Infesté par Vers et Chevaux de troie

SLt

Merci pour ton aide. Mes réponses :

1/ Ordinateur Sain
2/ PAs de log
3/ J'ai suivi le tuto et redémarrer en mode sans échec pour Combofix.
Voici ile rapport :

ComboFix 08-07-10.1 - guillaume 2008-07-11 0:08:36.1 - NTFSx86 MINIMAL
Endroit: D:\Documents and Settings\guillaume\Bureau\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\oeminfo.ini
D:\Documents and Settings\guillaume\Application Data\inst.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-06-10 to 2008-07-10 ))))))))))))))))))))))))))))))))))))
.

2008-07-10 23:48 . 2008-07-10 23:48 173 --a------ C:\curr_ver.tmp
2008-07-10 23:47 . 2008-07-10 23:47 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-07-10 19:56 . 2008-07-10 23:38 <REP> d-------- D:\Documents and Settings\guillaume\Contacts
2008-07-10 19:56 . 2008-07-10 19:56 268 --ah----- C:\sqmdata00.sqm
2008-07-10 19:56 . 2008-07-10 19:56 244 --ah----- C:\sqmnoopt00.sqm
2008-07-10 19:50 . 2008-07-10 19:53 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-07-10 19:49 . 2008-07-10 19:49 <REP> d-------- D:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-10 19:49 . 2008-07-10 19:58 <REP> d-------- C:\Program Files\Windows Live
2008-07-10 00:49 . 2008-07-10 00:49 <REP> d-------- C:\Program Files\CleanUp!
2008-07-10 00:11 . 2006-10-04 16:06 1,197,294 --------- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-07-10 00:11 . 2006-10-04 16:06 764,868 --------- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-07-10 00:11 . 2006-10-04 16:06 217,118 --------- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-07-10 00:10 . 2008-07-10 00:10 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-07-10 00:09 . 2008-07-10 00:09 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-07-10 00:09 . 2008-07-10 00:09 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-07-10 00:08 . 2008-07-10 00:08 <REP> d-------- C:\Program Files\MSXML 6.0
2008-07-10 00:07 . 2005-01-28 13:44 396,528 --a------ C:\WINDOWS\system32\setb0.tmp
2008-07-10 00:07 . 2005-01-28 13:44 224,768 --a------ C:\WINDOWS\system32\setb1.tmp
2008-07-10 00:06 . 2008-04-23 06:16 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-07-10 00:06 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-07-10 00:06 . 2007-03-08 07:10 1,048,576 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-07-10 00:06 . 2008-04-23 06:16 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-07-10 00:06 . 2008-04-23 06:16 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-07-10 00:06 . 2008-04-23 06:16 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-07-10 00:06 . 2008-04-23 06:16 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2008-07-10 00:06 . 2008-04-23 06:16 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-07-10 00:06 . 2008-04-22 09:39 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-07-09 23:35 . 2008-07-09 23:35 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Grisoft
2008-07-09 23:30 . 2008-07-09 23:30 <REP> d-------- C:\Program Files\MSXML 4.0
2008-07-09 23:27 . 2008-07-10 00:12 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-07-09 23:17 . 2008-07-09 23:17 <REP> d-------- C:\Program Files\Realtek AC97
2008-07-09 23:15 . 2008-07-09 23:15 <REP> d-------- C:\WINDOWS\OPTIONS
2008-07-09 23:15 . 2008-07-09 23:15 <REP> d-------- C:\Program Files\Realtek
2008-07-09 23:15 . 2008-02-25 20:54 105,088 --a------ C:\WINDOWS\system32\drivers\Rtnicxp.sys
2008-07-09 23:14 . 2008-07-09 23:14 <REP> d-------- D:\Documents and Settings\guillaume\Application Data\InstallShield
2008-07-09 23:12 . 2006-08-21 11:14 128,896 --------- C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-07-09 23:12 . 2006-08-21 11:14 23,040 --------- C:\WINDOWS\system32\dllcache\fltmc.exe
2008-07-09 23:12 . 2006-08-21 14:26 16,896 --------- C:\WINDOWS\system32\dllcache\fltlib.dll
2008-07-09 23:10 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-07-09 23:10 . 2008-07-10 00:37 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-07-09 23:08 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-07-09 23:08 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-09 23:01 . 2008-07-09 23:01 <REP> d-------- D:\Documents and Settings\All Users\Application Data\ma-config.com
2008-07-09 23:01 . 2008-07-09 23:01 <REP> d-------- C:\Program Files\ma-config.com
