Comment enlever Trojan:Win32/Vundo.HT ?

slt,

scan avec malwarebyte's aprè mise a jour, vire ce qui est trouvé et colle le rapport:
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

___________________

colle un rapport hijackthis

http://www.trendsecure.com/portal/en-US/tools/security_tools­/hijackthis/download

manuel :
http://pagesperso-orange.fr/rginformatique/section%20virus/d­emohijack.htm
http://leblogdeclaude.blogspot.com/2006/10/informatique-sect­ion-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

ok je fais tout sa de suite merci de ton aide

voila pour malwarebytes
mais il ne la pas trouver
Malwarebytes' Anti-Malware 1.20
Version de la base de données: 963
Windows 6.0.6001 Service Pack 1

10:43:10 18/07/2008
mbam-log-7-18-2008 (10-43-10).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 140278
Temps écoulé: 25 minute(s), 46 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\Services en ligne\iminites\iminitelinstaller.exe (Adware.Agent) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:39, on 18/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\system32\wbem\unsecapp.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\conime.exe
C:\hp\kbd\kbd.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hijackthis\eden.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/fr-fr/wlscctrl2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F3350D6-BC02-41AA-BC84-E870DD39E6F2}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

analyse ce fichier sur virus total et collle le rapport: https://www.virustotal.com/gui/

C:\Windows\system32\guard32.dll

_________________

Télécharge Combofix de sUBs : aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: http://bibou0007.forumpro.fr/tutos-f45/tutorial-combofix-t12­1.htm

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Fichier guard32.dll reçu le 2008.07.18 13:56:56 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 0/33 (0%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: ___.
L'heure estimée de démarrage est entre ___ et ___ .
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.17.0 2008.07.18 -
AntiVir 7.8.0.68 2008.07.18 -
Authentium 5.1.0.4 2008.07.18 -
Avast 4.8.1195.0 2008.07.18 -
AVG 8.0.0.130 2008.07.18 -
BitDefender 7.2 2008.07.18 -
CAT-QuickHeal 9.50 2008.07.17 -
ClamAV 0.93.1 2008.07.18 -
DrWeb 4.44.0.09170 2008.07.18 -
eSafe 7.0.17.0 2008.07.17 -
eTrust-Vet 31.6.5965 2008.07.18 -
Ewido 4.0 2008.07.18 -
F-Prot 4.4.4.56 2008.07.18 -
F-Secure 7.60.13501.0 2008.07.18 -
Fortinet 3.14.0.0 2008.07.18 -
GData 2.0.7306.1023 2008.07.18 -
Ikarus T3.1.1.34.0 2008.07.18 -
Kaspersky 7.0.0.125 2008.07.18 -
McAfee 5341 2008.07.18 -
Microsoft 1.3704 2008.07.18 -
NOD32v2 3278 2008.07.18 -
Norman 5.80.02 2008.07.18 -
Panda 9.0.0.4 2008.07.17 -
Prevx1 V2 2008.07.18 -
Rising 20.53.42.00 2008.07.18 -
Sophos 4.31.0 2008.07.18 -
Sunbelt 3.1.1536.1 2008.07.17 -
Symantec 10 2008.07.18 -
TheHacker 6.2.96.381 2008.07.16 -
TrendMicro 8.700.0.1004 2008.07.18 -
VBA32 3.12.8.0 2008.07.17 -
VirusBuster 4.5.11.0 2008.07.17 -
Webwasher-Gateway 6.6.2 2008.07.18 -
Information additionnelle
File size: 143104 bytes
MD5...: d5082666bbf335b39a2b2fbba78b4bff
SHA1..: 92ff8b895f6a6177816cd8973d21503e0d5f8527
SHA256: ab35eb52621008abd6005a500b0c3c23ecb066d1b509fed2a03d0b4616b5e00c
SHA512: 322b47bff8e9788455b4d09c35cd82f185731ded3da7de6b948b62a8819435e8
880d1e105bf7bb71a7de9a22373bdc4cebcdb0630c0e3fbc2643aeb465c29b92
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000a166
timedatestamp.....: 0x4832858f (Tue May 20 08:02:23 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1368a 0x14000 6.41 8e63a8a234ec4fea7400c1e7e06f7260
.rdata 0x15000 0x63be 0x7000 4.42 442ce159eb81cab19b132aa665da3d4c
.data 0x1c000 0x2edc 0x2000 1.46 4001de9f67b36e383d523a445b2e3247
.rsrc 0x1f000 0x2b0 0x1000 0.74 5cb4eb3f37cc37e208a523cc5321f6fe
.reloc 0x20000 0x2654 0x3000 4.48 70859b8d85e0bca5ffb22fdecceca724

