Des pubs, des virus, c'est l'anarchie !

Désolé pour le temps de réponse, j'ai eu quelques problèmes de plantage durant l'analyse mais voici enfin le rapport :

Malwarebytes' Anti-Malware 1.18
Version de la base de données: 893

22:00:34 2008-06-26
mbam-log-6-26-2008 (22-00-34).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 124018
Temps écoulé: 47 minute(s), 5 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 33
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 21
Fichier(s) infecté(s): 78

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\cyvvkiqm.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\pmnllifG.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\vtUlJYOG.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e009c59c-9d13-4393-b557-e3f7f96f9848} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{e009c59c-9d13-4393-b557-e3f7f96f9848} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{f30b1b0b-c305-414e-a4ff-ac93a08de0ac} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f30b1b0b-c305-414e-a4ff-ac93a08de0ac} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtuljyog (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\shoppingreport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d444b750 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{f30b1b0b-c305-414e-a4ff-ac93a08de0ac} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMd77784cc (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnllifg -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnllifg -> Delete on reboot.

Dossier(s) infecté(s):
C:\Program Files\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin\2.0.24 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Program Files\Fichiers communs\SystemDoctor (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\resources (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\db (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\report (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\res1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\db (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\report (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\res1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\cyvvkiqm.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\mqikvvyc.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGvWopp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ppoWvGgh.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ppoWvGgh.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iifecbAT.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TAbcefii.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TAbcefii.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pmnllifG.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\Gfillnmp.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Gfillnmp.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rpuxwjpd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dpjwxupr.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rqRllJbY.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\YbJllRqr.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\YbJllRqr.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\waiycxnv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vnxcyiaw.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wvxjjxjo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ojxjjxvw.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xayyoqgv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vgqoyyax.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vtUlJYOG.dll (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\Olivier\Local Settings\Temporary Internet Files\Content.IE5\29MMEA9D\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Local Settings\Temporary Internet Files\Content.IE5\29MMEA9D\css4[3] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Local Settings\Temporary Internet Files\Content.IE5\EM9MDW3W\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Local Settings\Temporary Internet Files\Content.IE5\NMX3HDFB\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Local Settings\Temporary Internet Files\Content.IE5\QDZQ5HQV\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP725\A0124257.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP725\A0124291.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP726\A0124354.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP726\A0124355.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP726\A0124356.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP727\A0124501.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP727\A0124502.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP727\A0124503.0LL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP727\A0124536.0LL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP730\A0126654.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP730\A0126718.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP733\A0126934.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP746\A0130558.dll (Adware.Shopper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP754\A0132523.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0960848-2CE4-4B15-B900-1883B6643414}\RP755\A0137603.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dfowqgon.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGwWPJd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iifeFYro.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\KLGFANKA.0LL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Uninst.exe (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Program Files\Fichiers communs\SystemDoctor\err.log (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\Abbr (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\ActivationCode (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\HOURS (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\ProductCode (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\config.s3db (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\quarantine.s3db (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\Spyware-Secure_trial.exe (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\sqlite3.dll (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\unrar.dll (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\resources\filesDesc_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Valentin\Application Data\ShoppingReport\cs\res1\WhiteList.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\Olivier\Application Data\ShoppingReport\cs\res1\WhiteList.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ayisxwvk.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\system\smss.0xe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.


J'ai redémarré comme demandé, mais malgré cela j'ai eu une alerte de mon pare feu sur une modification du démarrage concernant un fichier .dll du dossier /windows (peut-être dû au fait que j'ai refusé une modification d'un fichier .reg lors d'une alerte survenue après l'analyse du disque dur ?)