2008-07-09 23:01 . 2007-07-09 15:11 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-07-09 22:56 . 2008-05-08 14:28 202,752 --------- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-07-09 22:52 . 2008-07-09 22:52 <REP> d-------- C:\Program Files\Trend Micro
2008-07-09 22:42 . 2008-07-09 22:42 <REP> d--hs---- D:\Documents and Settings\guillaume\UserData
2008-07-09 22:29 . 2008-07-09 22:29 <REP> d-------- C:\Program Files\Wireless LAN Utility
2008-07-09 22:29 . 2005-08-04 17:28 49,152 --a------ C:\WINDOWS\system32\unWdWu.exe
2008-07-09 22:29 . 2005-04-14 17:02 31,872 --a------ C:\WINDOWS\system32\drivers\sisnpf.sys
2008-07-09 22:28 . 2008-07-09 22:28 <REP> d-------- C:\Program Files\SiSWLAN
2008-07-09 22:28 . 2005-11-02 10:53 215,552 --a------ C:\WINDOWS\system32\drivers\sis163u.sys
2008-07-09 22:28 . 2005-01-06 14:04 49,152 --a------ C:\WINDOWS\system32\unwlsdrv.exe
2008-07-09 22:28 . 2008-07-09 22:28 0 --a------ C:\WINDOWS\system32\wunilog.ini
2008-07-04 20:20 . 2008-07-04 20:20 <REP> d-------- C:\Program Files\Alwil Software
2008-07-04 19:51 . 2008-07-04 19:51 14,848 --ahs---- C:\WINDOWS\Thumbs.db
2008-07-04 19:46 . 2008-07-04 20:17 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2008-07-04 19:29 . 2008-07-04 19:29 <REP> d-------- D:\Documents and Settings\guillaume\Application Data\Malwarebytes
2008-07-04 19:29 . 2008-07-04 19:29 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-04 19:29 . 2008-07-09 22:44 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-04 19:29 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-04 19:29 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-04 19:26 . 2008-07-04 19:26 <REP> d-------- D:\Documents and Settings\guillaume\Application Data\Auslogics
2008-07-04 19:26 . 2008-07-04 19:26 <REP> d-------- C:\Program Files\AusLogics Disk Defrag
2008-07-04 19:26 . 2006-09-05 18:03 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-20 19:41 . 2008-06-20 19:41 247,808 --------- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 12:45 . 2008-06-20 12:45 360,320 --------- C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 12:44 . 2008-06-20 12:44 138,368 --------- C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 11:52 . 2008-06-20 11:52 225,920 --------- C:\WINDOWS\system32\dllcache\tcpip6.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-09 21:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-04 17:52 --------- d-----w C:\Program Files\Readiris Pro 8
2008-07-04 17:52 --------- d-----w C:\Program Files\PowerArchiver
2008-07-04 17:49 --------- d-----w C:\Program Files\ASIO4ALL v2
2008-07-04 17:46 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-07-04 17:12 --------- d-----w D:\Documents and Settings\guillaume\Application Data\OpenOffice.org2
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-05-27 18:46 --------- d-----w D:\Documents and Settings\guillaume\Application Data\Vso
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:15 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-23 20:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:41 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:41 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-21 06:57 474,624 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2008-04-21 06:57 152,064 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2008-04-21 06:57 1,499,648 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2008-04-21 06:57 1,056,768 ------w C:\WINDOWS\system32\dllcache\danim.dll
2008-04-21 06:57 1,024,512 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-01-30 19:13 47,360 ------w D:\Documents and Settings\guillaume\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 19:23 102400]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-11-30 17:56 1306624]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 14:00 455168]
"ATIPTA"="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 21:05 344064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" [2005-06-03 03:52 36975]
"PCMService"="c:\Apps\Powercinema\PCMService.exe" [2005-05-11 13:48 127118]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2005-12-13 09:49 217088]
"QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" [2006-09-01 16:57 282624]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-07-09 22:45 6731312]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

D:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
SiWake.lnk - C:\Program Files\Wireless LAN Utility\SiWake.exe [2008-07-09 22:29:01 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm
"msacm.mpegacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\mpegacm.acm
"VIDC.X264"= x264vfw.dll
"VIDC.DIV3"= DivXc32.dll
"VIDC.DIV4"= DivXc32f.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.HFYU"= huffyuv.dll
"VIDC.MPG4"= msmpeg4.dll
"VIDC.MP42"= msmpeg4.dll
"VIDC.MP43"= msmpeg4.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\D:^Documents and Settings^guillaume^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=D:\Documents and Settings\guillaume\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^guillaume^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=D:\Documents and Settings\guillaume\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^guillaume^Menu Démarrer^Programmes^Démarrage^Outil de détection de support Picture Motion Browser.lnk]
path=D:\Documents and Settings\guillaume\Menu Démarrer\Programmes\Démarrage\Outil de détection de support Picture Motion Browser.lnk
backup=C:\WINDOWS\pss\Outil de détection de support Picture Motion Browser.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACTIVBOARD]
--a------ 2003-05-02 11:31 24576 c:\APPS\ABOARD\ABOARD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--------- 2005-06-02 17:03 1957888 C:\Program Files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vade Retro Outlook Express]
--a------ 2004-10-04 13:03 310272 C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\APPS\\skype\\phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

S1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
S2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-06-26 09:13]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys [2005-11-02 10:53]
S3 SISNPF;SIS Netgroup Packet Filter;C:\WINDOWS\system32\drivers\SISNPF.sys [2005-04-14 17:02]
S3 w600bus;Sony Ericsson W600 driver (WDM);C:\WINDOWS\system32\DRIVERS\w600bus.sys []
S3 w600mdfl;Sony Ericsson W600 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w600mdfl.sys []
S3 w600mdm;Sony Ericsson W600 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\w600mdm.sys []
S3 w600mgmt;Sony Ericsson W600 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\w600mgmt.sys []
S3 w600obex;Sony Ericsson W600 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\w600obex.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dc82eae-e23c-11dc-bca7-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47b3a3aa-ddaa-11dc-bca4-00038a000015}]
\Shell\AutoRun\command - K:\u2.cmd
\Shell\explore\Command - K:\u2.cmd
\Shell\open\Command - K:\u2.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{506820f0-7330-11db-bb9d-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51fc067c-20b4-11dd-bcca-00038a000015}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{960252b0-33cc-11dd-bcd1-00038a000015}]
\Shell\AutoRun\command - F:\u2.cmd
\Shell\explore\Command - F:\u2.cmd
\Shell\open\Command - F:\u2.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e1a54c2-0fe4-11dd-bcc3-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1df2240-3f9b-11dd-bcd4-00038a000015}]
\Shell\AutoRun\command - F:\u2.cmd
\Shell\explore\Command - F:\u2.cmd
\Shell\open\Command - F:\u2.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a888d756-701a-11db-bb95-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf5a2730-1108-11dd-bcc4-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf5df802-17be-11dd-bcc8-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dcc84db2-a847-11dc-bc7f-00038a000015}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{edc3d7c2-fd9d-11dc-bcb9-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f36de24a-b0b5-11dc-bc8a-00038a000015}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f36de24b-b0b5-11dc-bc8a-00038a000015}]
\Shell\AutoRun\command - F:\u2.cmd
\Shell\explore\Command - F:\u2.cmd
\Shell\open\Command - F:\u2.cmd

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-07-10 17:30:00 C:\WINDOWS\Tasks\Extension de garantie.job"
- C:\APPS\SMP\PBCARNOT.EXE
"2008-07-10 17:30:00 C:\WINDOWS\Tasks\Master CD_DVD Creator.job"
- C:\Apps\SMP\MCDCHECK.EXE
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-wsctf.exe - wsctf.exe


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-11 00:11:46
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-07-11 0:13:46
ComboFix-quarantined-files.txt 2008-07-10 22:13:31

Pre-Run: 18,798,338,048 octets libres
Post-Run: 18,785,853,440 octets libres

268 --- E O F --- 2008-07-10 21:47:21

et le rapport Hijack :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:23:55, on 11/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Bonsoir

Aucun changement mis à part les mises à jour Windows et l'installation de Windows Live messenger...
Concernant Combofix, je l'ai lu sur un tuto posté sur comment ça marche.
J'ai refait la manip en mode normal.
Voici le rapport :

ComboFix 08-07-11.1 - guillaume 2008-07-11 20:27:23.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.132 [GMT 2:00]
Endroit: D:\Documents and Settings\guillaume\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers créés 2008-06-11 to 2008-07-11 ))))))))))))))))))))))))))))))))))))
.

