Win32

Bonjour,
Voici mon rapport combofix :
ComboFix 08-07-09.5 - User 2008-07-11 0:02:26.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.667 [GMT 2:00]
Endroit: C:\Documents and Settings\User\Bureau\antibagle.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-06-10 to 2008-07-10 ))))))))))))))))))))))))))))))))))))
.

2008-07-10 22:47 . 2008-07-10 22:47 <REP> d-------- C:\Program Files\PrivacyEraser Computing
2008-07-10 22:36 . 2008-07-10 22:36 <REP> d-------- C:\Program Files\Alwil Software
2008-07-10 22:04 . 2008-07-10 22:04 <REP> d-------- C:\Program Files\Trend Micro
2008-07-10 21:41 . 2008-07-10 21:41 <REP> d-------- C:\!KillBox
2008-07-10 21:36 . 2008-07-10 21:36 <REP> d-------- C:\SAV32CLI
2008-07-09 23:56 . 2008-07-09 23:56 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2008-07-09 23:53 . 2008-07-10 00:01 <REP> d-------- C:\Program Files\Uniblue
2008-07-09 21:54 . 2008-07-09 21:54 <REP> d-------- C:\Program Files\Symantec
2008-07-09 21:54 . 2008-07-09 21:54 <REP> d-------- C:\Program Files\Fichiers communs\Symantec Shared
2008-07-09 20:53 . 2008-07-10 22:38 <REP> d-------- C:\Documents and Settings\User\Application Data\Uniblue
2008-07-09 20:38 . 2008-07-09 20:38 <REP> d-------- C:\stdtsa
2008-07-09 03:59 . 2008-07-09 03:59 81,465 --a------ C:\WINDOWS\system32\drivers\klif.cab
2008-07-09 03:10 . 2008-07-09 21:53 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-07-09 02:36 . 2008-07-10 00:07 <REP> d-------- C:\Program Files\ESET
2008-07-09 01:58 . 2008-07-09 02:49 <REP> d-------- C:\Documents and Settings\User\Application Data\LuckyTender
2008-07-09 01:55 . 2008-07-09 01:55 <REP> d-------- C:\Documents and Settings\User\Application Data\AVGTOOLBAR
2008-07-09 01:55 . 2008-07-09 21:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-07-02 21:09 . 2008-07-02 21:11 <REP> d-------- C:\WINDOWS\A5W_DATA
2008-07-02 21:09 . 2008-07-02 21:13 19,623 --a------ C:\WINDOWS\Run32A50.mch
2008-07-02 21:09 . 2008-07-02 21:11 35 --a------ C:\WINDOWS\A5W.INI
2008-06-24 22:01 . 2008-06-24 22:01 <REP> d-------- C:\Program Files\Apple Software Update
2008-06-24 10:45 . 2008-06-24 11:47 <REP> d-------- C:\Documents and Settings\User\Application Data\U3
2008-06-23 15:45 . 2004-08-19 16:09 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-06-23 15:45 . 2004-08-19 16:09 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-06-23 15:45 . 2004-08-19 16:00 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-06-23 15:45 . 2004-08-19 16:00 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-06-23 15:45 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-06-23 15:45 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-06-22 21:12 . 2008-07-10 20:42 <REP> d-------- C:\Program Files\McDonaldsDragons
2008-06-22 21:11 . 2008-06-22 21:11 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-06-21 00:00 . 2008-06-21 00:23 <REP> d-------- C:\POWERDS
2008-06-21 00:00 . 1996-02-12 11:11 288,368 --a------ C:\WINDOWS\IRSETUP.EXE
2008-06-17 15:36 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-06-14 22:13 . 2008-06-14 22:13 21,032 --a------ C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT
2008-06-14 22:11 . 2008-06-14 22:11 <REP> d-------- C:\Program Files\MSECache
2008-06-14 22:09 . 2008-07-09 21:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-06-14 21:58 . 2008-06-14 21:58 9,216 --a------ C:\WINDOWS\system32\avgwlntf.dll
2008-06-14 13:48 . 2008-06-14 13:48 <REP> dr-h----- C:\$VAULT$.AVG
2008-06-14 13:00 . 2008-06-14 13:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-14 13:00 . 2008-06-14 13:00 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-06-14 13:00 . 2008-06-14 13:00 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-06-11 14:58 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 14:58 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-10 19:57 15,600 ----a-w C:\WINDOWS\gdrv.sys