Tout s'est bien passé, voici le rapport :

ComboFix 08-06-20.4 - Valentin 2008-06-26 22:23:43.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.479 [GMT 2:00]
Endroit: C:\Documents and Settings\Valentin\Bureau\ComboFix.exe
* Resident AV is active


[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\Documents and Settings\Valentin\Local Settings\Application Data\yysigqk.dat
c:\documents and settings\valentin\local settings\application data\yysigqk.exe
c:\Documents and Settings\Valentin\Local Settings\Application Data\yysigqk_nav.dat
c:\Documents and Settings\Valentin\Local Settings\Application Data\yysigqk_navps.dat
C:\WINDOWS\BMd77784cc.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aknafglk.ini
C:\WINDOWS\system32\bdmxnnfk.ini
C:\WINDOWS\system32\bwsggjtt.ini
C:\WINDOWS\system32\cehiftna.ini
C:\WINDOWS\system32\fhavobvf.ini
C:\WINDOWS\system32\Gfillnmp.ini
C:\WINDOWS\system32\Gfillnmp.ini2
C:\WINDOWS\system32\hOoonUtv.ini
C:\WINDOWS\system32\hOoonUtv.ini2
C:\WINDOWS\system32\ilryqscn.ini
C:\WINDOWS\system32\instsrv.exe
C:\WINDOWS\system32\iqjwxkhd.ini
C:\WINDOWS\system32\jclbgtli.ini
C:\WINDOWS\system32\kwtrixoy.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nprqBcfe.ini
C:\WINDOWS\system32\nprqBcfe.ini2
C:\WINDOWS\system32\ohmwidxv.ini
C:\WINDOWS\system32\pfiyfdmu.ini
C:\WINDOWS\system32\pmnllifG.dll
C:\WINDOWS\system32\twain32.dll
C:\WINDOWS\system32\upsqbvrn.dll
C:\WINDOWS\system32\vtUlJYOG.dll
C:\WINDOWS\system32\wmebijgj.ini
C:\WINDOWS\system32\wqgenhxf.ini
C:\WINDOWS\system32\xworowkr.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_NetManager


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-26 to 2008-06-26 ))))))))))))))))))))))))))))))))))))
.