2008-07-11 20:22 . 2008-07-11 20:22 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Installations
2008-07-11 20:18 . 2008-07-11 20:18 <REP> d-------- C:\WINDOWS\LastGood
2008-07-11 20:18 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-11 20:18 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-07-11 20:18 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-11 00:25 . 2008-07-11 00:25 <REP> d-------- D:\Documents and Settings\guillaume\DoctorWeb
2008-07-10 23:48 . 2008-07-10 23:48 173 --a------ C:\curr_ver.tmp
2008-07-10 23:47 . 2008-07-10 23:47 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-07-10 19:56 . 2008-07-10 23:38 <REP> d-------- D:\Documents and Settings\guillaume\Contacts
2008-07-10 19:56 . 2008-07-10 19:56 268 --ah----- C:\sqmdata00.sqm
2008-07-10 19:56 . 2008-07-10 19:56 244 --ah----- C:\sqmnoopt00.sqm
2008-07-10 19:50 . 2008-07-10 19:53 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-07-10 19:49 . 2008-07-10 19:49 <REP> d-------- D:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-10 19:49 . 2008-07-10 19:58 <REP> d-------- C:\Program Files\Windows Live
2008-07-10 00:49 . 2008-07-10 00:49 <REP> d-------- C:\Program Files\CleanUp!
2008-07-10 00:11 . 2006-10-04 16:06 1,197,294 --------- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-07-10 00:11 . 2006-10-04 16:06 764,868 --------- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-07-10 00:11 . 2006-10-04 16:06 217,118 --------- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-07-10 00:10 . 2008-07-10 00:10 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-07-10 00:09 . 2008-07-10 00:09 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-07-10 00:09 . 2008-07-10 00:09 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-07-10 00:08 . 2008-07-10 00:08 <REP> d-------- C:\Program Files\MSXML 6.0
2008-07-10 00:07 . 2005-01-28 13:44 396,528 --a------ C:\WINDOWS\system32\setb0.tmp
2008-07-10 00:07 . 2005-01-28 13:44 224,768 --a------ C:\WINDOWS\system32\setb1.tmp
2008-07-10 00:06 . 2008-04-23 06:16 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-07-10 00:06 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-07-10 00:06 . 2007-03-08 07:10 1,048,576 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-07-10 00:06 . 2008-04-23 06:16 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-07-10 00:06 . 2008-04-23 06:16 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-07-10 00:06 . 2008-04-23 06:16 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-07-10 00:06 . 2008-04-23 06:16 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2008-07-10 00:06 . 2008-04-23 06:16 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-07-10 00:06 . 2008-04-22 09:39 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-07-09 23:35 . 2008-07-09 23:35 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Grisoft
2008-07-09 23:30 . 2008-07-09 23:30 <REP> d-------- C:\Program Files\MSXML 4.0
2008-07-09 23:27 . 2008-07-10 00:12 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-07-09 23:17 . 2008-07-09 23:17 <REP> d-------- C:\Program Files\Realtek AC97
2008-07-09 23:15 . 2008-07-09 23:15 <REP> d-------- C:\WINDOWS\OPTIONS
2008-07-09 23:15 . 2008-07-09 23:15 <REP> d-------- C:\Program Files\Realtek
2008-07-09 23:15 . 2008-02-25 20:54 105,088 --a------ C:\WINDOWS\system32\drivers\Rtnicxp.sys
2008-07-09 23:14 . 2008-07-09 23:14 <REP> d-------- D:\Documents and Settings\guillaume\Application Data\InstallShield
2008-07-09 23:12 . 2006-08-21 11:14 128,896 --------- C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-07-09 23:12 . 2006-08-21 11:14 23,040 --------- C:\WINDOWS\system32\dllcache\fltmc.exe
2008-07-09 23:12 . 2006-08-21 14:26 16,896 --------- C:\WINDOWS\system32\dllcache\fltlib.dll
2008-07-09 23:10 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-07-09 23:10 . 2008-07-10 00:37 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-07-09 23:08 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-07-09 23:08 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-09 23:01 . 2008-07-09 23:01 <REP> d-------- D:\Documents and Settings\All Users\Application Data\ma-config.com
2008-07-09 23:01 . 2008-07-09 23:01 <REP> d-------- C:\Program Files\ma-config.com
2008-07-09 23:01 . 2007-07-09 15:11 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-07-09 22:56 . 2008-05-08 14:28 202,752 --------- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-07-09 22:52 . 2008-07-09 22:52 <REP> d-------- C:\Program Files\Trend Micro
2008-07-09 22:42 . 2008-07-09 22:42 <REP> d--hs---- D:\Documents and Settings\guillaume\UserData
2008-07-09 22:29 . 2008-07-09 22:29 <REP> d-------- C:\Program Files\Wireless LAN Utility
2008-07-09 22:29 . 2005-08-04 17:28 49,152 --a------ C:\WINDOWS\system32\unWdWu.exe
2008-07-09 22:29 . 2005-04-14 17:02 31,872 --a------ C:\WINDOWS\system32\drivers\sisnpf.sys
2008-07-09 22:28 . 2008-07-09 22:28 <REP> d-------- C:\Program Files\SiSWLAN
2008-07-09 22:28 . 2005-11-02 10:53 215,552 --a------ C:\WINDOWS\system32\drivers\sis163u.sys
2008-07-09 22:28 . 2005-01-06 14:04 49,152 --a------ C:\WINDOWS\system32\unwlsdrv.exe
2008-07-09 22:28 . 2008-07-09 22:28 0 --a------ C:\WINDOWS\system32\wunilog.ini
2008-07-04 20:20 . 2008-07-04 20:20 <REP> d-------- C:\Program Files\Alwil Software
2008-07-04 19:51 . 2008-07-04 19:51 14,848 --ahs---- C:\WINDOWS\Thumbs.db
2008-07-04 19:46 . 2008-07-04 20:17 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2008-07-04 19:29 . 2008-07-04 19:29 <REP> d-------- D:\Documents and Settings\guillaume\Application Data\Malwarebytes
2008-07-04 19:29 . 2008-07-04 19:29 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-04 19:29 . 2008-07-09 22:44 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-04 19:29 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-04 19:29 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-04 19:26 . 2008-07-04 19:26 <REP> d-------- D:\Documents and Settings\guillaume\Application Data\Auslogics
2008-07-04 19:26 . 2008-07-04 19:26 <REP> d-------- C:\Program Files\AusLogics Disk Defrag
