateur 2008-03-26 21:57:46.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1759 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM83fc7a4a.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\ayinmvub.dll
C:\WINDOWS\system32\clvqwebm.dll
C:\WINDOWS\system32\cmdhbrmw.dll
C:\WINDOWS\system32\ctynarno.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\gwlscydg.dll
C:\WINDOWS\system32\hjnftftv.dll
C:\WINDOWS\system32\ilnduqwy.dll
C:\WINDOWS\system32\itjmtrpv.dll
C:\WINDOWS\system32\iuywtocj.dll
C:\WINDOWS\system32\jcotwyui.ini
C:\WINDOWS\system32\jgdvkeyn.ini
C:\WINDOWS\system32\napmatln.dll
C:\WINDOWS\system32\nurbvkvx.dll
C:\WINDOWS\system32\nyekvdgj.dll
C:\WINDOWS\system32\ovtbajmm.dll
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\sjdvxjdl.dll
C:\WINDOWS\system32\ssqnnlj.dll
C:\WINDOWS\system32\ussugpnn.dll
C:\WINDOWS\system32\vifdxooq.dll
C:\WINDOWS\system32\ygxadnfi.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.

2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-26 21:56 . 2008-02-05 23:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-26 21:56 . 2008-02-05 22:49 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-03-26 21:56 . 2008-03-26 21:59 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-25 20:05 . 2008-03-25 20:05 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Media Player Classic
2008-03-20 23:55 . 2008-03-20 23:55 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-20 23:51 . 2008-03-26 21:04 1,426 --a------ C:\rollback.ini
2008-03-20 23:43 . 2008-03-20 23:43 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-20 23:20 . 2008-03-20 23:20 <REP> d-------- C:\Documents and Settings\Fred\Application Data\MailFrontier
2008-03-20 23:17 . 2008-03-26 22:01 3,483,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 23:17 . 2008-03-26 21:52 53,828 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 23:13 . 2008-03-21 07:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-20 23:11 . 2008-03-26 20:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-03-20 00:01 . 2008-03-20 19:01 1,501,269 ---hs---- C:\WINDOWS\system32\nbqidoup.ini
2008-03-19 20:27 . 2008-03-19 23:55 1,501,020 ---hs---- C:\WINDOWS\system32\bhsayfaq.ini
2008-03-19 19:52 . 2008-03-19 20:19 1,500,720 ---hs---- C:\WINDOWS\system32\jthinvat.ini
2008-03-18 16:51 . 2008-03-19 19:47 2,031,076 ---hs---- C:\WINDOWS\system32\nhnigetp.ini
2008-03-17 21:58 . 2008-03-18 16:50 1,358,947 ---hs---- C:\WINDOWS\system32\wkvfreyp.ini
2008-03-17 21:04 . 2008-03-17 21:04 <REP> d-------- C:\Program Files\MSXML 4.0
2008-03-17 18:10 . 2008-03-17 18:22 1,355,220 ---hs---- C:\WINDOWS\system32\xcgxlnyn.ini
2008-03-17 12:44 . 2008-03-17 18:05 654 ---hs---- C:\WINDOWS\system32\govivmke.ini
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\Fred\Application Data\SUPERAntiSpyware.com
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-17 07:48 . 2008-03-17 07:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-17 07:28 . 2008-03-17 18:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-17 07:23 . 2007-07-09 14:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-16 20:15 . 2008-03-19 23:57 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-03-16 20:15 . 2007-02-09 12:10 574,464 -----c--- C:\WINDOWS\system32\dllcache\ntfs.sys
2008-03-16 20:15 . 2006-08-14 11:34 332,928 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-03-16 20:15 . 2006-06-26 18:41 148,480 -----c--- C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-03-16 20:15 . 2006-05-19 14:23 112,128 -----c--- C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
2008-03-16 20:15 . 2006-05-19 14:23 95,744 -----c--- C:\WINDOWS\system32\dllcache\iphlpapi.dll
2008-03-16 20:14 . 2008-03-17 07:47 534 ---hs---- C:\WINDOWS\system32\kvetpuje.ini
2008-03-16 11:27 . 2008-03-16 12:08 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Image Zone Express
2008-03-15 12:38 . 2008-03-16 20:14 1,366,983 ---hs---- C:\WINDOWS\system32\lvhhpnyu.ini
2008-03-14 12:43 . 2008-03-14 23:32 1,350,975 ---hs---- C:\WINDOWS\system32\nestoxvd.ini
2008-03-13 00:03 . 2008-03-13 00:03 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-13 00:03 . 2008-03-13 00:03 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-10 23:44 . 2008-03-10 23:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
2008-03-10 23:40 . 2008-03-10 23:40 <REP> dr-h----- C:\Documents and Settings\Fred\Application Data\SecuROM
2008-03-10 23:40 . 2008-03-10 23:40 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-06 00:19 . 2008-03-06 00:19 319 --a------ C:\WINDOWS\game.ini
2008-03-06 00:14 . 2008-03-06 00:14 <REP> d-------- C:\Program Files\Activision
