Pubs intempestives

désolé d' insister mais je ne trouve pas de solution sur quelques sites ou forum que se soit.....

je suis trés mal car cela commence à couper l'explorateur quand je navigue sur le net... help
merci

bonsoir à toi ..... et merci de cette rapidité!!!!

voilà le rapport demandé !

ComboFix 08-03-25.4 - Administrateur 2008-03-26 21:57:46.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1759 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM83fc7a4a.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\ayinmvub.dll
C:\WINDOWS\system32\clvqwebm.dll
C:\WINDOWS\system32\cmdhbrmw.dll
C:\WINDOWS\system32\ctynarno.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\gwlscydg.dll
C:\WINDOWS\system32\hjnftftv.dll
C:\WINDOWS\system32\ilnduqwy.dll
C:\WINDOWS\system32\itjmtrpv.dll
C:\WINDOWS\system32\iuywtocj.dll
C:\WINDOWS\system32\jcotwyui.ini
C:\WINDOWS\system32\jgdvkeyn.ini
C:\WINDOWS\system32\napmatln.dll
C:\WINDOWS\system32\nurbvkvx.dll
C:\WINDOWS\system32\nyekvdgj.dll
C:\WINDOWS\system32\ovtbajmm.dll
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\sjdvxjdl.dll
C:\WINDOWS\system32\ssqnnlj.dll
C:\WINDOWS\system32\ussugpnn.dll
C:\WINDOWS\system32\vifdxooq.dll
C:\WINDOWS\system32\ygxadnfi.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.