2008-07-04 19:26 . 2006-09-05 18:03 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-20 19:41 . 2008-06-20 19:41 247,808 --------- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 12:45 . 2008-06-20 12:45 360,320 --------- C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 12:44 . 2008-06-20 12:44 138,368 --------- C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 11:52 . 2008-06-20 11:52 225,920 --------- C:\WINDOWS\system32\dllcache\tcpip6.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-09 21:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-04 17:52 --------- d-----w C:\Program Files\Readiris Pro 8
2008-07-04 17:52 --------- d-----w C:\Program Files\PowerArchiver
2008-07-04 17:49 --------- d-----w C:\Program Files\ASIO4ALL v2
2008-07-04 17:46 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-07-04 17:12 --------- d-----w D:\Documents and Settings\guillaume\Application Data\OpenOffice.org2
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-05-27 18:46 --------- d-----w D:\Documents and Settings\guillaume\Application Data\Vso
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:15 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-23 20:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:41 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:41 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-21 06:57 474,624 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2008-04-21 06:57 152,064 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2008-04-21 06:57 1,499,648 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2008-04-21 06:57 1,056,768 ------w C:\WINDOWS\system32\dllcache\danim.dll
2008-04-21 06:57 1,024,512 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-01-30 19:13 47,360 ------w D:\Documents and Settings\guillaume\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((( snapshot@2008-07-11_ 0.13.09,21 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-10 22:05:08 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-11 18:15:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-11 18:15:46 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_58c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 19:23 102400]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 14:00 455168]
"ATIPTA"="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 21:05 344064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" [2005-06-03 03:52 36975]
"PCMService"="c:\Apps\Powercinema\PCMService.exe" [2005-05-11 13:48 127118]
"QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" [2006-09-01 16:57 282624]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-07-09 22:45 6731312]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm
"msacm.mpegacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\mpegacm.acm
"VIDC.X264"= x264vfw.dll
"VIDC.DIV3"= DivXc32.dll
"VIDC.DIV4"= DivXc32f.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.HFYU"= huffyuv.dll
"VIDC.MPG4"= msmpeg4.dll
"VIDC.MP42"= msmpeg4.dll
"VIDC.MP43"= msmpeg4.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\D:^Documents and Settings^guillaume^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=D:\Documents and Settings\guillaume\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^guillaume^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=D:\Documents and Settings\guillaume\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^guillaume^Menu Démarrer^Programmes^Démarrage^Outil de détection de support Picture Motion Browser.lnk]
path=D:\Documents and Settings\guillaume\Menu Démarrer\Programmes\Démarrage\Outil de détection de support Picture Motion Browser.lnk
backup=C:\WINDOWS\pss\Outil de détection de support Picture Motion Browser.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACTIVBOARD]
--a------ 2003-05-02 11:31 24576 c:\APPS\ABOARD\ABOARD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--------- 2005-06-02 17:03 1957888 C:\Program Files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vade Retro Outlook Express]
--a------ 2004-10-04 13:03 310272 C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\APPS\\skype\\phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-06-26 09:13]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys [2005-11-02 10:53]
S3 SISNPF;SIS Netgroup Packet Filter;C:\WINDOWS\system32\drivers\SISNPF.sys [2005-04-14 17:02]
S3 w600bus;Sony Ericsson W600 driver (WDM);C:\WINDOWS\system32\DRIVERS\w600bus.sys []
S3 w600mdfl;Sony Ericsson W600 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w600mdfl.sys []
S3 w600mdm;Sony Ericsson W600 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\w600mdm.sys []
S3 w600mgmt;Sony Ericsson W600 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\w600mgmt.sys []
S3 w600obex;Sony Ericsson W600 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\w600obex.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dc82eae-e23c-11dc-bca7-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47b3a3aa-ddaa-11dc-bca4-00038a000015}]
\Shell\AutoRun\command - K:\u2.cmd
\Shell\explore\Command - K:\u2.cmd
\Shell\open\Command - K:\u2.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{506820f0-7330-11db-bb9d-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51fc067c-20b4-11dd-bcca-00038a000015}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{960252b0-33cc-11dd-bcd1-00038a000015}]
\Shell\AutoRun\command - F:\u2.cmd
\Shell\explore\Command - F:\u2.cmd
\Shell\open\Command - F:\u2.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e1a54c2-0fe4-11dd-bcc3-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1df2240-3f9b-11dd-bcd4-00038a000015}]
\Shell\AutoRun\command - F:\u2.cmd
\Shell\explore\Command - F:\u2.cmd
\Shell\open\Command - F:\u2.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a888d756-701a-11db-bb95-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf5a2730-1108-11dd-bcc4-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf5df802-17be-11dd-bcc8-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dcc84db2-a847-11dc-bc7f-00038a000015}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{edc3d7c2-fd9d-11dc-bcb9-00038a000015}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f36de24a-b0b5-11dc-bc8a-00038a000015}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f36de24b-b0b5-11dc-bc8a-00038a000015}]
\Shell\AutoRun\command - F:\u2.cmd
\Shell\explore\Command - F:\u2.cmd
\Shell\open\Command - F:\u2.cmd