2008-03-05 23:36 . 2008-03-05 23:36 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-02-26 07:41 . 2007-02-03 19:30 1,507,232 -ra------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2008-02-26 07:41 . 2008-03-26 22:00 0 --a------ C:\WINDOWS\system32\drivers\lvuvc.hs
2008-02-26 07:40 . 2007-02-03 19:32 1,939,360 -ra------ C:\WINDOWS\system32\drivers\lvuvc.sys
2008-02-26 07:40 . 2007-02-03 19:32 527,136 -ra------ C:\WINDOWS\system32\LVUI2RC.dll
2008-02-26 07:40 . 2003-02-21 13:42 348,160 -ra------ C:\WINDOWS\system\msvcr71.dll
2008-02-26 07:40 . 2007-02-03 19:29 264,992 -ra------ C:\WINDOWS\system32\lvcodec2.dll
2008-02-26 07:40 . 2007-02-03 19:32 215,840 -ra------ C:\WINDOWS\system32\LVUI2.dll
2008-02-26 07:40 . 2007-02-03 19:29 129,824 -ra------ C:\WINDOWS\system32\lvci1051.dll
2008-02-26 07:40 . 2007-02-03 17:59 50,127 -ra------ C:\WINDOWS\system32\lvcoinst.ini
2008-02-26 07:40 . 2007-02-03 19:32 41,504 -ra------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-02-26 07:40 . 2007-02-03 19:32 22,560 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2008-02-26 07:40 . 2007-02-03 18:01 13,398 -ra------ C:\WINDOWS\system32\Repository.reg
2008-02-26 07:30 . 2008-02-26 07:30 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-02-26 07:28 . 2008-02-26 07:30 <REP> d-------- C:\Program Files\Logitech
2008-02-26 07:28 . 2008-02-26 07:40 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 23:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 11:20 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-01 15:34 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-29 19:24 --------- d-----w C:\Documents and Settings\Rudy\Application Data\HPAppData
2008-02-15 19:24 --------- d-----w C:\Documents and Settings\Fred\Application Data\HP
2008-02-13 00:19 --------- d-----w C:\Program Files\Ubi Soft
2008-02-12 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\Ahead
2008-02-12 23:33 --------- d-----w C:\Program Files\Nero
2008-02-12 23:33 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-02-11 19:40 --------- d-----w C:\Documents and Settings\Rudy\Application Data\Grisoft
2008-02-09 21:56 --------- d-----w C:\Documents and Settings\Fred\Application Data\CyberLink
2008-02-08 19:19 --------- d-----w C:\Program Files\QuickTime
2008-02-07 19:18 --------- d-----w C:\Program Files\HP
2008-02-06 23:42 --------- d-----w C:\Documents and Settings\Fred\Application Data\Snapfish
2008-02-06 21:31 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-06 21:31 --------- d-----w C:\Program Files\installations
2008-02-06 21:05 --------- d-----w C:\Documents and Settings\Fred\Application Data\eu
2008-02-06 21:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-06 00:14 --------- d-----w C:\Program Files\MSN Messenger
2008-02-05 23:55 --------- d-----w C:\Program Files\CyberLink
2008-02-05 23:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-05 23:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-02-05 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 23:52 --------- d-----w C:\Program Files\Microsoft Works
2008-02-05 23:47 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools
2008-02-05 23:40 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 23:37 --------- d-----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-02-05 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools Pro
2008-02-05 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 23:14 --------- d-----w C:\Program Files\Roxio
2008-02-05 23:14 --------- d-----w C:\Program Files\Fichiers communs\SureThing Shared
2008-02-05 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WEBREG
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\Fred\Application Data\HPAppData
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-02-05 23:05 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-05 22:45 --------- d-----w C:\Program Files\Realtek
2008-02-05 22:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 22:08 --------- d-----w C:\Program Files\Services en ligne
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"SUPERAntiSpyware"="C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 06:19 7626752]
"nwiz"="nwiz.exe" [2006-07-12 06:19 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 06:19 86016]
"avast!"="C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13 774168]
"devenv"="C:\WINDOWS\system\smvss.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe" [2007-12-13 19:27 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\installations\logiciels\superantispyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnnlj]
ssqnnlj.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\installations\logiciels\adobe acrobat\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 16:09 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 11:02 482760 C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"=