( 5 imports )
> KERNEL32.dll: GetCurrentProcess, LocalAlloc, GetLastError, LocalFree, GetModuleHandleW, FlushFileBuffers, CreateFileA, GetModuleFileNameW, CloseHandle, GetCurrentProcessId, GetCurrentThread, GetLocaleInfoA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, WriteConsoleW, GetConsoleOutputCP, FreeLibrary, GetProcAddress, LoadLibraryA, VirtualQuery, SetLastError, GetModuleHandleA, VirtualProtect, VirtualAlloc, InterlockedCompareExchange, GetCurrentThreadId, ResumeThread, FlushInstructionCache, GetThreadContext, SetThreadContext, SuspendThread, GetCommandLineA, HeapFree, GetVersionExA, HeapAlloc, GetProcessHeap, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RaiseException, ExitProcess, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, InterlockedDecrement, Sleep, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, RtlUnwind, HeapSize, LeaveCriticalSection, EnterCriticalSection, HeapReAlloc, WriteFile, SetFilePointer, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, MultiByteToWideChar, InitializeCriticalSection, SetStdHandle, WriteConsoleA
> USER32.dll: GetWindowThreadProcessId, WindowFromDC
> ole32.dll: StringFromCLSID, CoTaskMemFree, ProgIDFromCLSID
> ADVAPI32.dll: GetTokenInformation, OpenProcessToken, EqualSid
> ntdll.dll: NtQueryInformationThread, NtQueryInformationProcess, wcsncpy, NtQuerySystemInformation, RtlAppendUnicodeStringToString, RtlAppendUnicodeToString, RtlCopyUnicodeString, RtlEqualUnicodeString, NtQueryObject, _wcsnicmp

( 0 exports )

Télécharge Combofix de sUBs : aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: http://bibou0007.forumpro.fr/tutos-f45/tutorial-combofix-t12­­1.htm

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

ComboFix 08-07-17.4 - Hermann 2008-07-19 10:58:54.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1209 [GMT 2:00]
Endroit: C:\Users\Hermann\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-06-19 to 2008-07-19 ))))))))))))))))))))))))))))))))))))
.