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-07-10 17:30:00 C:\WINDOWS\Tasks\Extension de garantie.job"
- C:\APPS\SMP\PBCARNOT.EXE
"2008-07-10 17:30:00 C:\WINDOWS\Tasks\Master CD_DVD Creator.job"
- C:\Apps\SMP\MCDCHECK.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-11 20:29:17
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-07-11 20:30:14
ComboFix-quarantined-files.txt 2008-07-11 18:30:09
ComboFix2.txt 2008-07-10 22:13:47

Pre-Run: 18,362,736,640 octets libres
Post-Run: 18,352,455,680 octets libres

273 --- E O F --- 2008-07-10 21:47:21

Ok merci j'ai suivi tes instructions.
Voici le nouveau log Hijackthis :

22:23 11/07/2008Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:23:26, on 11/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\BitLord\BitLord.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\ctfmon.exe
D:\DOCUME~1\GUILLA~1\LOCALS~1\Temp\ICD1.tmp\jinstall.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Ok je vais faire un scan Malwarebytes.
J'ai fait un scan minutieux cette nuit avec Avast, il m'a encore supprimé 432 lignes infectées.
J'ai fait un scan en ligne Bitdefender qui lui aussi m'a suppirmé un certains nombre de fichiers infectés.
En voici le rapport :

BitDefender Online Scanner



Scan report generated at: Fri, Jul 11, 2008 - 23:57:57





Scan path: C:\;D:\;E:\;G:\;H:\;I:\;J:\;