R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc []
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 10:23]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-14 13:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\Documents
"2008-03-14 19:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\Documents
"2008-03-14 07:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\Documents
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 22:01:16
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-26 22:04:01 - machine was rebooted [Fred]
ComboFix-quarantined-files.txt 2008-03-26 21:03:55
.
2008-03-17 20:11:14 --- E O F ---

merci merci merci !

bonsoir à toi ..... et merci de cette rapidité!!!!

voilà le rapport demandé !

ComboFix 08-03-25.4 - Administrateur 2008-03-26 21:57:46.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1759 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM83fc7a4a.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\ayinmvub.dll
C:\WINDOWS\system32\clvqwebm.dll
C:\WINDOWS\system32\cmdhbrmw.dll
C:\WINDOWS\system32\ctynarno.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\gwlscydg.dll
C:\WINDOWS\system32\hjnftftv.dll
C:\WINDOWS\system32\ilnduqwy.dll
C:\WINDOWS\system32\itjmtrpv.dll
C:\WINDOWS\system32\iuywtocj.dll
C:\WINDOWS\system32\jcotwyui.ini
C:\WINDOWS\system32\jgdvkeyn.ini
C:\WINDOWS\system32\napmatln.dll
C:\WINDOWS\system32\nurbvkvx.dll
C:\WINDOWS\system32\nyekvdgj.dll
C:\WINDOWS\system32\ovtbajmm.dll
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\sjdvxjdl.dll
C:\WINDOWS\system32\ssqnnlj.dll
C:\WINDOWS\system32\ussugpnn.dll
C:\WINDOWS\system32\vifdxooq.dll
C:\WINDOWS\system32\ygxadnfi.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.