2008-07-18 10:14 . 2008-07-18 10:45 <REP> d-------- C:\hijackthis
2008-07-18 10:12 . 2008-07-18 10:12 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-18 10:12 . 2008-07-07 17:35 34,296 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
2008-07-18 10:12 . 2008-07-07 17:35 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-07-17 22:22 . 2008-07-17 22:22 <REP> d-------- C:\Program Files\Eidos Interactive
2008-07-11 10:21 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-11 10:21 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-07-11 10:21 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-07-10 13:11 . 2008-07-10 13:11 43,520 --a------ C:\Windows\System32\CmdLineExt03.dll
2008-07-10 12:52 . 2008-07-10 12:52 <REP> d-------- C:\Program Files\LucasArts
2008-07-07 11:53 . 2008-07-07 12:44 <REP> d-------- C:\Program Files\uTorrent
2008-07-07 11:20 . 2008-07-07 11:42 <REP> d-------- C:\Users\Hermann\AppData\Roaming\Azureus
2008-07-07 11:20 . 2008-07-07 11:20 <REP> d-------- C:\Users\All Users\Azureus
2008-07-07 11:20 . 2008-07-07 11:20 <REP> d-------- C:\ProgramData\Azureus
2008-07-07 11:19 . 2008-07-07 11:51 <REP> d-------- C:\Program Files\Azureus
2008-07-07 11:06 . 2008-07-17 22:43 <REP> d-------- C:\Users\Hermann\AppData\Roaming\uTorrent
2008-07-06 14:21 . 2008-07-06 14:24 <REP> dr------- C:\Users\Hermann\Pictures
2008-07-04 10:32 . 2008-07-04 10:32 54,156 --ah----- C:\Windows\QTFont.qfn
2008-07-04 10:32 . 2008-07-04 10:32 1,409 --a------ C:\Windows\QTFont.for
2008-07-02 20:39 . 2008-07-02 20:39 <REP> d-------- C:\Users\Hermann\AppData\Roaming\Microsoft Games
2008-07-02 14:12 . 2008-07-02 14:12 <REP> d-------- C:\Program Files\Common Files\Microsoft Games
2008-07-02 11:01 . 2008-07-02 11:01 <REP> d--hs---- C:\$RECYCLE.BIN
2008-06-30 10:03 . 2008-06-30 10:03 <REP> dr------- C:\Windows\System32\config\systemprofile\Videos
2008-06-30 10:03 . 2008-06-30 10:03 <REP> dr------- C:\Windows\System32\config\systemprofile\Searches
2008-06-30 10:03 . 2008-06-30 10:03 <REP> dr------- C:\Windows\System32\config\systemprofile\Saved Games
2008-06-30 10:03 . 2008-06-30 10:03 <REP> dr------- C:\Windows\System32\config\systemprofile\Pictures
2008-06-30 10:03 . 2008-06-30 10:03 <REP> dr------- C:\Windows\System32\config\systemprofile\Links
2008-06-30 10:03 . 2008-06-30 10:03 <REP> dr------- C:\Windows\System32\config\systemprofile\Downloads
2008-06-30 10:03 . 2008-06-30 10:03 <REP> dr------- C:\Windows\System32\config\systemprofile\Documents
2008-06-26 06:59 . 2008-06-26 06:59 <REP> d-------- C:\Program Files\Trend Micro
2008-06-22 09:50 . 2008-06-22 09:50 319 --a------ C:\Windows\game.ini
2008-06-22 09:11 . 2008-06-22 09:11 <REP> d-------- C:\Program Files\Activision
2008-06-22 09:08 . 2008-06-22 09:08 <REP> d--hs---- C:\Windows\ftpcache