Statistics

Time
00:41:30

Files
133994

Folders
7692

Boot Sectors
4

Archives
6483

Packed Files
7837




Results

Identified Viruses
4

Infected Files
64

Suspect Files
0

Warnings
0

Disinfected
16

Deleted Files
48




Engines Info

Virus Definitions
1363087

Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
15

Archive plugins
34

Unpack plugins
6

E-mail plugins
6

System plugins
4




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP210\A0018885.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP210\A0018885.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP210\A0018913.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP210\A0018913.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP210\A0018916.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP210\A0018916.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP211\A0018939.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP211\A0018939.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP212\A0018944.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP212\A0018944.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP213\A0018956.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP213\A0018956.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP213\A0018974.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP213\A0018974.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP213\A0018978.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP213\A0018978.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP214\A0018990.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP214\A0018990.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP214\A0019014.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP214\A0019014.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP214\A0019017.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP214\A0019017.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP215\A0019021.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP215\A0019021.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP216\A0019038.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP216\A0019038.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP216\A0019052.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP216\A0019052.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP216\A0019055.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP216\A0019055.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP216\A0019078.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP216\A0019078.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP216\A0019081.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP216\A0019081.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP217\A0019087.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP217\A0019087.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP217\A0019125.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP217\A0019125.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP217\A0019127.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP217\A0019127.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP218\A0019147.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP218\A0019147.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP218\A0019158.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP218\A0019158.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP218\A0019161.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP218\A0019161.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP219\A0019180.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP219\A0019180.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP219\A0019196.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP219\A0019196.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP219\A0019197.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP219\A0019197.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP220\A0019211.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP220\A0019211.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP220\A0019222.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP220\A0019222.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP220\A0019225.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP220\A0019225.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019229.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019229.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019240.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019240.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019243.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019243.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019263.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019263.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019266.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019266.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019285.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019285.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019286.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP221\A0019286.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP222\A0019778.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP222\A0019778.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0019868.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0019868.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020099.exe
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020099.exe
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020107.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020107.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020115.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020115.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020121.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020121.cmd
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020122.exe
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020122.exe
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020123.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP223\A0020123.dll
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP239\A0021983.EXE
Infected with: Trojan.PWS.OnlineGames.WJP

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP239\A0021983.EXE
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP239\A0022027.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP239\A0022027.cmd
Deleted

C:\u2.cmd
Infected with: Trojan.PWS.OnlineGames.WMD

C:\u2.cmd
Deleted

C:\WINDOWS\system32\amvo0.dll
Infected with: Trojan.PWS.OnlineGames.QZU

C:\WINDOWS\system32\amvo0.dll
Deleted

D:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\QuickTime 7.1.3.100\QuickTimeInstallerAdmin.exe
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\QuickTime 7.1.3.100\QuickTimeInstallerAdmin.exe
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Expsrv.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Expsrv.dll
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msado15.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msado15.dll
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msadox.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msadox.dll
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msadrh15.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msadrh15.dll
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msjet40.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msjet40.dll
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msjint40.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msjint40.dll
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msjro.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msjro.dll
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msjter40.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msjter40.dll
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msjtes40.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Msjtes40.dll
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Mswstr10.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\Mswstr10.dll
Disinfected

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\vbajet32.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Application Data\Creative\Media Database\JetFileBackup\vbajet32.dll
Disinfected

D:\Documents and Settings\guillaume\Mes documents\fl\FL Studio 6.0.8 XXL Producer Edition [New Fix]\FLEngine.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Mes documents\fl\FL Studio 6.0.8 XXL Producer Edition [New Fix]\FLEngine.dll
Disinfected

D:\Documents and Settings\guillaume\Mes documents\fl\Flstudio5\FL.EXE
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Mes documents\fl\Flstudio5\FL.EXE
Disinfected

D:\Documents and Settings\guillaume\Mes documents\fl\Flstudio5\FLEngine.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Mes documents\fl\Flstudio5\FLEngine.dll
Disinfected

D:\Documents and Settings\guillaume\Mes documents\fl\plugins\Lizard2.dll
Infected with: Win32.Bacalid.A.gen

D:\Documents and Settings\guillaume\Mes documents\fl\plugins\Lizard2.dll
Disinfected

Le pc commence enfin à devenir propre...
Jepost le rpport Malwarebytes dès qu'il est terminé
En tous cas merci pour ton aide

Slt

Voici le rapport Mbam. R.A.S
Je pense que tu veux que je supprime tous les points de restauration et en créer un propre. J'attends de tes nouvelles. Merci

Malwarebytes' Anti-Malware 1.20
Version de la base de données: 941
Windows 5.1.2600 Service Pack 2

13:19:35 14/07/2008
mbam-log-7-14-2008 (13-19-35).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 116249
Temps écoulé: 37 minute(s), 32 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Coucou

J'ai crée un point de restauration qui je l'espère est propre.
J'ai fait un autre scan en ligne via Trend Micro, il n'a trouvé que des cookies trackeurs !! et aussi via DrWeb qui a triouvé encore des fichiers infectés. Ca n'arrête pars pour un pc qui n'avait jms été connecté à Internet je n'ai jms vu ça !!!
Voici un nouveau rapport hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:12:10, on 15/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\svchost.exe
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1215814486581&h=28de850e015efe878ee8f911fdf0db53/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