2008-07-09 21:48 --------- d-----w C:\Program Files\eMule
2008-07-09 12:45 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-07-09 02:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-07-08 23:05 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-08 23:05 --------- d-----w C:\Program Files\AMD
2008-06-27 20:03 --------- d-----w C:\Documents and Settings\User\Application Data\dvdcss
2008-06-24 14:39 --------- d-----w C:\Documents and Settings\User\Application Data\Apple Computer
2008-06-23 14:02 --------- d-----w C:\Documents and Settings\User\Application Data\EPSON
2008-06-03 19:56 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-05-30 13:01 --------- d-----w C:\Program Files\Neuf
2008-05-28 20:27 --------- d-----w C:\Program Files\QuickTime
2008-05-28 20:27 --------- d-----w C:\Program Files\iTunes
2008-05-28 20:27 --------- d-----w C:\Program Files\iPod
2008-05-28 20:27 --------- d-----w C:\Program Files\Bonjour
2008-05-28 20:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-28 20:26 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-05-28 20:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-05-27 14:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\IM
2008-05-27 14:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\IncrediMail
2008-05-26 20:02 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-23 20:57 --------- d-----w C:\Documents and Settings\User\Application Data\Talkback
2008-05-23 15:38 --------- d-----w C:\Program Files\DIFX
2008-05-19 20:27 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-17 16:16 --------- d-----w C:\Program Files\Callserve
2008-05-15 11:16 --------- d-----w C:\Program Files\Windows Live
2008-05-15 11:15 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-05-15 11:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-15 09:28 --------- d-----w C:\Documents and Settings\User\Application Data\vlc
2008-05-15 09:27 --------- d-----w C:\Program Files\VideoLAN
2008-05-14 10:14 --------- d-----w C:\Program Files\sesam
2008-05-13 20:46 --------- d-----w C:\Documents and Settings\User\Application Data\MSNInstaller
2008-05-13 19:57 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-05-13 19:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\UDL
2008-05-13 19:55 --------- d-----w C:\Program Files\epson
2008-05-13 19:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\EPSON
2008-05-13 16:49 --------- d-----w C:\Program Files\SuperCopier2
2008-05-13 15:15 --------- d-----w C:\Documents and Settings\User\Application Data\ATI
2008-05-13 15:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI
2008-05-13 15:10 --------- d-----w C:\Program Files\ATI Technologies
2008-05-13 13:15 --------- d-----w C:\Program Files\MSXML 6.0
2008-05-13 12:44 --------- d-----w C:\Program Files\MSBuild
2008-05-13 12:41 --------- d-----w C:\Program Files\Reference Assemblies
2008-05-13 12:15 --------- d-----w C:\Program Files\Realtek
2008-05-13 12:15 --------- d-----w C:\Documents and Settings\User\Application Data\InstallShield
2008-05-13 10:59 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((( snapshot@2008-07-10_23.50.54.81 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-10 21:48:10 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-10 21:57:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2008-05-05 13:01 1923352]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
2008-06-14 21:58 9216 C:\WINDOWS\system32\avgwlntf.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^SERVEUR TELEVITALE MONOPOSTE.lnk]
backup=C:\WINDOWS\pss\SERVEUR TELEVITALE MONOPOSTE.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinLogon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2006-03-02 14:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