2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-26 21:56 . 2008-02-05 23:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-26 21:56 . 2008-02-05 22:49 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-03-26 21:56 . 2008-03-26 21:59 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-25 20:05 . 2008-03-25 20:05 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Media Player Classic
2008-03-20 23:55 . 2008-03-20 23:55 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-20 23:51 . 2008-03-26 21:04 1,426 --a------ C:\rollback.ini
2008-03-20 23:43 . 2008-03-20 23:43 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-20 23:20 . 2008-03-20 23:20 <REP> d-------- C:\Documents and Settings\Fred\Application Data\MailFrontier
2008-03-20 23:17 . 2008-03-26 22:01 3,483,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 23:17 . 2008-03-26 21:52 53,828 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 23:13 . 2008-03-21 07:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-20 23:11 . 2008-03-26 20:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-03-20 00:01 . 2008-03-20 19:01 1,501,269 ---hs---- C:\WINDOWS\system32\nbqidoup.ini
2008-03-19 20:27 . 2008-03-19 23:55 1,501,020 ---hs---- C:\WINDOWS\system32\bhsayfaq.ini
2008-03-19 19:52 . 2008-03-19 20:19 1,500,720 ---hs---- C:\WINDOWS\system32\jthinvat.ini
2008-03-18 16:51 . 2008-03-19 19:47 2,031,076 ---hs---- C:\WINDOWS\system32\nhnigetp.ini
2008-03-17 21:58 . 2008-03-18 16:50 1,358,947 ---hs---- C:\WINDOWS\system32\wkvfreyp.ini
2008-03-17 21:04 . 2008-03-17 21:04 <REP> d-------- C:\Program Files\MSXML 4.0
2008-03-17 18:10 . 2008-03-17 18:22 1,355,220 ---hs---- C:\WINDOWS\system32\xcgxlnyn.ini
2008-03-17 12:44 . 2008-03-17 18:05 654 ---hs---- C:\WINDOWS\system32\govivmke.ini
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\Fred\Application Data\SUPERAntiSpyware.com
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-17 07:48 . 2008-03-17 07:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-17 07:28 . 2008-03-17 18:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-17 07:23 . 2007-07-09 14:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-16 20:15 . 2008-03-19 23:57 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-03-16 20:15 . 2007-02-09 12:10 574,464 -----c--- C:\WINDOWS\system32\dllcache\ntfs.sys
2008-03-16 20:15 . 2006-08-14 11:34 332,928 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-03-16 20:15 . 2006-06-26 18:41 148,480 -----c--- C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-03-16 20:15 . 2006-05-19 14:23 112,128 -----c--- C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
2008-03-16 20:15 . 2006-05-19 14:23 95,744 -----c--- C:\WINDOWS\system32\dllcache\iphlpapi.dll
2008-03-16 20:14 . 2008-03-17 07:47 534 ---hs---- C:\WINDOWS\system32\kvetpuje.ini
2008-03-16 11:27 . 2008-03-16 12:08 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Image Zone Express
2008-03-15 12:38 . 2008-03-16 20:14 1,366,983 ---hs---- C:\WINDOWS\system32\lvhhpnyu.ini
2008-03-14 12:43 . 2008-03-14 23:32 1,350,975 ---hs---- C:\WINDOWS\system32\nestoxvd.ini
2008-03-13 00:03 . 2008-03-13 00:03 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-13 00:03 . 2008-03-13 00:03 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-10 23:44 . 2008-03-10 23:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
2008-03-10 23:40 . 2008-03-10 23:40 <REP> dr-h----- C:\Documents and Settings\Fred\Application Data\SecuROM
2008-03-10 23:40 . 2008-03-10 23:40 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-06 00:19 . 2008-03-06 00:19 319 --a------ C:\WINDOWS\game.ini
2008-03-06 00:14 . 2008-03-06 00:14 <REP> d-------- C:\Program Files\Activision
2008-03-05 23:36 . 2008-03-05 23:36 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-02-26 07:41 . 2007-02-03 19:30 1,507,232 -ra------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2008-02-26 07:41 . 2008-03-26 22:00 0 --a------ C:\WINDOWS\system32\drivers\lvuvc.hs
2008-02-26 07:40 . 2007-02-03 19:32 1,939,360 -ra------ C:\WINDOWS\system32\drivers\lvuvc.sys
2008-02-26 07:40 . 2007-02-03 19:32 527,136 -ra------ C:\WINDOWS\system32\LVUI2RC.dll
2008-02-26 07:40 . 2003-02-21 13:42 348,160 -ra------ C:\WINDOWS\system\msvcr71.dll
2008-02-26 07:40 . 2007-02-03 19:29 264,992 -ra------ C:\WINDOWS\system32\lvcodec2.dll
2008-02-26 07:40 . 2007-02-03 19:32 215,840 -ra------ C:\WINDOWS\system32\LVUI2.dll
2008-02-26 07:40 . 2007-02-03 19:29 129,824 -ra------ C:\WINDOWS\system32\lvci1051.dll
2008-02-26 07:40 . 2007-02-03 17:59 50,127 -ra------ C:\WINDOWS\system32\lvcoinst.ini
2008-02-26 07:40 . 2007-02-03 19:32 41,504 -ra------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-02-26 07:40 . 2007-02-03 19:32 22,560 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2008-02-26 07:40 . 2007-02-03 18:01 13,398 -ra------ C:\WINDOWS\system32\Repository.reg
2008-02-26 07:30 . 2008-02-26 07:30 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-02-26 07:28 . 2008-02-26 07:30 <REP> d-------- C:\Program Files\Logitech
2008-02-26 07:28 . 2008-02-26 07:40 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 23:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 11:20 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-01 15:34 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-29 19:24 --------- d-----w C:\Documents and Settings\Rudy\Application Data\HPAppData
2008-02-15 19:24 --------- d-----w C:\Documents and Settings\Fred\Application Data\HP
2008-02-13 00:19 --------- d-----w C:\Program Files\Ubi Soft
2008-02-12 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\Ahead
2008-02-12 23:33 --------- d-----w C:\Program Files\Nero
2008-02-12 23:33 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-02-11 19:40 --------- d-----w C:\Documents and Settings\Rudy\Application Data\Grisoft
2008-02-09 21:56 --------- d-----w C:\Documents and Settings\Fred\Application Data\CyberLink
2008-02-08 19:19 --------- d-----w C:\Program Files\QuickTime
2008-02-07 19:18 --------- d-----w C:\Program Files\HP
2008-02-06 23:42 --------- d-----w C:\Documents and Settings\Fred\Application Data\Snapfish
2008-02-06 21:31 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-06 21:31 --------- d-----w C:\Program Files\installations
2008-02-06 21:05 --------- d-----w C:\Documents and Settings\Fred\Application Data\eu
2008-02-06 21:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-06 00:14 --------- d-----w C:\Program Files\MSN Messenger
2008-02-05 23:55 --------- d-----w C:\Program Files\CyberLink
2008-02-05 23:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-05 23:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-02-05 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 23:52 --------- d-----w C:\Program Files\Microsoft Works
2008-02-05 23:47 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools
2008-02-05 23:40 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 23:37 --------- d-----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-02-05 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools Pro
2008-02-05 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 23:14 --------- d-----w C:\Program Files\Roxio
2008-02-05 23:14 --------- d-----w C:\Program Files\Fichiers communs\SureThing Shared
2008-02-05 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WEBREG
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\Fred\Application Data\HPAppData
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-02-05 23:05 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-05 22:45 --------- d-----w C:\Program Files\Realtek
2008-02-05 22:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 22:08 --------- d-----w C:\Program Files\Services en ligne
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"SUPERAntiSpyware"="C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 06:19 7626752]
"nwiz"="nwiz.exe" [2006-07-12 06:19 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 06:19 86016]
"avast!"="C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13 774168]
"devenv"="C:\WINDOWS\system\smvss.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe" [2007-12-13 19:27 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\installations\logiciels\superantispyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnnlj]
ssqnnlj.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\installations\logiciels\adobe acrobat\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 16:09 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 11:02 482760 C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"=