BOnjour

Dr Web a supprimé 3 fichiers infectés...et impossible de sauvegarder un rapport. J'ai fait un nouveau scan et il n'a rien trouvé....
A+

Salut

Sur tes conseils(et ceux d'un grand nombre d'ulisateurs d'Avast d'après les forums) j'ai installé Antivir.
Voici le rapport. Il n'a rien trouvé :

Avira AntiVir Personal
Report file date: mercredi 16 juillet 2008 01:25

Scanning for 1454594 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Save mode
Username: guillaume
Computer name: guizzzz

Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 22:57:34
ANTIVIR2.VDF : 7.0.5.119 1264128 Bytes 15/07/2008 22:57:45
ANTIVIR3.VDF : 7.0.5.120 2048 Bytes 15/07/2008 22:57:45
Engineversion : 8.1.0.68
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.53 303481 Bytes 15/07/2008 22:58:05
AESCN.DLL : 8.1.0.23 119156 Bytes 15/07/2008 22:58:03
AERDL.DLL : 8.1.0.20 418165 Bytes 15/07/2008 22:58:02
AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 22:58:00
AEOFFICE.DLL : 8.1.0.20 192891 Bytes 15/07/2008 22:57:58
AEHEUR.DLL : 8.1.0.41 1339765 Bytes 15/07/2008 22:57:57
AEHELP.DLL : 8.1.0.15 115063 Bytes 15/07/2008 22:57:51
AEGEN.DLL : 8.1.0.29 307573 Bytes 15/07/2008 22:57:50
AEEMU.DLL : 8.1.0.6 430451 Bytes 15/07/2008 22:57:48
AECORE.DLL : 8.1.0.33 168311 Bytes 15/07/2008 22:57:47
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: C:\Program Files\Avira\AntiVir PersonalEdition Classic\sysscan.avp
Logging..........................: low
Primary action...................: repair
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mercredi 16 juillet 2008 01:25

Starting search for hidden objects.
The driver could not be initialized.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
12 processes with 12 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
Master boot sector HD2
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '19' files ).


Starting the file scan:

Begin scan in 'C:\' <HDD>
C:\pagefile.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <DATA>


End of the scan: mercredi 16 juillet 2008 03:34
Used time: 2:08:53 min

The scan has been done completely.

7550 Scanning directories
232849 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
232849 Files not concerned
6987 Archives were scanned
5 Warnings
0 Notes

A+

Jenny

RAS pour le scan bitdefender... L'ordi a l'air clean !!

Par contre, j'ai fait une défragmentation avec AusLogics Disk Defrag et il fait référence à 7 fichiers indésirables(junk files) qui pourraient ralentir les performance du pc. Du jamais vu pour moi
voici la copie écran [URL=https://imageshack.com/][IMG]http://img523.imageshack.us/img523/8055/sanstitredb7.th.png[/IMG][/URL]
Qu'est-ce que tu en penses ??
Merci

Bah je sais pas trop encore des problèmes de lenteur mais à priori les scans que je fais sont maintenant négatifs.
J'espère que cette fois l'ordi est propre...
C'est bizar j'ai mis à jour Adobe hier via adobe acrobat updater et java me dit que c'est la dernière version...
Je vais faire un scan cette nuit avec bitdefender et s'il ne trouve rien je le rends à son proprio...
Je post demain le rapport bitdenfender
Merci pour ton aide

RAS pour le scan bitdefender... L'ordi a l'air clean !!

Par contre, j'ai fait une défragmentation avec AusLogics Disk Defrag et il fait référence à 7 fichiers indésirables(junk files) qui pourraient ralentir les performance du pc. Du jamais vu pour moi
voici la copie écran [URL=https://imageshack.com/­ng][IMG]http://img523.imageshack.us/img523/8055/sanstitredb7­.th.png/IMG/URL
Qu'est-ce que tu en penses ??
Merci

Bonsoir

C'est la première chose que j'ai faite après l'apparition des symptomes.
J'ai téléchargé et fait un scan avec Junk Files Finder, il a supprimé certains fichiers d'installation temporaires.
Je pense que cela vine tpeut-être des logiciles qui sont pré-installés sur l'ordinateur au moment de l'achat et que j'ai désinstallé en ayant aucune utilité.
Le seul soucis que j'ai c'est que je n'ai aucune information sur les fichiers indésirables, pas de nom de logiciel rien...
Je sais pas trop quoi fair epour régler ce problème du coup.
Merci pour ton aide