2008-06-26 22:18 . 2008-06-26 22:18 106,496 --a------ C:\WINDOWS\system32\iuadljio.dll
2008-06-26 22:18 . 2008-06-26 22:18 91,648 --a------ C:\WINDOWS\system32\gypdiadt.dll
2008-06-26 22:18 . 2008-06-26 22:18 80,896 --a------ C:\WINDOWS\system32\umdfyifp.dll
2008-06-26 18:36 . 2008-06-26 18:36 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-26 18:36 . 2008-06-26 18:36 <REP> d-------- C:\Documents and Settings\Valentin\Application Data\Malwarebytes
2008-06-26 18:36 . 2008-06-26 18:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-26 18:36 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-26 18:36 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-26 17:42 . 2008-06-26 17:42 80,896 --------- C:\WINDOWS\system32\cyvvkiqm.dll
2008-06-26 17:41 . 2008-06-26 17:41 106,496 --a------ C:\WINDOWS\system32\gdttotsl.dll
2008-06-26 14:47 . 2008-06-26 14:47 91,648 --------- C:\WINDOWS\system32\ayisxwvk.dll
2008-06-25 18:00 . 2008-06-25 18:00 106,496 --a------ C:\WINDOWS\system32\gtneaghi.dll
2008-06-25 14:46 . 2008-06-25 14:46 106,496 --a------ C:\WINDOWS\system32\vaxcbhro.dll
2008-06-25 14:46 . 2008-06-25 14:46 91,136 --a------ C:\WINDOWS\system32\kafyvbaa.dll
2008-06-24 09:41 . 2008-06-24 09:41 <REP> d-------- C:\Program Files\Rockstar Games
2008-06-23 22:44 . 2008-06-23 22:44 91,136 --a------ C:\WINDOWS\system32\jkxojqsq.dll
2008-06-23 19:51 . 2008-06-23 19:51 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-23 19:51 . 2008-06-23 19:51 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-22 22:19 . 2008-06-22 22:19 <REP> d-------- C:\Documents and Settings\Valentin\Application Data\Voxmobili
2008-06-22 17:32 . 2008-06-22 17:32 <REP> d-------- C:\Program Files\Orange
2008-06-22 17:32 . 2008-06-22 17:32 <REP> d-------- C:\Documents and Settings\Olivier\Application Data\Voxmobili
2008-06-22 10:07 . 2008-06-22 20:53 834 ---hs---- C:\WINDOWS\system32\iebnlhkr.ini
2008-06-21 23:11 . 2008-06-21 23:11 <REP> d-------- C:\Program Files\Trend Micro
2008-06-21 19:52 . 2008-06-21 19:52 <REP> d-------- C:\Program Files\Alwil Software
2008-06-19 14:25 . 2008-06-19 14:25 98,816 --a------ C:\WINDOWS\system32\gnfcweok.dll
2008-06-18 14:23 . 2008-06-18 14:23 98,816 --a------ C:\WINDOWS\system32\crouyymk.dll
2008-06-18 14:18 . 2008-06-18 14:18 89,600 --------- C:\WINDOWS\system32\KIGTBFWC.0LL
2008-06-17 12:48 . 2008-06-17 12:48 90,112 --------- C:\WINDOWS\system32\OIGMJTMY.0LL
2008-06-12 21:51 . 2008-06-12 21:51 <REP> d-------- C:\Program Files\NCH Software
2008-06-12 21:50 . 2008-06-23 19:43 <REP> d-------- C:\Program Files\NCH Swift Sound
2008-06-12 21:50 . 2008-06-23 19:43 <REP> d-------- C:\Documents and Settings\Valentin\Application Data\NCH Swift Sound
2008-06-12 21:50 . 2008-06-12 21:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
2008-06-01 11:19 . 2008-06-01 11:19 <REP> d-------- C:\WINDOWS\system32\Adobe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-26 20:35 --------- d-----w C:\Program Files\Wanadoo
2008-06-26 16:08 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-06-24 07:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-24 00:37 --------- d-----w C:\Program Files\Steam
2008-06-23 18:11 --------- d-----w C:\Program Files\Google
2008-06-23 17:57 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-06-23 17:56 --------- d-----w C:\Program Files\Fichiers communs\Real
2008-06-23 17:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skyline
2008-06-23 17:11 --------- d-----w C:\Program Files\eMule
2008-06-23 17:11 --------- d-----w C:\Program Files\DivX
2008-06-23 16:25 --------- d-----w C:\Documents and Settings\Olivier\Application Data\Roxio
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 14:23 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-24 21:04 --------- d-----w C:\Program Files\Garritan Instruments for Finale
2008-05-24 21:03 --------- d-----w C:\Program Files\Kontakt Player 2
2008-05-23 11:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-05-18 16:21 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-05-13 01:49 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-28 10:32 --------- d-----w C:\Program Files\Java
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2007-06-18 14:09 357 ----a-w C:\Documents and Settings\Valentin\.cb_layout.bin
2006-08-24 17:18 278,528 -c--a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2006-05-10 12:28 560 -c--a-w C:\Documents and Settings\Olivier\Application Data\ViewerApp.dat
2006-04-12 15:18 284 ----a-w C:\Documents and Settings\Valentin\Application Data\ViewerApp.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3EE6D906-E383-43CE-8D61-564A39A5EA1B}]
C:\WINDOWS\system32\vtULEwTK.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{52A41646-6662-4466-8C15-FDB8237DC576}]
C:\WINDOWS\system32\efcBqrpn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8633fbd-b962-4e7d-88b5-cecc749344a7}]
2008-06-26 22:18 106496 --a------ C:\WINDOWS\system32\iuadljio.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-27 18:31 68856]
"WhenUSave"="C:\Program Files\Save\Save.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 17:28 790528]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 22:05 339968]
"Logitech Utility"="Logi_MwX.Exe" [2003-03-04 11:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2004-03-18 09:33 892928]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2003-02-27 05:36 757760]
"RoxioAudioCentral"="C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-02-26 17:50 253952]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2003-08-28 12:47 396800]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"F-Secure Manager"="C:\Program Files\Securitoo\Av_Fw\Common\FSM32.EXE" [2005-10-26 03:51 122929]
"F-Secure TNB"="C:\Program Files\Securitoo\Av_Fw\TNB\TNBUtil.exe" [2005-07-18 16:51 700416]
"F-Secure Startup Wizard"="C:\Program Files\Securitoo\Av_Fw\FSGUI\FSSW.EXE" [2005-10-18 10:29 372736]
"News Service"="C:\Program Files\Securitoo\Av_Fw\FSGUI\ispnews.exe" [2005-05-31 14:45 356352]
"RoxioEngineUtility"="C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe" [2003-02-27 06:31 69632]
"eCarteBleue-LPV-P1"="C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD VISA\ECB.exe" [2005-12-13 16:39 200704]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"d444b750"="C:\WINDOWS\system32\umdfyifp.dll" [2008-06-26 22:18 80896]
"BMd77784cc"="C:\WINDOWS\system32\gypdiadt.dll" [2008-06-26 22:18 91648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll
"vidc.iv41"= ir41_32.dll
"vidc.COL1"= Col4codk.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Valentin^Menu Démarrer^Programmes^Démarrage^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\Valentin\Menu Démarrer\Programmes\Démarrage\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\ASUS\\AsusUpdate\\Update.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\Securitoo\\Av_Fw\\backweb\\6588780\\Program\\fspex.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\svchost.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\Winapp32.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15829:TCP"= 15829:TCP:µTorrent