R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc []
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 10:23]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-14 13:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\Documents
"2008-03-14 19:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\Documents
"2008-03-14 07:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\Documents
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 22:01:16
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-26 22:04:01 - machine was rebooted [Fred]
ComboFix-quarantined-files.txt 2008-03-26 21:03:55
.
2008-03-17 20:11:14 --- E O F ---

merci merci merci !

bien

tu ne vas pas trouver grand chose ici je crois ...

VundoFix V7.0.3

Scan started at 22:46:28 2008-03-26

Listing files found while scanning....

No infected files were found.

Beginning removal...

merci

je sais pas

je teste et je te dis ça dans deux secondes

ok ?

et enfin voila le hijackthis le plus récent

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:06, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
O20 - Winlogon Notify: ssqnnlj - ssqnnlj.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ok

salut

voila le avg

-----------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 00:27 2008-03-27

+ Résultat de l'analyse:

C:\Documents and Settings\Rudy\Cookies\rudy@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@advertising[1].txt -> TrackingCookie.Advertising : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@atdmt[1].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@ehg-telecomitalia.hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@ie.search.msn[1].txt -> TrackingCookie.Msn : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@serving-sys[1].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@statcounter[1].txt -> TrackingCookie.Statcounter : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.

Fin du rapport

re re salut voila le rapport bitdef en ligne

BitDefender Online Scanner

Rapport d'analyse généré à: Thu, Mar 27, 2008 - 00:48:18

Voie d'analyse: A:\;C:\;D:\;F:\;Z:\;

Statistiques

Temps
00:16:01

Fichiers
67538

Directoires
5464

Secteurs de boot
3

Archives
835

Paquets programmes
6666

Résultats

Virus identifiés
10

Fichiers infectés
21

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
21

Info sur les moteurs

Définition virus
941186

Version des moteurs
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Analyse des plugins
14

Archive des plugins
38

Unpack des plugins
7

E-mail plugins
6

Système plugins
1

Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions

Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui

Fichier analysé
Statut

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP51\A0006883.dll
Infecté par: Trojan.Vundo.EDN

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP51\A0006883.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP51\A0006883.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007235.dll
Infecté par: Trojan.Vundo.EEL

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007235.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007235.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007337.dll
Infecté par: Trojan.Vundo.EEL

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007337.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007337.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007338.dll
Infecté par: Trojan.Vundo.EDK

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007338.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007338.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007394.dll
Infecté par: Trojan.Vundo.EDQ

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007394.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007394.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007395.dll
Infecté par: Trojan.Vundo.EDV

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007395.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007395.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007399.dll
Infecté par: Trojan.Vundo.EDV

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007399.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007399.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007584.dll
Infecté par: Trojan.Vundo.EDV

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007584.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007584.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009893.dll
Infecté par: Trojan.Vundo.EDT

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009893.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009893.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009894.dll
Infecté par: Trojan.Vundo.EDU

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009894.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009894.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009895.dll
Infecté par: Trojan.Vundo.EEH