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-19 09:00 --------- d-----w C:\Users\Hermann\AppData\Roaming\Spyware Terminator
2008-07-13 19:27 --------- d-----w C:\Users\Hermann\AppData\Roaming\LimeWire
2008-07-10 11:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-10 11:15 --------- d-----w C:\Program Files\Spyware Terminator
2008-07-10 08:03 --------- d-----w C:\Program Files\Windows Mail
2008-07-03 09:33 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-06-30 07:59 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-06-25 16:40 --------- d-----w C:\ProgramData\Spyware Terminator
2008-06-23 19:10 --------- d-----w C:\Users\Hermann\AppData\Roaming\Image Zone Express
2008-06-20 13:02 3,232 ----a-w C:\Users\Hermann\AppData\Roaming\wklnhst.dat
2008-06-18 09:04 --------- d-----w C:\Program Files\LimeWire
2008-06-18 08:40 --------- d-----w C:\Users\Hermann\AppData\Roaming\vlc
2008-06-18 08:31 --------- d-----w C:\Program Files\Common Files\muvee Technologies
2008-06-18 08:23 --------- d-----w C:\Program Files\Microsoft Games
2008-06-18 08:20 --------- d-----w C:\Program Files\Logitech
2008-06-18 08:18 --------- d-----w C:\Program Files\DivX
2008-06-17 08:57 --------- d-----w C:\Program Files\Java
2008-06-13 11:14 --------- d-----w C:\ProgramData\Symantec
2008-06-13 11:14 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-08 08:12 --------- d-----w C:\Program Files\Google
2008-06-03 10:10 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll
2008-06-03 05:53 --------- d-----w C:\Program Files\THQ
2008-06-02 17:24 --------- d-----w C:\Program Files\Warcraft III
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\Windows\System32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\Windows\System32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-05-25 06:43 85,008 ----a-w C:\Windows\system32\drivers\cmdguard.sys
2008-05-25 06:43 25,104 ----a-w C:\Windows\system32\drivers\cmdhlp.sys
2008-05-25 06:43 143,104 ----a-w C:\Windows\System32\guard32.dll
2008-05-25 06:42 141,312 ----a-w C:\Windows\system32\drivers\sp_rsdrv2.sys
2008-05-22 22:22 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-05-22 22:22 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-05-22 22:20 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-05-22 22:19 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-05-22 22:19 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-05-22 22:19 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-05-10 03:35 564,736 ----a-w C:\Windows\System32\emdmgmt.dll
2008-05-08 21:59 90,112 ----a-w C:\Windows\System32\wshext.dll
2008-05-08 21:59 430,080 ----a-w C:\Windows\System32\vbscript.dll
2008-05-08 21:59 180,224 ----a-w C:\Windows\System32\scrobj.dll
2008-05-08 21:59 172,032 ----a-w C:\Windows\System32\scrrun.dll
2008-05-08 21:59 155,648 ----a-w C:\Windows\System32\wscript.exe
2008-05-08 21:58 135,168 ----a-w C:\Windows\System32\cscript.exe
2008-04-26 08:25 3,600,952 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-04-26 08:25 3,549,240 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-04-26 08:08 1,314,816 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 04:35 826,880 ----a-w C:\Windows\System32\wininet.dll
2008-04-23 20:06 2,560 ----a-w C:\Windows\_MSRSTRT.EXE
2008-04-23 04:42 428,544 ----a-w C:\Windows\System32\EncDec.dll
2008-04-23 04:42 293,376 ----a-w C:\Windows\System32\psisdecd.dll
2008-04-04 16:10 174 --sha-w C:\Program Files\desktop.ini
2008-04-14 13:53 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008040720080414\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-07-18_14.11.08.44 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-18 07:56:34 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-07-19 08:45:03 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-07-18 07:56:34 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-07-19 08:45:03 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-07-18 07:58:06 1,572,864 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-07-19 08:46:02 1,572,864 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