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-11-18 17:04]
R0 viaraid;viaraid;C:\WINDOWS\system32\DRIVERS\viaraid.sys [2003-10-21 08:03]
R2 BackWeb Plug-in - 6588780;Antivirus Firewall;C:\PROGRA~1\SECURI~1\Av_Fw\backweb\6588780\Program\SERVIC~1.EXE [2006-10-16 19:54]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Securitoo\Av_Fw\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 17:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Securitoo\Av_Fw\Anti-Virus\Win2K\FSgk.sys [2008-03-20 19:33]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Securitoo\Av_Fw\Anti-Virus\Win2K\FSrec.sys [2004-06-01 11:03]
R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys [2006-04-21 18:01]
R2 swgclnt;Star Wars Galaxies Client Service;C:\WINDOWS\system32\DirectX\SystemBack.exe [2002-09-26 07:13]
R2 swgsvr;Star Wars Galaxies Server Service;C:\WINDOWS\system32\DirectX\SystemBack.exe [2002-09-26 07:13]
R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS\tansgt.sys [2006-04-21 18:01]
S3 ASUSHWIO;ASUSHWIO;C:\WINDOWS\system32\drivers\ASUSHWIO.sys []
S3 kbeepm;kbeepm;C:\DOCUME~1\Valentin\LOCALS~1\Temp\kbeepm.sys []
S3 SaiH040C;SaiH040C;C:\WINDOWS\system32\DRIVERS\SaiH040C.sys [2005-07-07 14:10]
S3 SaiU040C;SaiU040C;C:\WINDOWS\system32\DRIVERS\SaiU040C.sys [2005-07-07 14:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce5be7e0-91c7-11da-9394-00073aa301ec}]
\Shell\AutoRun\command - autorun.exe
\Shell\explore\Command - autorun.exe -e
\Shell\open\Command - autorun.exe