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009895.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009895.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009896.dll
Infecté par: Trojan.Vundo.EDM

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009896.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009896.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009897.dll
Infecté par: Trojan.Vundo.EDM

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009897.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009897.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009899.dll
Infecté par: Trojan.Vundo.EDM

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009899.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009899.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009903.dll
Infecté par: Trojan.Vundo.EDU

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009903.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009903.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009904.dll
Infecté par: Trojan.Vundo.EDK

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009904.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009904.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009905.dll
Infecté par: Trojan.Vundo.EDU

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009905.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009905.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009906.dll
Infecté par: Trojan.Vundo.EDT

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009906.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009906.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009907.dll
Infecté par: Trojan.Vundo.GH

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009907.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009908.dll
Infecté par: Trojan.Vundo.EEH

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009908.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009908.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009909.dll
Infecté par: Trojan.Vundo.EDT

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009909.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009909.dll
Supprimé

merci pour la reponse

amno

salut a toi

oh ! grand vizir !

voici le rapport numero 1, le 2 arrive de suite....

[b]SDFix: Version 1.162 [/b]

Run by Fred on 2008-03-27 at 17:47

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\Fred\Bureau\sdfix\SDFix

[b]Checking Services [/b]:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

[b]Checking Files [/b]:

No Trojan Files Found

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-27 18:23:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000000
"hdf12"=hex:f9,4e,cc,36,84,6f,94,ab,5e,07,ed,ae,e0,b0,33,d6,a0,42,9d,d9,c9,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\"
"h0"=dword:00000001
"khjeh"=hex:ff,15,86,30,85,01,8d,5b,16,e5,6b,58,54,51,c1,b5,75,c9,68,10,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,85,4e,5b,06,e4,54,1a,e9,65,88,8a,37,8f,f2,59,3f,..
"khjeh"=hex:f9,0b,6f,e2,e4,02,6b,11,35,4e,dc,ee,b5,b1,29,8d,99,94,b8,5a,6a,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a7,89,5e,17,76,b2,1f,54,bd,3f,9b,a2,93,50,6d,09,96,82,36,53,45,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000000
"hdf12"=hex:f9,4e,cc,36,84,6f,94,ab,5e,07,ed,ae,e0,b0,33,d6,a0,42,9d,d9,c9,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\"
"h0"=dword:00000001
"khjeh"=hex:ff,15,86,30,85,01,8d,5b,16,e5,6b,58,54,51,c1,b5,75,c9,68,10,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,85,4e,5b,06,e4,54,1a,e9,65,88,8a,37,8f,f2,59,3f,..
"khjeh"=hex:f9,0b,6f,e2,e4,02,6b,11,35,4e,dc,ee,b5,b1,29,8d,99,94,b8,5a,6a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a7,89,5e,17,76,b2,1f,54,bd,3f,9b,a2,93,50,6d,09,96,82,36,53,45,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000091

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"="C:\\Program Files\\installations\\jeux\\halo2\\halo.exe:*:Enabled:Halo"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"="C:\\Program Files\\installations\\logiciels\\emule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"="C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe:*:Enabled:DiRT Executable"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"

[b]Remaining Files [/b]:

File Backups: - C:\DOCUME~1\Fred\Bureau\sdfix\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 17 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cc102203f99c8c6ebf1523556f8411b6\BIT3.tmp"
Mon 17 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT2.tmp"

[b]Finished![/b]

le voilà ! !!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:48, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
O20 - Winlogon Notify: ssqnnlj - ssqnnlj.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

oups !

pardon

voila

File/Folder C:\Windows\system32\ssqnnlj.dll not found.

OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03272008_202154

et l'autre

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:25, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

faudra que tu m'explique comment tu fais pour savoir ce qui est infecté et ce qu'il faut faire

c possible ça ?

grande vizirette ?

a bientôt

merci encore ...... merci beaucoup !!!!!!

amnohymne

signe !!

@amnohymnecommence pas t'inscrire sur le forum, ça sera plus simple :-)

ensuite, dis moi un peu ce que tu attends, que veux tu apprendre, pour toi ou pour la suite pouvoir aider ? etc ...

++

@green daydéjà inscris

je voudrais savoir déchiffrer les rapports divers, savoir lesquels faire, et ce pour moi et pour les autres car je dépanne des gens en informatique en attendant d'ouvrir ma boite un jour....(peut-être !)

en attendant bonne nuit

a+

amno

@green dayhello

là je suis inscris et connecté !

a bientôt

amno