2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-26 21:56 . 2008-02-05 23:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-26 21:56 . 2008-02-05 22:49 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-03-26 21:56 . 2008-03-26 21:59 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-25 20:05 . 2008-03-25 20:05 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Media Player Classic
2008-03-20 23:55 . 2008-03-20 23:55 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-20 23:51 . 2008-03-26 21:04 1,426 --a------ C:\rollback.ini
2008-03-20 23:43 . 2008-03-20 23:43 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-20 23:20 . 2008-03-20 23:20 <REP> d-------- C:\Documents and Settings\Fred\Application Data\MailFrontier
2008-03-20 23:17 . 2008-03-26 22:01 3,483,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 23:17 . 2008-03-26 21:52 53,828 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 23:13 . 2008-03-21 07:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-20 23:11 . 2008-03-26 20:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-03-20 00:01 . 2008-03-20 19:01 1,501,269 ---hs---- C:\WINDOWS\system32\nbqidoup.ini
2008-03-19 20:27 . 2008-03-19 23:55 1,501,020 ---hs---- C:\WINDOWS\system32\bhsayfaq.ini
2008-03-19 19:52 . 2008-03-19 20:19 1,500,720 ---hs---- C:\WINDOWS\system32\jthinvat.ini
2008-03-18 16:51 . 2008-03-19 19:47 2,031,076 ---hs---- C:\WINDOWS\system32\nhnigetp.ini
2008-03-17 21:58 . 2008-03-18 16:50 1,358,947 ---hs---- C:\WINDOWS\system32\wkvfreyp.ini
2008-03-17 21:04 . 2008-03-17 21:04 <REP> d-------- C:\Program Files\MSXML 4.0
2008-03-17 18:10 . 2008-03-17 18:22 1,355,220 ---hs---- C:\WINDOWS\system32\xcgxlnyn.ini
2008-03-17 12:44 . 2008-03-17 18:05 654 ---hs---- C:\WINDOWS\system32\govivmke.ini
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\Fred\Application Data\SUPERAntiSpyware.com
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-17 07:48 . 2008-03-17 07:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-17 07:28 . 2008-03-17 18:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-17 07:23 . 2007-07-09 14:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-16 20:15 . 2008-03-19 23:57 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-03-16 20:15 . 2007-02-09 12:10 574,464 -----c--- C:\WINDOWS\system32\dllcache\ntfs.sys
2008-03-16 20:15 . 2006-08-14 11:34 332,928 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-03-16 20:15 . 2006-06-26 18:41 148,480 -----c--- C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-03-16 20:15 . 2006-05-19 14:23 112,128 -----c--- C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
2008-03-16 20:15 . 2006-05-19 14:23 95,744 -----c--- C:\WINDOWS\system32\dllcache\iphlpapi.dll
2008-03-16 20:14 . 2008-03-17 07:47 534 ---hs---- C:\WINDOWS\system32\kvetpuje.ini
2008-03-16 11:27 . 2008-03-16 12:08 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Image Zone Express
2008-03-15 12:38 . 2008-03-16 20:14 1,366,983 ---hs---- C:\WINDOWS\system32\lvhhpnyu.ini
2008-03-14 12:43 . 2008-03-14 23:32 1,350,975 ---hs---- C:\WINDOWS\system32\nestoxvd.ini
2008-03-13 00:03 . 2008-03-13 00:03 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-13 00:03 . 2008-03-13 00:03 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-10 23:44 . 2008-03-10 23:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
2008-03-10 23:40 . 2008-03-10 23:40 <REP> dr-h----- C:\Documents and Settings\Fred\Application Data\SecuROM
2008-03-10 23:40 . 2008-03-10 23:40 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-06 00:19 . 2008-03-06 00:19 319 --a------ C:\WINDOWS\game.ini
2008-03-06 00:14 . 2008-03-06 00:14 <REP> d-------- C:\Program Files\Activision
2008-03-05 23:36 . 2008-03-05 23:36 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-02-26 07:41 . 2007-02-03 19:30 1,507,232 -ra------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2008-02-26 07:41 . 2008-03-26 22:00 0 --a------ C:\WINDOWS\system32\drivers\lvuvc.hs
2008-02-26 07:40 . 2007-02-03 19:32 1,939,360 -ra------ C:\WINDOWS\system32\drivers\lvuvc.sys
2008-02-26 07:40 . 2007-02-03 19:32 527,136 -ra------ C:\WINDOWS\system32\LVUI2RC.dll
2008-02-26 07:40 . 2003-02-21 13:42 348,160 -ra------ C:\WINDOWS\system\msvcr71.dll
2008-02-26 07:40 . 2007-02-03 19:29 264,992 -ra------ C:\WINDOWS\system32\lvcodec2.dll
2008-02-26 07:40 . 2007-02-03 19:32 215,840 -ra------ C:\WINDOWS\system32\LVUI2.dll
2008-02-26 07:40 . 2007-02-03 19:29 129,824 -ra------ C:\WINDOWS\system32\lvci1051.dll
2008-02-26 07:40 . 2007-02-03 17:59 50,127 -ra------ C:\WINDOWS\system32\lvcoinst.ini
2008-02-26 07:40 . 2007-02-03 19:32 41,504 -ra------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-02-26 07:40 . 2007-02-03 19:32 22,560 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2008-02-26 07:40 . 2007-02-03 18:01 13,398 -ra------ C:\WINDOWS\system32\Repository.reg
2008-02-26 07:30 . 2008-02-26 07:30 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-02-26 07:28 . 2008-02-26 07:30 <REP> d-------- C:\Program Files\Logitech
2008-02-26 07:28 . 2008-02-26 07:40 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 23:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 11:20 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-01 15:34 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-29 19:24 --------- d-----w C:\Documents and Settings\Rudy\Application Data\HPAppData
2008-02-15 19:24 --------- d-----w C:\Documents and Settings\Fred\Application Data\HP
2008-02-13 00:19 --------- d-----w C:\Program Files\Ubi Soft
2008-02-12 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\Ahead
2008-02-12 23:33 --------- d-----w C:\Program Files\Nero
2008-02-12 23:33 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-02-11 19:40 --------- d-----w C:\Documents and Settings\Rudy\Application Data\Grisoft
2008-02-09 21:56 --------- d-----w C:\Documents and Settings\Fred\Application Data\CyberLink
2008-02-08 19:19 --------- d-----w C:\Program Files\QuickTime
2008-02-07 19:18 --------- d-----w C:\Program Files\HP
2008-02-06 23:42 --------- d-----w C:\Documents and Settings\Fred\Application Data\Snapfish
2008-02-06 21:31 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-06 21:31 --------- d-----w C:\Program Files\installations
2008-02-06 21:05 --------- d-----w C:\Documents and Settings\Fred\Application Data\eu
2008-02-06 21:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-06 00:14 --------- d-----w C:\Program Files\MSN Messenger
2008-02-05 23:55 --------- d-----w C:\Program Files\CyberLink
2008-02-05 23:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-05 23:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-02-05 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 23:52 --------- d-----w C:\Program Files\Microsoft Works
2008-02-05 23:47 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools
2008-02-05 23:40 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 23:37 --------- d-----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-02-05 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools Pro
2008-02-05 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 23:14 --------- d-----w C:\Program Files\Roxio
2008-02-05 23:14 --------- d-----w C:\Program Files\Fichiers communs\SureThing Shared
2008-02-05 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WEBREG
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\Fred\Application Data\HPAppData
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-02-05 23:05 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-05 22:45 --------- d-----w C:\Program Files\Realtek
2008-02-05 22:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 22:08 --------- d-----w C:\Program Files\Services en ligne
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"SUPERAntiSpyware"="C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 06:19 7626752]
"nwiz"="nwiz.exe" [2006-07-12 06:19 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 06:19 86016]
"avast!"="C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13 774168]
"devenv"="C:\WINDOWS\system\smvss.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe" [2007-12-13 19:27 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\installations\logiciels\superantispyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnnlj]
ssqnnlj.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\installations\logiciels\adobe acrobat\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 16:09 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 11:02 482760 C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"=