- 2008-07-18 08:11:14 1,572,864 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-07-19 08:46:43 1,572,864 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
- 2008-07-18 12:02:18 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-07-19 08:45:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-07-18 12:02:18 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-07-19 08:45:39 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-07-18 12:02:18 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-07-19 08:45:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-07-18 07:58:33 11,338 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1135877176-2401637280-1905807098-1000_UserData.bin
+ 2008-07-19 08:47:03 11,338 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1135877176-2401637280-1905807098-1000_UserData.bin
- 2008-07-18 07:58:33 77,202 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-07-19 08:47:02 77,256 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-07-17 22:12:35 2,994 ----a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-07-18 21:18:26 2,994 ----a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-07-18 07:58:31 60,126 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-07-19 08:46:59 60,126 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-03-24 11:48 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 17:01 65536]
"KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 18:16 65536]
"OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 13:59 118784]
"StartCCC"="c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 13:13 71176]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 22:52 49152]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-09 12:23 185896]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-05-25 08:42 1817600]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-06-01 10:02 1655552]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 11:26 4874240 C:\Windows\RtHDVCpl.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2008-03-24 11:48 5724184]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 22:40:10 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\Windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
--a------ 2008-01-19 09:33 125952 C:\Windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
--a------ 2007-10-25 16:37 2178832 C:\Program Files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg]
--a------ 2007-04-07 02:56 54936 C:\Windows\System32\jureg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-03-25 04:28 144784 C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--a------ 2008-01-19 09:33 202240 C:\Program Files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{E4FCBFAC-19EF-44E5-A036-485CB0BE127D}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{27FB6ED0-6CFA-4800-805B-7B8B9904D797}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{134071CE-D8E7-432B-B06F-8CE33EE9B8EE}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{5E4F2BEC-E7C2-4E87-956B-60CFCDE21B07}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{18ED7BA4-FEF1-4DCB-835B-C982EB7678C4}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{92B9E409-B6DC-44EB-9579-4BBFB1004E9B}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{40EDABA8-B681-4A4B-92F7-DE3539BB296A}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{DFE5295C-3BCA-4E2E-8F45-854F498AE586}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{6E7E50F5-D6DC-424E-A805-EC922C71E5DC}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{440C66E8-5E04-4239-A21E-F301781C0CDF}C:\\program files\\windows sidebar\\sidebar.exe"= UDP:C:\program files\windows sidebar\sidebar.exe:Volet Windows