--a------ 2007-03-01 08:01 180736 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATICAE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\minitool]
--a------ 2006-01-26 10:02 692224 C:\TELVITAL\minitool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
--a------ 2008-01-21 12:17 61440 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
--a------ 2008-05-05 13:01 1923352 C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 11:43 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"xmlprov"=3 (0x3)
"WZCSVC"=2 (0x2)
"WudfSvc"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"WmiApSrv"=3 (0x3)
"WmdmPmSN"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"winmgmt"=2 (0x2)
"WebClient"=2 (0x2)
"W32Time"=2 (0x2)
"VSS"=3 (0x3)
"usnjsvc"=3 (0x3)
"UPS"=3 (0x3)
"upnphost"=3 (0x3)
"TrkWks"=2 (0x2)
"Themes"=2 (0x2)
"TermService"=3 (0x3)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"SwPrv"=3 (0x3)
"stisvc"=2 (0x2)
"SSDPSRV"=3 (0x3)
"srservice"=2 (0x2)
"Spooler"=2 (0x2)
"ShellHWDetection"=2 (0x2)
"SENS"=2 (0x2)
"seclogon"=2 (0x2)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"SamSs"=2 (0x2)
"RSVP"=3 (0x3)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"ProtectedStorage"=2 (0x2)
"PolicyAgent"=2 (0x2)
"PlugPlay"=2 (0x2)
"NtmsSvc"=3 (0x3)
"NtLmSsp"=3 (0x3)
"Nla"=3 (0x3)
"Netman"=3 (0x3)
"Netlogon"=3 (0x3)
"NetDDE"=2 (0x2)
"MSIServer"=3 (0x3)
"MSDTC"=3 (0x3)
"mnmsrvc"=3 (0x3)
"LmHosts"=2 (0x2)
"lanmanworkstation"=2 (0x2)
"lanmanserver"=2 (0x2)
"iPod Service"=3 (0x3)
"ImapiService"=2 (0x2)
"idsvc"=3 (0x3)
"HTTPFilter"=3 (0x3)
"HidServ"=2 (0x2)
"helpsvc"=2 (0x2)
"FontCache3.0.0.0"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"EventSystem"=3 (0x3)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"Dnscache"=2 (0x2)
"dmserver"=3 (0x3)
"dmadmin"=3 (0x3)
"Dhcp"=2 (0x2)
"CryptSvc"=3 (0x3)
"COMSysApp"=3 (0x3)
"clr_optimization_v2.0.50727_32"=3 (0x3)
"CiSvc"=3 (0x3)
"Browser"=2 (0x2)
"Bonjour Service"=2 (0x2)
"BITS"=2 (0x2)
"AudioSrv"=2 (0x2)
"ATI Smart"=2 (0x2)
"aspnet_state"=3 (0x3)
"AppMgmt"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"ALG"=3 (0x3)
"AgereModemAudio"=2 (0x2)
"LiveUpdate"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\TELVITAL\\DBSRV50.EXE"=
"C:\\TV\\DBSRV50.EXE"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Callserve\\Téléphone Internet\\CS_Phone.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys [2007-05-31 13:48]
R3 serusb;XIRING USB COM Port;C:\WINDOWS\system32\DRIVERS\usbser.sys [2004-08-03 23:08]
S1 SAVOnAccess Control;SAVOnAccess Control;C:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys []
S1 SAVOnAccess Filter;SAVOnAccess Filter;C:\WINDOWS\system32\DRIVERS\savonaccessfilter.sys []
S3 USBCamera;DSC Still Image Capture (CA100);C:\WINDOWS\system32\Drivers\Bulk100.sys [2002-05-09 06:39]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\Run.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{67ba44b4-20fa-11dd-807f-001d7dc91470}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2e03988-41c9-11dd-ae86-001d7dc91470}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-07-02 21:56:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-07-10 19:52:38 C:\WINDOWS\Tasks\Uniblue SpyEraser Nag.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
"2008-07-09 21:57:57 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-11 00:03:36
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-07-11 0:04:31
ComboFix-quarantined-files.txt 2008-07-10 22:04:20
ComboFix2.txt 2008-07-10 21:52:49

Pre-Run: 135,856,168,960 octets libres
Post-Run: 135,841,832,960 octets libres

280 --- E O F --- 2008-06-21 05:46:17



....et j'ai tjrs pas de solution!!!

Merci kan mem pour votre aide...ya au moins une chose qui a marché!! espoire!!!!!!!