R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc []
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 10:23]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-14 13:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\Documents
"2008-03-14 19:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\Documents
"2008-03-14 07:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\Documents
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 22:01:16
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-26 22:04:01 - machine was rebooted [Fred]
ComboFix-quarantined-files.txt 2008-03-26 21:03:55
.
2008-03-17 20:11:14 --- E O F ---


merci merci merci !

bonsoir à toi ..... et merci de cette rapidité!!!!

voilà le rapport demandé !

ComboFix 08-03-25.4 - Administrateur 2008-03-26 21:57:46.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1759 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM83fc7a4a.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\ayinmvub.dll
C:\WINDOWS\system32\clvqwebm.dll
C:\WINDOWS\system32\cmdhbrmw.dll
C:\WINDOWS\system32\ctynarno.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\gwlscydg.dll
C:\WINDOWS\system32\hjnftftv.dll
C:\WINDOWS\system32\ilnduqwy.dll
C:\WINDOWS\system32\itjmtrpv.dll
C:\WINDOWS\system32\iuywtocj.dll
C:\WINDOWS\system32\jcotwyui.ini
C:\WINDOWS\system32\jgdvkeyn.ini
C:\WINDOWS\system32\napmatln.dll
C:\WINDOWS\system32\nurbvkvx.dll
C:\WINDOWS\system32\nyekvdgj.dll
C:\WINDOWS\system32\ovtbajmm.dll
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\sjdvxjdl.dll
C:\WINDOWS\system32\ssqnnlj.dll
C:\WINDOWS\system32\ussugpnn.dll
C:\WINDOWS\system32\vifdxooq.dll
C:\WINDOWS\system32\ygxadnfi.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.