"UDP Query User{5D43A5EB-3BA4-413E-98B2-4AA29B0171E9}C:\\program files\\windows sidebar\\sidebar.exe"= TCP:C:\program files\windows sidebar\sidebar.exe:Volet Windows
"{9C7CAD32-6269-467D-A087-17DC48D54170}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{E4CA437C-12AB-42A0-A9BF-ADFD68F6A5CD}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{ED0C63DB-1846-4A57-9509-F5B33DC6EED0}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{DDD4114F-3540-4631-B49C-5FF2CDE0242B}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{75D799C1-57CF-497D-AF46-4E94C49EAE8D}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{0F305B92-0BF1-4664-9A99-7731C1F7BEF0}C:\\program files\\windows sidebar\\sidebar.exe"= UDP:C:\program files\windows sidebar\sidebar.exe:Volet Windows
"UDP Query User{76BAEAC6-50B2-4D8F-AA3E-C159511524CD}C:\\program files\\windows sidebar\\sidebar.exe"= TCP:C:\program files\windows sidebar\sidebar.exe:Volet Windows
"TCP Query User{2A739031-2B90-4B7A-980A-F4D27C7FCEBC}C:\\program files\\warcraft iii\\war3.exe"= UDP:C:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{4C614532-9F24-4DE0-B23B-356324074D09}C:\\program files\\warcraft iii\\war3.exe"= TCP:C:\program files\warcraft iii\war3.exe:Warcraft III
"TCP Query User{D07AE4D1-3FC8-411D-A055-C9C29223461E}C:\\program files\\warcraft iii\\war3.exe"= UDP:C:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{89E4115C-2E53-47A0-AE1E-5B471AC62F71}C:\\program files\\warcraft iii\\war3.exe"= TCP:C:\program files\warcraft iii\war3.exe:Warcraft III
"TCP Query User{17D8812F-2851-4E6A-B77F-AC63F72397B0}C:\\users\\hermann\\wow-2.0.0-frfr-installer-downloader.exe"= Disabled:UDP:C:\users\hermann\wow-2.0.0-frfr-installer-downloader.exe:wow-2.0.0-frfr-installer-downloader.exe
"UDP Query User{CDAC9B03-9B6B-4B5E-B0E5-19790477FF29}C:\\users\\hermann\\wow-2.0.0-frfr-installer-downloader.exe"= Disabled:TCP:C:\users\hermann\wow-2.0.0-frfr-installer-downloader.exe:wow-2.0.0-frfr-installer-downloader.exe
"TCP Query User{527506DE-F120-4D61-9430-BA3478A7AB7C}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{6ACFDFC2-C8A0-434C-9A97-B98A079CD5C9}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{D814659E-A13F-4358-9DCD-B9282F271A57}C:\\users\\hermann\\desktop\\utorrent.exe"= UDP:C:\users\hermann\desktop\utorrent.exe:utorrent.exe
"UDP Query User{9A5FDE96-3822-43D1-AB6E-1BE755E31915}C:\\users\\hermann\\desktop\\utorrent.exe"= TCP:C:\users\hermann\desktop\utorrent.exe:utorrent.exe
"TCP Query User{5B4D5CF4-328A-42A7-9627-78A60F3D5942}C:\\users\\hermann\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\hermann\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{931E2520-DB3F-4E66-91D0-CF9DA3291817}C:\\users\\hermann\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\hermann\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{B4B54935-FC39-40E4-BF51-DC06B13BA4A3}C:\\users\\hermann\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\hermann\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{F3644E2F-4588-455E-A77C-781C0713D947}C:\\users\\hermann\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\hermann\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{22487B17-FB20-4A26-8435-03B100C7D2E4}C:\\program files\\world of warcraft\\wow-1.12.0-frfr-downloader.exe"= UDP:C:\program files\world of warcraft\wow-1.12.0-frfr-downloader.exe:Blizzard Downloader
"UDP Query User{2A9ACB70-1338-41EC-B567-99C79B05501E}C:\\program files\\world of warcraft\\wow-1.12.0-frfr-downloader.exe"= TCP:C:\program files\world of warcraft\wow-1.12.0-frfr-downloader.exe:Blizzard Downloader
"TCP Query User{010E3F87-C804-4965-B78D-2DAD78578C1C}C:\\users\\hermann\\desktop\\torrent\\worms 4 mayhem\\crack\\rld-w4m\\worms 4 mayhem.exe"= UDP:C:\users\hermann\desktop\torrent\worms 4 mayhem\crack\rld-w4m\worms 4 mayhem.exe:worms 4 mayhem.exe