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-06-26 10:31:14 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\SECURI~1\Av_Fw\ANTI-V~1\fsav.exe` /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\SECURI~1\Av_Fw\ANTI-V~1\report.txt $C:\PROGRA~1\SECURI~1\Av_Fw\ANTI-V~1.SYSTEM'Tƒche ajout‚e par F-Secure Anti-Virus.
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 22:34:22
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\umdfyifp.dll
-> C:\WINDOWS\system32\gypdiadt.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsgk32.exe
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\Av_Fw\backweb\6588780\Program\fsbwsys.exe
C:\Program Files\Securitoo\Av_Fw\Common\FSMA32.EXE
C:\WINDOWS\system32\FTRTSVC.exe
C:\Program Files\Securitoo\Av_Fw\Common\FSMB32.EXE
C:\Program Files\Securitoo\Av_Fw\backweb\6588780\Program\fspex.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Securitoo\Av_Fw\Common\FCH32.EXE
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\Av_Fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\FSRW.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\FSAV32.exe
C:\Program Files\Securitoo\Av_Fw\FWES\program\fsdfwd.exe
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
C:\Program Files\Wanadoo\TaskBarIcon.exe
C:\Program Files\Securitoo\Av_Fw\Anti-Spyware\FSAW.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Securitoo\Av_Fw\FSGUI\fsguidll.exe
C:\WINDOWS\system32\Winapp32.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-26 22:38:50 - machine was rebooted [Valentin]
ComboFix-quarantined-files.txt 2008-06-26 20:38:43

Pre-Run: 101,673,517,056 octets libres
Post-Run: 101,828,698,112 octets libres

242 --- E O F --- 2008-06-19 20:52:57

Voilà le rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:58:12, on 26/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SECURI~1\Av_Fw\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\Av_Fw\backweb\6588780\program\fsbwsys.exe
C:\Program Files\Securitoo\Av_Fw\Common\FSMA32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Securitoo\Av_Fw\Common\FSMB32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Securitoo\Av_Fw\Common\FCH32.EXE
C:\WINDOWS\system32\DirectX\SystemBack.exe
C:\WINDOWS\system32\DirectX\SystemBack.exe
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\Av_Fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\services.exe
C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsav32.exe
C:\Program Files\Securitoo\Av_Fw\FWES\Program\fsdfwd.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Securitoo\Av_Fw\Common\FSM32.EXE
C:\Program Files\Securitoo\Av_Fw\FSGUI\ispnews.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD VISA\ECB.exe
C:\PROGRA~1\SECURI~1\Av_Fw\ANTI-S~1\fsaw.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Securitoo\Av_Fw\FSGUI\fsguidll.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\Winapp32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Securitoo\Av_Fw\backweb\6588780\Program\fspex.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: (no name) - {3EE6D906-E383-43CE-8D61-564A39A5EA1B} - C:\WINDOWS\system32\vtULEwTK.dll (file missing)
O2 - BHO: (no name) - {52A41646-6662-4466-8C15-FDB8237DC576} - C:\WINDOWS\system32\efcBqrpn.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: {7a443947-ccec-5b88-d7e4-269bdbf3368d} - {d8633fbd-b962-4e7d-88b5-cecc749344a7} - C:\WINDOWS\system32\iuadljio.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\Av_Fw\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\Av_Fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\Av_Fw\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\Av_Fw\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [eCarteBleue-LPV-P1] "C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD VISA\ECB.exe" /dontopenmycards
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [d444b750] rundll32.exe "C:\WINDOWS\system32\umdfyifp.dll",b
O4 - HKLM\..\Run: [BMd77784cc] Rundll32.exe "C:\WINDOWS\system32\gypdiadt.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Favorites.lnk = C:\WINDOWS\system32\WinIogon.exe
O4 - Startup: History.lnk = C:\WINDOWS\system32\winlogin.exe
O4 - Startup: Internet Explorer.lnk = C:\WINDOWS\system32\Winapp32.exe
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\Av_Fw\backweb\6588780\Program\fspex.exe
O4 - Global Startup: Logiciel de Synchronisation Orange.lnk = ?
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\Av_Fw\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\Av_Fw\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\Av_Fw\Anti-Spyware\ieshield.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - https://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\Av_Fw\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\Av_Fw\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\Av_Fw\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\Av_Fw\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Star Wars Galaxies Client Service (swgclnt) - Unknown owner - C:\WINDOWS\system32\DirectX\SystemBack.exe
O23 - Service: Star Wars Galaxies Server Service (swgsvr) - Unknown owner - C:\WINDOWS\system32\DirectX\SystemBack.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

D'accord, je ferai ça demain, je n'ai plus le temps ce soir.