2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-26 21:56 . 2008-02-05 23:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-26 21:56 . 2008-02-05 22:49 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-03-26 21:56 . 2008-03-26 21:59 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-25 20:05 . 2008-03-25 20:05 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Media Player Classic
2008-03-20 23:55 . 2008-03-20 23:55 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-20 23:51 . 2008-03-26 21:04 1,426 --a------ C:\rollback.ini
2008-03-20 23:43 . 2008-03-20 23:43 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-20 23:20 . 2008-03-20 23:20 <REP> d-------- C:\Documents and Settings\Fred\Application Data\MailFrontier
2008-03-20 23:17 . 2008-03-26 22:01 3,483,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 23:17 . 2008-03-26 21:52 53,828 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 23:13 . 2008-03-21 07:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-20 23:11 . 2008-03-26 20:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-03-20 00:01 . 2008-03-20 19:01 1,501,269 ---hs---- C:\WINDOWS\system32\nbqidoup.ini
2008-03-19 20:27 . 2008-03-19 23:55 1,501,020 ---hs---- C:\WINDOWS\system32\bhsayfaq.ini
2008-03-19 19:52 . 2008-03-19 20:19 1,500,720 ---hs---- C:\WINDOWS\system32\jthinvat.ini
2008-03-18 16:51 . 2008-03-19 19:47 2,031,076 ---hs---- C:\WINDOWS\system32\nhnigetp.ini
2008-03-17 21:58 . 2008-03-18 16:50 1,358,947 ---hs---- C:\WINDOWS\system32\wkvfreyp.ini
2008-03-17 21:04 . 2008-03-17 21:04 <REP> d-------- C:\Program Files\MSXML 4.0
2008-03-17 18:10 . 2008-03-17 18:22 1,355,220 ---hs---- C:\WINDOWS\system32\xcgxlnyn.ini
2008-03-17 12:44 . 2008-03-17 18:05 654 ---hs---- C:\WINDOWS\system32\govivmke.ini
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\Fred\Application Data\SUPERAntiSpyware.com
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-17 07:48 . 2008-03-17 07:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-17 07:28 . 2008-03-17 18:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-17 07:23 . 2007-07-09 14:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-16 20:15 . 2008-03-19 23:57 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-03-16 20:15 . 2007-02-09 12:10 574,464 -----c--- C:\WINDOWS\system32\dllcache\ntfs.sys
2008-03-16 20:15 . 2006-08-14 11:34 332,928 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-03-16 20:15 . 2006-06-26 18:41 148,480 -----c--- C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-03-16 20:15 . 2006-05-19 14:23 112,128 -----c--- C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
2008-03-16 20:15 . 2006-05-19 14:23 95,744 -----c--- C:\WINDOWS\system32\dllcache\iphlpapi.dll
2008-03-16 20:14 . 2008-03-17 07:47 534 ---hs---- C:\WINDOWS\system32\kvetpuje.ini
2008-03-16 11:27 . 2008-03-16 12:08 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Image Zone Express
2008-03-15 12:38 . 2008-03-16 20:14 1,366,983 ---hs---- C:\WINDOWS\system32\lvhhpnyu.ini
2008-03-14 12:43 . 2008-03-14 23:32 1,350,975 ---hs---- C:\WINDOWS\system32\nestoxvd.ini
2008-03-13 00:03 . 2008-03-13 00:03 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-13 00:03 . 2008-03-13 00:03 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-10 23:44 . 2008-03-10 23:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
2008-03-10 23:40 . 2008-03-10 23:40 <REP> dr-h----- C:\Documents and Settings\Fred\Application Data\SecuROM
2008-03-10 23:40 . 2008-03-10 23:40 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-06 00:19 . 2008-03-06 00:19 319 --a------ C:\WINDOWS\game.ini
2008-03-06 00:14 . 2008-03-06 00:14 <REP> d-------- C:\Program Files\Activision
2008-03-05 23:36 . 2008-03-05 23:36 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-02-26 07:41 . 2007-02-03 19:30 1,507,232 -ra------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2008-02-26 07:41 . 2008-03-26 22:00 0 --a------ C:\WINDOWS\system32\drivers\lvuvc.hs
2008-02-26 07:40 . 2007-02-03 19:32 1,939,360 -ra------ C:\WINDOWS\system32\drivers\lvuvc.sys
2008-02-26 07:40 . 2007-02-03 19:32 527,136 -ra------ C:\WINDOWS\system32\LVUI2RC.dll
2008-02-26 07:40 . 2003-02-21 13:42 348,160 -ra------ C:\WINDOWS\system\msvcr71.dll
2008-02-26 07:40 . 2007-02-03 19:29 264,992 -ra------ C:\WINDOWS\system32\lvcodec2.dll
2008-02-26 07:40 . 2007-02-03 19:32 215,840 -ra------ C:\WINDOWS\system32\LVUI2.dll
2008-02-26 07:40 . 2007-02-03 19:29 129,824 -ra------ C:\WINDOWS\system32\lvci1051.dll
2008-02-26 07:40 . 2007-02-03 17:59 50,127 -ra------ C:\WINDOWS\system32\lvcoinst.ini
2008-02-26 07:40 . 2007-02-03 19:32 41,504 -ra------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-02-26 07:40 . 2007-02-03 19:32 22,560 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2008-02-26 07:40 . 2007-02-03 18:01 13,398 -ra------ C:\WINDOWS\system32\Repository.reg
2008-02-26 07:30 . 2008-02-26 07:30 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-02-26 07:28 . 2008-02-26 07:30 <REP> d-------- C:\Program Files\Logitech
2008-02-26 07:28 . 2008-02-26 07:40 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 23:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 11:20 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-01 15:34 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-29 19:24 --------- d-----w C:\Documents and Settings\Rudy\Application Data\HPAppData
2008-02-15 19:24 --------- d-----w C:\Documents and Settings\Fred\Application Data\HP
2008-02-13 00:19 --------- d-----w C:\Program Files\Ubi Soft
2008-02-12 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\Ahead
2008-02-12 23:33 --------- d-----w C:\Program Files\Nero
2008-02-12 23:33 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-02-11 19:40 --------- d-----w C:\Documents and Settings\Rudy\Application Data\Grisoft
2008-02-09 21:56 --------- d-----w C:\Documents and Settings\Fred\Application Data\CyberLink
2008-02-08 19:19 --------- d-----w C:\Program Files\QuickTime
2008-02-07 19:18 --------- d-----w C:\Program Files\HP
2008-02-06 23:42 --------- d-----w C:\Documents and Settings\Fred\Application Data\Snapfish
2008-02-06 21:31 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-06 21:31 --------- d-----w C:\Program Files\installations
2008-02-06 21:05 --------- d-----w C:\Documents and Settings\Fred\Application Data\eu
2008-02-06 21:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-06 00:14 --------- d-----w C:\Program Files\MSN Messenger
2008-02-05 23:55 --------- d-----w C:\Program Files\CyberLink
2008-02-05 23:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-05 23:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-02-05 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 23:52 --------- d-----w C:\Program Files\Microsoft Works
2008-02-05 23:47 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools
2008-02-05 23:40 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 23:37 --------- d-----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-02-05 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools Pro
2008-02-05 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 23:14 --------- d-----w C:\Program Files\Roxio
2008-02-05 23:14 --------- d-----w C:\Program Files\Fichiers communs\SureThing Shared
2008-02-05 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WEBREG
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\Fred\Application Data\HPAppData
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-02-05 23:05 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-05 22:45 --------- d-----w C:\Program Files\Realtek
2008-02-05 22:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 22:08 --------- d-----w C:\Program Files\Services en ligne
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"SUPERAntiSpyware"="C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 06:19 7626752]
"nwiz"="nwiz.exe" [2006-07-12 06:19 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 06:19 86016]
"avast!"="C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13 774168]
"devenv"="C:\WINDOWS\system\smvss.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe" [2007-12-13 19:27 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\installations\logiciels\superantispyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnnlj]
ssqnnlj.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\installations\logiciels\adobe acrobat\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 16:09 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 11:02 482760 C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"=

