Helpeur et hijackthis

merci .

Voici les deux rapports combofix et hijackthis :

ComboFix 08-05-29.1 - label 2008-05-30 21:46:11.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.378 [GMT 2:00]
Endroit: C:\Users\label\Desktop\ComboFix.exe
Command switches used :: c:\Users\label\AppData\Roaming\Microsoft\Windows\Recent\CFScript.txt..lnk
.

((((((((((((((((((((((((((((( Fichiers créés 2008-04-28 to 2008-05-30 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-30 13:30 --------- d-----w C:\Users\label\AppData\Roaming\Uniblue
2008-05-30 13:30 --------- d-----w C:\Program Files\Uniblue
2008-05-30 13:03 --------- d-----w C:\Users\label\AppData\Roaming\uTorrent
2008-05-30 06:11 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-05-29 22:29 --------- d-----w C:\Users\label\AppData\Roaming\Malwarebytes
2008-05-29 22:29 --------- d-----w C:\ProgramData\Malwarebytes
2008-05-29 22:29 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-05-29 21:28 --------- d-----w C:\Program Files\Trend Micro
2008-05-28 07:15 --------- d-----w C:\Program Files\DivX
2008-05-27 21:58 --------- d-----w C:\Program Files\ESET
2008-05-27 19:55 174 --sha-w C:\Program Files\desktop.ini
2008-05-27 19:45 --------- d-----w C:\Program Files\Windows Sidebar
2008-05-27 19:45 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-05-27 19:45 --------- d-----w C:\Program Files\Windows Mail
2008-05-27 19:45 --------- d-----w C:\Program Files\Windows Journal
2008-05-27 19:45 --------- d-----w C:\Program Files\Windows Defender
2008-05-27 19:45 --------- d-----w C:\Program Files\Windows Collaboration
2008-05-27 19:45 --------- d-----w C:\Program Files\Windows Calendar
2008-05-27 19:26 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-05-27 19:26 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-05-27 17:14 --------- d-----w C:\Program Files\Yahoo!
2008-05-26 22:16 --------- d-----w C:\Program Files\uTorrent
2008-05-26 21:59 --------- d-----w C:\Program Files\Google
2008-05-26 21:56 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-05-26 21:56 315,392 ----a-w C:\Windows\HideWin.exe
2008-05-26 21:56 --------- d-----w C:\Users\label\AppData\Roaming\WinBatch
2008-05-26 21:56 --------- d-----w C:\Program Files\Realtek
2008-05-26 02:22 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-26 02:17 --------- d-----w C:\Program Files\Windows Live
2008-05-26 02:16 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-26 02:13 --------- d-----w C:\ProgramData\WLInstaller
2008-05-26 02:09 --------- d-----w C:\Program Files\CCleaner
2008-05-25 22:27 --------- d-----w C:\ProgramData\ESET
2008-05-25 21:55 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-25 21:53 --------- d-----w C:\ProgramData\Symantec
2008-05-25 21:44 1,843 --sha-r C:\Windows\system32\drivers\103C_HP_CPC_RR461AA-ABF s7710.fr_YC_0Pavi_QCNH651_E71FRv3PrA3_49_ICalcite_SASUSTeK Computer INC._V1.xx_B5.07_T061213_WUH0_L40C_M1015_J250_7Intel_8Celeron M 430_91.73_#080519_N808627DC_Z_G808627A2.MRK
2008-05-25 21:14 988,216 ----a-w C:\Windows\System32\winload.exe
2008-05-25 21:14 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-05-25 21:14 615,992 ----a-w C:\Windows\System32\ci.dll
2008-05-25 21:14 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-05-25 21:14 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-05-25 21:14 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-05-25 21:14 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-05-25 21:14 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-05-25 21:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-05-25 21:14 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-05-25 21:13 2,032,128 ----a-w C:\Windows\System32\win32k.sys
2008-05-25 21:12 295,936 ----a-w C:\Windows\System32\gdi32.dll
2008-05-25 21:03 826,880 ----a-w C:\Windows\System32\wininet.dll
2008-05-25 21:02 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-25 20:33 --------- d-----w C:\Users\label\AppData\Roaming\Hewlett-Packard
2008-05-25 20:26 --------- d-sh--w C:\ProgramData\Modèles
2008-05-25 20:26 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-05-25 20:26 --------- d-sh--w C:\ProgramData\Favoris
2008-05-25 20:26 --------- d-sh--w C:\ProgramData\Documents
2008-05-25 20:26 --------- d-sh--w C:\ProgramData\Bureau
2008-05-25 20:26 --------- d-sh--w C:\ProgramData\Application Data
2008-05-25 20:26 --------- d-sh--w C:\Program Files\Fichiers communs
2008-05-13 01:53 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-05-13 01:53 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-05-13 01:51 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-05-13 01:51 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-05-13 01:49 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-05-13 01:49 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-05-05 18:46 27,048 ----a-w C:\Windows\system32\drivers\mbamcatchme.sys
2008-05-05 18:46 15,864 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-03-25 15:07 920,088 ----a-w C:\Windows\System32\igxpun.exe