"UDP Query User{6CC0445A-2B28-4B83-9CEE-8AFBC47E5EF3}C:\\users\\hermann\\desktop\\torrent\\worms 4 mayhem\\crack\\rld-w4m\\worms 4 mayhem.exe"= TCP:C:\users\hermann\desktop\torrent\worms 4 mayhem\crack\rld-w4m\worms 4 mayhem.exe:worms 4 mayhem.exe
"{63E03C36-5125-4B73-BC7F-BFB2B4D9174C}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{2EF1110C-930A-426A-A000-95C2D32AE97A}C:\\program files\\itunes\\itunes.exe"= UDP:C:\program files\itunes\itunes.exe:iTunes
"UDP Query User{F0349E7A-7E77-437B-A759-0564A1BAB2D8}C:\\program files\\itunes\\itunes.exe"= TCP:C:\program files\itunes\itunes.exe:iTunes
"TCP Query User{A926B1B6-136F-4CD8-BD8F-E31FE8F54B5B}C:\\program files\\lucasarts\\star wars galactic battlegrounds\\game\\battlegrounds.exe"= UDP:C:\program files\lucasarts\star wars galactic battlegrounds\game\battlegrounds.exe:Star Wars Galactic Battlegrounds
"UDP Query User{02069FCE-2429-4F2C-AFFB-0FA9EF04D93C}C:\\program files\\lucasarts\\star wars galactic battlegrounds\\game\\battlegrounds.exe"= TCP:C:\program files\lucasarts\star wars galactic battlegrounds\game\battlegrounds.exe:Star Wars Galactic Battlegrounds
"TCP Query User{1D57DB06-6391-413D-9A58-694D57724CFA}C:\\program files\\screamer radio\\screamer.exe"= Disabled:UDP:C:\program files\screamer radio\screamer.exe:Screamer Radio
"UDP Query User{B0AEDEE1-2D70-48D7-8AEB-5F144B858416}C:\\program files\\screamer radio\\screamer.exe"= Disabled:TCP:C:\program files\screamer radio\screamer.exe:Screamer Radio
"TCP Query User{99609E9D-9528-4B68-9A96-51E681C4C6A2}C:\\program files\\bitdownload\\bitdownload.exe"= Disabled:UDP:C:\program files\bitdownload\bitdownload.exe:BitDownload
"UDP Query User{E4AB56DC-8DBC-425A-A30F-6D3155E38485}C:\\program files\\bitdownload\\bitdownload.exe"= Disabled:TCP:C:\program files\bitdownload\bitdownload.exe:BitDownload
"{14B055FD-884E-47A5-B816-C5B2F2BDF3AB}"= UDP:C:\Program Files\DNA\btdna.exe:DNA
"{4FE11EE2-8D2F-43D7-A36B-B873C5D4D5AA}"= TCP:C:\Program Files\DNA\btdna.exe:DNA
"{5BDEE30D-CC7B-4A2E-98C0-BA516D2CBABD}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{82C99DEE-961E-451B-9E6A-C4A0B3342BE6}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{7DC40026-8CC7-4B8B-9DF3-E380E81B910A}"= UDP:C:\Program Files\DNA\btdna.exe:DNA
"{9943FDB6-9CCB-4E3E-99AD-22406FC88ECE}"= TCP:C:\Program Files\DNA\btdna.exe:DNA
"TCP Query User{F2985FBF-BE76-4F05-81A0-4A97AB8D1A30}C:\\program files\\lucasarts\\star wars galactic battlegrounds\\game\\battlegrounds.exe"= UDP:C:\program files\lucasarts\star wars galactic battlegrounds\game\battlegrounds.exe:Star Wars Galactic Battlegrounds
"UDP Query User{F9216115-F508-4B42-BBC9-B5EEB1C119F6}C:\\program files\\lucasarts\\star wars galactic battlegrounds\\game\\battlegrounds.exe"= TCP:C:\program files\lucasarts\star wars galactic battlegrounds\game\battlegrounds.exe:Star Wars Galactic Battlegrounds
"TCP Query User{C9E5D068-923D-4B1D-B49E-0C12C7C6AB03}C:\\program files\\microsoft games\\gears of war\\binaries\\wargame-g4wlive.exe"= UDP:C:\program files\microsoft games\gears of war\binaries\wargame-g4wlive.exe:Gears Of War
"UDP Query User{47700537-7464-4B82-B688-4D836AC349C4}C:\\program files\\microsoft games\\gears of war\\binaries\\wargame-g4wlive.exe"= TCP:C:\program files\microsoft games\gears of war\binaries\wargame-g4wlive.exe:Gears Of War
"TCP Query User{081F080F-B2FA-4A13-8693-A3599D2F4595}C:\\program files\\thq\\dawn of war - soulstorm\\soulstorm.exe"= UDP:C:\program files\thq\dawn of war - soulstorm\soulstorm.exe:Soulstorm
"UDP Query User{C3197882-CB97-40D0-B895-75B52D34A4E8}C:\\program files\\thq\\dawn of war - soulstorm\\soulstorm.exe"= TCP:C:\program files\thq\dawn of war - soulstorm\soulstorm.exe:Soulstorm
"TCP Query User{DDD48EB2-3BF0-4C4C-A2CB-C89F9D8C36F4}C:\\program files\\thq\\dawn of war - soulstorm\\soulstorm.exe"= UDP:C:\program files\thq\dawn of war - soulstorm\soulstorm.exe:Soulstorm