R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc []
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 10:23]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-14 13:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\Documents
"2008-03-14 19:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\Documents
"2008-03-14 07:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\Documents
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 22:01:16
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-26 22:04:01 - machine was rebooted [Fred]
ComboFix-quarantined-files.txt 2008-03-26 21:03:55
.
2008-03-17 20:11:14 --- E O F ---


merci merci merci !

bonsoir à toi ..... et merci de cette rapidité!!!!

voilà le rapport demandé !

ComboFix 08-03-25.4 - Administrateur 2008-03-26 21:57:46.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1759 [GMT 1:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM83fc7a4a.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\ayinmvub.dll
C:\WINDOWS\system32\clvqwebm.dll
C:\WINDOWS\system32\cmdhbrmw.dll
C:\WINDOWS\system32\ctynarno.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\gwlscydg.dll
C:\WINDOWS\system32\hjnftftv.dll
C:\WINDOWS\system32\ilnduqwy.dll
C:\WINDOWS\system32\itjmtrpv.dll
C:\WINDOWS\system32\iuywtocj.dll
C:\WINDOWS\system32\jcotwyui.ini
C:\WINDOWS\system32\jgdvkeyn.ini
C:\WINDOWS\system32\napmatln.dll
C:\WINDOWS\system32\nurbvkvx.dll
C:\WINDOWS\system32\nyekvdgj.dll
C:\WINDOWS\system32\ovtbajmm.dll
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\sjdvxjdl.dll
C:\WINDOWS\system32\ssqnnlj.dll
C:\WINDOWS\system32\ussugpnn.dll
C:\WINDOWS\system32\vifdxooq.dll
C:\WINDOWS\system32\ygxadnfi.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.