2008-03-25 15:07 539,160 ----a-w C:\Windows\System32\igfxcfg.exe
2008-03-25 15:07 256,536 ----a-w C:\Windows\System32\igfxsrvc.exe
2008-03-25 15:07 170,520 ----a-w C:\Windows\System32\igfxzoom.exe
2008-03-25 15:07 170,520 ----a-w C:\Windows\System32\igfxext.exe
2008-03-25 15:07 166,424 ----a-w C:\Windows\System32\hkcmd.exe
2008-03-25 15:07 141,848 ----a-w C:\Windows\System32\igfxtray.exe
2008-03-25 15:07 133,656 ----a-w C:\Windows\System32\igfxpers.exe
2008-03-25 14:56 147,456 ----a-w C:\Windows\System32\igfxCoIn_v1461.dll
2008-03-25 14:44 3,301,376 ----a-w C:\Windows\System32\igdumd32.dll
2008-03-25 14:33 2,420,736 ----a-w C:\Windows\System32\ig4icd32.dll
2008-03-25 14:33 2,174,976 ----a-w C:\Windows\System32\ig4dev32.dll
2008-03-25 14:26 241,664 ----a-w C:\Windows\System32\igfxTMM.dll
2008-03-25 14:25 69,632 ----a-w C:\Windows\System32\oemdspif.dll
2008-03-25 14:25 48,640 ----a-w C:\Windows\System32\igfxsrvc.dll
2008-03-25 14:25 24,576 ----a-w C:\Windows\System32\igfxexps.dll
2008-03-25 14:25 204,800 ----a-w C:\Windows\System32\igfxpph.dll
2008-03-25 14:25 135,168 ----a-w C:\Windows\System32\igfxdo.dll
2008-03-25 14:25 106,496 ----a-w C:\Windows\System32\hccutils.dll
2008-03-25 14:24 3,293,184 ----a-w C:\Windows\System32\igfxress.dll
2008-03-25 14:24 204,800 ----a-w C:\Windows\System32\igfxdev.dll
2008-03-15 01:46 1,206,366 ----a-w C:\Windows\wrar371.exe
2008-03-08 04:21 1,695,744 ----a-w C:\Windows\System32\gameux.dll
2008-03-08 04:19 540,672 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-03-08 04:19 458,752 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-03-08 04:19 2,153,984 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-03-08 04:19 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-03-08 02:08 4,240,384 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-03-08 01:58 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((( snapshot@2008-05-30_20.26.31,18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-30 18:23:35 6,189,056 ----a-w C:\Windows\erdnt\Hiv-backup\SCHEMA.DAT
+ 2008-05-30 19:45:59 6,189,056 ----a-w C:\Windows\erdnt\Hiv-backup\SCHEMA.DAT
- 2008-05-30 18:08:46 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-05-30 19:10:08 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-05-30 18:08:46 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-30 19:10:08 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-30 18:08:46 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-05-30 19:10:08 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 09:36 2153472 C:\WINDOWS\System32\oobefldr.dll]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]
"Uniblue RegistryBooster 2"="c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe" [2008-05-05 12:22 99608]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 15:42 65536]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 17:44 61440]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 11:26 4874240 C:\WINDOWS\RtHDVCpl.exe]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-03-25 17:07 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-03-25 17:07 166424]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-03-25 17:07 133656]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{AA2A312E-9A75-4CEC-8EA1-D7FEFE6CF056}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{4BF5302F-4778-4F3E-AE22-64F61FEBFC30}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{3C5740AA-0C23-4AF8-BAFF-CC19BD18C78B}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent

R1 epfwtdir;epfwtdir;C:\Windows\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-03-25 16:44]
R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;C:\Windows\system32\DRIVERS\netr73.sys [2007-05-11 16:40]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-30 21:47:53
Windows 6.0.6001 Service Pack 1 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-05-30 21:48:52
ComboFix-quarantined-files.txt 2008-05-30 19:48:39
ComboFix2.txt 2008-05-30 18:26:44

Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.

176 --- E O F --- 2008-05-30 08:21:44
eux rapports combofix et hijackthis :


ET



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:29:38, on 29/05/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\hp\KBD\kbd.exe
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\System32\wsqmcons.exe
C:\Program Files\Trend Micro\monjack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/webhp?sourceid=navclient&hl=fr&ie=UTF-8&gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

est-ce que je doit faire hijackthis en mode normal ou sans echec? merci.

he bien merci beaucoup vraiment mille merci pour ce travaille qui c'est tres bien passer . Je tiens à dire que toi et beaucoup d'autre sur ce site que j'ai pu voir à travers le forum , vous etes phénomenals en informatique et le plus méritant , c'est votre patience bravo et encore merci .

sympatiquement, polux