"UDP Query User{8E812F97-A62F-427E-86E2-CB46AF3C9702}C:\\program files\\thq\\dawn of war - soulstorm\\soulstorm.exe"= TCP:C:\program files\thq\dawn of war - soulstorm\soulstorm.exe:Soulstorm
"TCP Query User{8D628331-0FFB-409E-A303-07CD92D357A5}C:\\program files\\adsltv\\adsltv.exe"= UDP:C:\program files\adsltv\adsltv.exe:adsltv
"UDP Query User{160BCA54-253E-4713-B55B-DAF23ED3B238}C:\\program files\\adsltv\\adsltv.exe"= TCP:C:\program files\adsltv\adsltv.exe:adsltv
"{CCD9DA43-6450-4B9D-AA24-81EBD930CC52}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{B317CE63-06EA-4212-8EB2-F3F663B70BC7}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{45D66C21-FBDF-473A-A629-1F7E591A3E63}"= UDP:J:\Alouette\Binaries\WarGame-G4WLive.exe:Gears of War
"{FAE34F9A-7938-49A3-BB12-F1087A508003}"= TCP:J:\Alouette\Binaries\WarGame-G4WLive.exe:Gears of War
"TCP Query User{D9F9C20D-8E42-4C25-BA21-826D2421D7B6}C:\\program files\\zattoo\\zattood.exe"= UDP:C:\program files\zattoo\zattood.exe:zattood
"UDP Query User{8E5A6FCA-C97D-4E72-8919-DFED85918ABF}C:\\program files\\zattoo\\zattood.exe"= TCP:C:\program files\zattoo\zattood.exe:zattood
"TCP Query User{41877FE1-EEB3-40E7-A4B7-3D0D738A2BFA}C:\\program files\\zattoo\\zattoo.exe"= UDP:C:\program files\zattoo\zattoo.exe:
"UDP Query User{799E3F87-6D62-4A59-A540-97CDA2B6E363}C:\\program files\\zattoo\\zattoo.exe"= TCP:C:\program files\zattoo\zattoo.exe:
"TCP Query User{C9010370-1920-4309-AF7D-F8B5D654C474}C:\\program files\\real\\realplayer\\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{C7477633-37AB-447C-BF3E-D562D116FB58}C:\\program files\\real\\realplayer\\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"{DCDCA4A3-46BC-4E3C-A08F-972CB0692D03}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{127CC36E-5D03-493C-AB6E-89E58C69BD73}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{AF400E84-1534-4D94-901D-86658B77F1A9}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
"UDP Query User{868FECE8-87D3-4A29-836F-C8E1E3D942BF}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
"{192ED26F-70C0-481A-BC9F-EEEBB3E11B2E}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{6B73F4BA-0E20-461C-8374-78C37C1B0E5A}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys [2008-05-25 08:43]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys [2008-05-25 08:43]
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\Windows\system32\drivers\sp_rsdrv2.sys [2008-05-25 08:42]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-08-14 00:07]
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\Windows\system32\DRIVERS\WlanBZXP.sys [2006-03-21 17:28]
S4 Boonty Games;Boonty Games;C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\shell\AutoRun\command - J:\Autorun.exe
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-07-18 19:09:11 C:\Windows\Tasks\User_Feed_Synchronization-{7AEDADEC-69AE-44A0-8785-6A3A89907BEA}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-19 11:03:22
Windows 6.0.6001 Service Pack 1 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-07-19 11:05:40
ComboFix-quarantined-files.txt 2008-07-19 09:05:29
ComboFix2.txt 2008-07-18 18:20:58
ComboFix3.txt 2008-07-18 12:12:22

Pre-Run: 142,884,634,624 octets libres
Post-Run: 142,848,634,880 octets libres

301 --- E O F --- 2008-07-17 17:37:25

désactive ta restauration puis redemarre ton ordi puis réactive la

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fdocid/20020830101856924

___________________

vire combofix de ton ordi

___________________

encore des soucis????

colle le rapport d'un scan en ligne
avec un des suivants:
(désactiver avast le temps du scan)

bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

je n arrive pas a désactiver la restauration système j ai vista si sa peut aider

regarde ici

https://forums.cnetfrance.fr