2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-03-26 21:56 . 2008-02-05 23:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-03-26 21:56 . 2008-02-05 22:49 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-03-26 21:56 . 2008-02-05 22:49 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-03-26 21:56 . 2008-03-26 21:59 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-03-25 20:05 . 2008-03-25 20:05 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Media Player Classic
2008-03-20 23:55 . 2008-03-20 23:55 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-20 23:51 . 2008-03-26 21:04 1,426 --a------ C:\rollback.ini
2008-03-20 23:43 . 2008-03-20 23:43 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-20 23:20 . 2008-03-20 23:20 <REP> d-------- C:\Documents and Settings\Fred\Application Data\MailFrontier
2008-03-20 23:17 . 2008-03-26 22:01 3,483,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-20 23:17 . 2008-03-26 21:52 53,828 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-20 23:13 . 2008-03-21 07:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-20 23:11 . 2008-03-26 20:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-03-20 00:01 . 2008-03-20 19:01 1,501,269 ---hs---- C:\WINDOWS\system32\nbqidoup.ini
2008-03-19 20:27 . 2008-03-19 23:55 1,501,020 ---hs---- C:\WINDOWS\system32\bhsayfaq.ini
2008-03-19 19:52 . 2008-03-19 20:19 1,500,720 ---hs---- C:\WINDOWS\system32\jthinvat.ini
2008-03-18 16:51 . 2008-03-19 19:47 2,031,076 ---hs---- C:\WINDOWS\system32\nhnigetp.ini
2008-03-17 21:58 . 2008-03-18 16:50 1,358,947 ---hs---- C:\WINDOWS\system32\wkvfreyp.ini
2008-03-17 21:04 . 2008-03-17 21:04 <REP> d-------- C:\Program Files\MSXML 4.0
2008-03-17 18:10 . 2008-03-17 18:22 1,355,220 ---hs---- C:\WINDOWS\system32\xcgxlnyn.ini
2008-03-17 12:44 . 2008-03-17 18:05 654 ---hs---- C:\WINDOWS\system32\govivmke.ini
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\Fred\Application Data\SUPERAntiSpyware.com
2008-03-17 07:49 . 2008-03-17 07:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-17 07:48 . 2008-03-17 07:48 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-17 07:28 . 2008-03-17 18:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-17 07:23 . 2007-07-09 14:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-16 20:15 . 2008-03-19 23:57 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-03-16 20:15 . 2007-02-09 12:10 574,464 -----c--- C:\WINDOWS\system32\dllcache\ntfs.sys
2008-03-16 20:15 . 2006-08-14 11:34 332,928 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-03-16 20:15 . 2006-06-26 18:41 148,480 -----c--- C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-03-16 20:15 . 2006-05-19 14:23 112,128 -----c--- C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
2008-03-16 20:15 . 2006-05-19 14:23 95,744 -----c--- C:\WINDOWS\system32\dllcache\iphlpapi.dll
2008-03-16 20:14 . 2008-03-17 07:47 534 ---hs---- C:\WINDOWS\system32\kvetpuje.ini
2008-03-16 11:27 . 2008-03-16 12:08 <REP> d-------- C:\Documents and Settings\Fred\Application Data\Image Zone Express
2008-03-15 12:38 . 2008-03-16 20:14 1,366,983 ---hs---- C:\WINDOWS\system32\lvhhpnyu.ini
2008-03-14 12:43 . 2008-03-14 23:32 1,350,975 ---hs---- C:\WINDOWS\system32\nestoxvd.ini
2008-03-13 00:03 . 2008-03-13 00:03 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-13 00:03 . 2008-03-13 00:03 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-03-10 23:44 . 2008-03-10 23:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
2008-03-10 23:40 . 2008-03-10 23:40 <REP> dr-h----- C:\Documents and Settings\Fred\Application Data\SecuROM
2008-03-10 23:40 . 2008-03-10 23:40 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-06 00:19 . 2008-03-06 00:19 319 --a------ C:\WINDOWS\game.ini
2008-03-06 00:14 . 2008-03-06 00:14 <REP> d-------- C:\Program Files\Activision
2008-03-05 23:36 . 2008-03-05 23:36 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-02-26 07:41 . 2007-02-03 19:30 1,507,232 -ra------ C:\WINDOWS\system32\drivers\lvpopflt.sys
2008-02-26 07:41 . 2008-03-26 22:00 0 --a------ C:\WINDOWS\system32\drivers\lvuvc.hs
2008-02-26 07:40 . 2007-02-03 19:32 1,939,360 -ra------ C:\WINDOWS\system32\drivers\lvuvc.sys
2008-02-26 07:40 . 2007-02-03 19:32 527,136 -ra------ C:\WINDOWS\system32\LVUI2RC.dll
2008-02-26 07:40 . 2003-02-21 13:42 348,160 -ra------ C:\WINDOWS\system\msvcr71.dll
2008-02-26 07:40 . 2007-02-03 19:29 264,992 -ra------ C:\WINDOWS\system32\lvcodec2.dll
2008-02-26 07:40 . 2007-02-03 19:32 215,840 -ra------ C:\WINDOWS\system32\LVUI2.dll
2008-02-26 07:40 . 2007-02-03 19:29 129,824 -ra------ C:\WINDOWS\system32\lvci1051.dll
2008-02-26 07:40 . 2007-02-03 17:59 50,127 -ra------ C:\WINDOWS\system32\lvcoinst.ini
2008-02-26 07:40 . 2007-02-03 19:32 41,504 -ra------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-02-26 07:40 . 2007-02-03 19:32 22,560 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys
2008-02-26 07:40 . 2007-02-03 18:01 13,398 -ra------ C:\WINDOWS\system32\Repository.reg
2008-02-26 07:30 . 2008-02-26 07:30 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-02-26 07:28 . 2008-02-26 07:30 <REP> d-------- C:\Program Files\Logitech
2008-02-26 07:28 . 2008-02-26 07:40 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 07:28 . 2008-02-26 07:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 23:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 11:20 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-01 15:34 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-29 19:24 --------- d-----w C:\Documents and Settings\Rudy\Application Data\HPAppData
2008-02-15 19:24 --------- d-----w C:\Documents and Settings\Fred\Application Data\HP
2008-02-13 00:19 --------- d-----w C:\Program Files\Ubi Soft
2008-02-12 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\Ahead
2008-02-12 23:33 --------- d-----w C:\Program Files\Nero
2008-02-12 23:33 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-02-11 19:40 --------- d-----w C:\Documents and Settings\Rudy\Application Data\Grisoft
2008-02-09 21:56 --------- d-----w C:\Documents and Settings\Fred\Application Data\CyberLink
2008-02-08 19:19 --------- d-----w C:\Program Files\QuickTime
2008-02-07 19:18 --------- d-----w C:\Program Files\HP
2008-02-06 23:42 --------- d-----w C:\Documents and Settings\Fred\Application Data\Snapfish
2008-02-06 21:31 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-06 21:31 --------- d-----w C:\Program Files\installations
2008-02-06 21:05 --------- d-----w C:\Documents and Settings\Fred\Application Data\eu
2008-02-06 21:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-02-06 00:14 --------- d-----w C:\Program Files\MSN Messenger
2008-02-05 23:55 --------- d-----w C:\Program Files\CyberLink
2008-02-05 23:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-05 23:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-02-05 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 23:52 --------- d-----w C:\Program Files\Microsoft Works
2008-02-05 23:47 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools
2008-02-05 23:40 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-05 23:37 --------- d-----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-02-05 23:35 --------- d-----w C:\Documents and Settings\Fred\Application Data\DAEMON Tools Pro
2008-02-05 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 23:14 --------- d-----w C:\Program Files\Roxio
2008-02-05 23:14 --------- d-----w C:\Program Files\Fichiers communs\SureThing Shared
2008-02-05 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WEBREG
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\Fred\Application Data\HPAppData
2008-02-05 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-02-05 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-02-05 23:05 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-02-05 23:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-02-05 22:45 --------- d-----w C:\Program Files\Realtek
2008-02-05 22:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 22:08 --------- d-----w C:\Program Files\Services en ligne
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"SUPERAntiSpyware"="C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 06:19 7626752]
"nwiz"="nwiz.exe" [2006-07-12 06:19 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 06:19 86016]
"avast!"="C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12 488984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13 774168]
"devenv"="C:\WINDOWS\system\smvss.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe" [2007-12-13 19:27 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\installations\logiciels\superantispyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnnlj]
ssqnnlj.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\installations\logiciels\adobe acrobat\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 16:09 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 11:02 482760 C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"=

R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 20:53]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 20:52]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc []
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 10:23]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-14 13:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\Documents
"2008-03-14 19:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\Documents
"2008-03-14 07:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\Documents
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 22:01:16
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-26 22:04:01 - machine was rebooted [Fred]
ComboFix-quarantined-files.txt 2008-03-26 21:03:55
.
2008-03-17 20:11:14 --- E O F ---


merci merci merci !

bien

tu ne vas pas trouver grand chose ici je crois ...


VundoFix V7.0.3

Scan started at 22:46:28 2008-03-26

Listing files found while scanning....

No infected files were found.


Beginning removal...


merci

je sais pas

je teste et je te dis ça dans deux secondes

ok ?

et enfin voila le hijackthis le plus récent

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:06, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
O20 - Winlogon Notify: ssqnnlj - ssqnnlj.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ok

salut

voila le avg

-----------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 00:27 2008-03-27

+ Résultat de l'analyse:



C:\Documents and Settings\Rudy\Cookies\rudy@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@advertising[1].txt -> TrackingCookie.Advertising : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@atdmt[1].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@ehg-telecomitalia.hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@ie.search.msn[1].txt -> TrackingCookie.Msn : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@serving-sys[1].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@statcounter[1].txt -> TrackingCookie.Statcounter : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
C:\Documents and Settings\Fred\Cookies\fred@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\Rudy\Cookies\rudy@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.


Fin du rapport

re re salut voila le rapport bitdef en ligne

BitDefender Online Scanner



Rapport d'analyse généré à: Thu, Mar 27, 2008 - 00:48:18





Voie d'analyse: A:\;C:\;D:\;F:\;Z:\;







Statistiques

Temps
00:16:01

Fichiers
67538

Directoires
5464

Secteurs de boot
3

Archives
835

Paquets programmes
6666




Résultats

Virus identifiés
10

Fichiers infectés
21

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
21




Info sur les moteurs

Définition virus
941186

Version des moteurs
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Analyse des plugins
14

Archive des plugins
38

Unpack des plugins
7

E-mail plugins
6

Système plugins
1




Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions


Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui




Fichier analysé
Statut

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP51\A0006883.dll
Infecté par: Trojan.Vundo.EDN

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP51\A0006883.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP51\A0006883.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007235.dll
Infecté par: Trojan.Vundo.EEL

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007235.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007235.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007337.dll
Infecté par: Trojan.Vundo.EEL

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007337.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007337.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007338.dll
Infecté par: Trojan.Vundo.EDK

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007338.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP52\A0007338.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007394.dll
Infecté par: Trojan.Vundo.EDQ

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007394.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007394.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007395.dll
Infecté par: Trojan.Vundo.EDV

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007395.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007395.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007399.dll
Infecté par: Trojan.Vundo.EDV

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007399.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007399.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007584.dll
Infecté par: Trojan.Vundo.EDV

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007584.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP54\A0007584.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009893.dll
Infecté par: Trojan.Vundo.EDT

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009893.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009893.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009894.dll
Infecté par: Trojan.Vundo.EDU

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009894.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009894.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009895.dll
Infecté par: Trojan.Vundo.EEH

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009895.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009895.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009896.dll
Infecté par: Trojan.Vundo.EDM

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009896.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009896.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009897.dll
Infecté par: Trojan.Vundo.EDM

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009897.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009897.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009899.dll
Infecté par: Trojan.Vundo.EDM

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009899.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009899.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009903.dll
Infecté par: Trojan.Vundo.EDU

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009903.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009903.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009904.dll
Infecté par: Trojan.Vundo.EDK

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009904.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009904.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009905.dll
Infecté par: Trojan.Vundo.EDU

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009905.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009905.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009906.dll
Infecté par: Trojan.Vundo.EDT

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009906.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009906.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009907.dll
Infecté par: Trojan.Vundo.GH

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009907.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009908.dll
Infecté par: Trojan.Vundo.EEH

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009908.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009908.dll
Supprimé

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009909.dll
Infecté par: Trojan.Vundo.EDT

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009909.dll
Echec de la désinfection

C:\System Volume Information\_restore{31897B8B-2569-4395-B80F-AC1E5AAC218F}\RP57\A0009909.dll
Supprimé





merci pour la reponse

amno

salut a toi

oh ! grand vizir !

voici le rapport numero 1, le 2 arrive de suite....

[b]SDFix: Version 1.162 [/b]

Run by Fred on 2008-03-27 at 17:47

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\Fred\Bureau\sdfix\SDFix

[b]Checking Services [/b]:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files [/b]:

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-27 18:23:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000000
"hdf12"=hex:f9,4e,cc,36,84,6f,94,ab,5e,07,ed,ae,e0,b0,33,d6,a0,42,9d,d9,c9,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\"
"h0"=dword:00000001
"khjeh"=hex:ff,15,86,30,85,01,8d,5b,16,e5,6b,58,54,51,c1,b5,75,c9,68,10,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,85,4e,5b,06,e4,54,1a,e9,65,88,8a,37,8f,f2,59,3f,..
"khjeh"=hex:f9,0b,6f,e2,e4,02,6b,11,35,4e,dc,ee,b5,b1,29,8d,99,94,b8,5a,6a,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a7,89,5e,17,76,b2,1f,54,bd,3f,9b,a2,93,50,6d,09,96,82,36,53,45,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000000
"hdf12"=hex:f9,4e,cc,36,84,6f,94,ab,5e,07,ed,ae,e0,b0,33,d6,a0,42,9d,d9,c9,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\installations\logiciels\deamon tools\DAEMON Tools Lite\"
"h0"=dword:00000001
"khjeh"=hex:ff,15,86,30,85,01,8d,5b,16,e5,6b,58,54,51,c1,b5,75,c9,68,10,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,09,85,4e,5b,06,e4,54,1a,e9,65,88,8a,37,8f,f2,59,3f,..
"khjeh"=hex:f9,0b,6f,e2,e4,02,6b,11,35,4e,dc,ee,b5,b1,29,8d,99,94,b8,5a,6a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a7,89,5e,17,76,b2,1f,54,bd,3f,9b,a2,93,50,6d,09,96,82,36,53,45,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000091

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\\Program Files\\installations\\jeux\\halo2\\halo.exe"="C:\\Program Files\\installations\\jeux\\halo2\\halo.exe:*:Enabled:Halo"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Program Files\\installations\\logiciels\\emule\\emule.exe"="C:\\Program Files\\installations\\logiciels\\emule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe"="C:\\Program Files\\installations\\jeux\\dirt\\DiRT.exe:*:Enabled:DiRT Executable"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"

[b]Remaining Files [/b]:


File Backups: - C:\DOCUME~1\Fred\Bureau\sdfix\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 17 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cc102203f99c8c6ebf1523556f8411b6\BIT3.tmp"
Mon 17 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT2.tmp"

[b]Finished![/b]



le voilà ! !!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:48, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
O20 - Winlogon Notify: ssqnnlj - ssqnnlj.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

oups !

pardon

voila

File/Folder C:\Windows\system32\ssqnnlj.dll not found.

OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03272008_202154


et l'autre

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:25, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe
C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\INSTAL~2\LOGICI~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\INSTAL~2\LOGICI~1\ANTIVI~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\installations\logiciels\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\installations\logiciels\superantispyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\installations\logiciels\superantispyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\installations\logiciels\antivirus\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\installations\logiciels\antivirus\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

faudra que tu m'explique comment tu fais pour savoir ce qui est infecté et ce qu'il faut faire

c possible ça ?

grande vizirette ?

a bientôt

merci encore ...... merci beaucoup !!!!!!

amnohymne

signe !!