Aidez moi svp c urgent

voila le rapport et encore merci j'attend la suite

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:34:05, on 24/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\Documents and Settings\Propriétaire\lsass.exe
C:\WINDOWS\system32\tcntptdm.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\mjc\mjc.exe
C:\Program Files\Sakora\Sakora.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\GetPack\GetPack20.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\mrofinu.exe
C:\Program Files\Orange\browser\browser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.skyrock.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O4 - HKLM\..\Run: [LSA Shellu] C:\Documents and Settings\Propriétaire\lsass.exe
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\tcntptdm.exe DWram02
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1188.exe 61A847B5BBF72813339330466188719AB689201522886B092CBD44BD8689220221DD325762E902BC9ED7286138F75F2F0C8D6E84A1EF7F506DCD610837F810EBCA9D775A67
O4 - HKLM\..\Run: [946876f6] rundll32.exe "C:\WINDOWS\system32\ngemqtow.dll",b
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [BM975b456a] Rundll32.exe "C:\WINDOWS\system32\cwqrdwqe.dll",s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKCU\..\Run: [BSserver] FileKan.exe
O4 - HKCU\..\Run: [mjc] C:\Program Files\mjc\mjc.exe
O4 - HKCU\..\Run: [Sakora] C:\Program Files\Sakora\Sakora.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [GetPack20] "C:\Program Files\GetPack\GetPack20.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\tcntptdm.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\rwwnw64d.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe

c'est le rapport! jfais quOi après??^^


Malwarebytes' Anti-Malware 1.23
Version de la base de données: 990
Windows 5.1.2600 Service Pack 3

21:17:18 24/07/2008
mbam-log-7-24-2008 (21-17-18).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 92200
Temps écoulé: 1 hour(s), 22 minute(s), 23 second(s)

Processus mémoire infecté(s): 5
Module(s) mémoire infecté(s): 5
Clé(s) du Registre infectée(s): 32
Valeur(s) du Registre infectée(s): 9
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 9
Fichier(s) infecté(s): 74

Processus mémoire infecté(s):
C:\Program Files\mjc\mjc.exe (Adware.MJC) -> Unloaded process successfully.
C:\Program Files\Sakora\Sakora.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Program Files\GetPack\GetPack20.exe (Trojan.Agent) -> Unloaded process successfully.
C:\WINDOWS\system32\tcntptdm.exe (Adware.Agent) -> Unloaded process successfully.
C:\Documents and Settings\Propriétaire\lsass.exe (Trojan.Agent) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\mlJBTJDS.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ngemqtow.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\mcwqjf.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\QdrDrive\QdrDrive20.dll (Trojan.Downloader) -> Delete on reboot.
C:\WINDOWS\system32\rqRLdDTk.dll (Trojan.Vundo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5f22043f-f469-4a14-9e30-5274202865e4} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5f22043f-f469-4a14-9e30-5274202865e4} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c79bcde4-7a49-452d-b978-d15ac32cfbca} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{c79bcde4-7a49-452d-b978-d15ac32cfbca} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\TypeLib\{f7fced71-ac73-4131-8836-a13c0fb0385b} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{180175c0-913e-451c-9419-2d5500368d43} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{180175c0-913e-451c-9419-2d5500368d43} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8eeb2711-9d21-4f9c-99a1-b7fc5a8ca56a} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8eeb2711-9d21-4f9c-99a1-b7fc5a8ca56a} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{db036a52-3a88-466b-bd39-05a6d9d9b18a} (Trojan.BHO) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{db036a52-3a88-466b-bd39-05a6d9d9b18a} (Trojan.BHO) -> Delete on reboot.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a394e835-c8d6-4b4b-884b-d2709059f3be} (Trojan.Network.Monitor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\GetPack (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XPShield (Rogue.XPShield) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\testCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\QdrDrive (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rqrlddtk (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Network Monitor (Trojan.Service) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\946876f6 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mjc (Adware.MJC) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sakora (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\getpack20 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runner1 (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\exploreupdsched (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm975b456a (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{db036a52-3a88-466b-bd39-05a6d9d9b18a} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsa shellu (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\mljbtjds -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\mljbtjds -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\Temporary (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\QdrDrive (Adware.AdBand) -> Quarantined and deleted successfully.
C:\Program Files\Webtools (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kBin02 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Sakora (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GetPack (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\iCheck (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\mjc (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\NetMon (Trojan.NetMon) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\mcwqjf.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\mlJBTJDS.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\SDJTBJlm.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\SDJTBJlm.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ngemqtow.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wotqmegn.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\romodwky.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ykwdomor.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\mjc\mjc.exe (Adware.MJC) -> Quarantined and deleted successfully.
C:\Program Files\Sakora\Sakora.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GetPack\GetPack20.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\QdrDrive\QdrDrive20.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rqRLdDTk.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\mrofinu1188.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\Webtools\webtools.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\4JVNMH4Q\17PHolmes[1].cmt (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\4XYOB8VG\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\4XYOB8VG\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\QEY9U9LR\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\QEY9U9LR\17PHolmes[1].cmt (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\iCheck\iCheck.exe (Adware.ISM) -> Quarantined and deleted successfully.
C:\Program Files\iCheck\Uninstall.exe (Malware.Trace) -> Quarantined and deleted successfully.
C:\Program Files\QdrDrive\qdrloader.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP44\A0045196.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP47\A0045603.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP47\A0046590.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP48\A0050727.exe (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP48\A0050754.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP49\A0051818.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP49\A0055937.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP49\A0055939.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP49\A0055953.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP50\A0064147.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP50\A0064149.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP53\A0066135.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP53\A0068147.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP53\A0068184.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\b148.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\b152.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\b155.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\b156.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\mrofinu1000106.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ddcDssQH.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tfshdvav.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssqPfdDS.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqQkjkk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jkkHXNdd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ytlnpavk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vtUlIbbY.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\geBuRHAp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vdf1\setpack22.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wnet\SFRuID2.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kBin02\kBin022328.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\GetPack\trgtame.gz (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt (Trojan.NetMon) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt (Trojan.NetMon) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tcntptdm.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winpfz33.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\amvo0.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cwqrdwqe.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\zxdnt3d.cfg. (Adware.ZenoSearch) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pac.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zxdnt3d.cfg (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssqQjGwV.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nnnliGxx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxyVPFxu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM975b456a.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM975b456a.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fccAssTj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\khfeDsTJ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SysNotifier.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\uninstall_nmon.vbs (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.

cOmment jfaiis pOur le supriimer stp??

ya tOujours la même erreur! :'(

le rapport est le suivant

ComboFix 08-07-24.6 - Propriétaire 2008-07-24 22:02:09.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.209 [GMT 2:00]
Endroit: C:\Documents and Settings\Propriétaire\Bureau\djamie.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\bestwiner.stt
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\CPV.stt
C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\Deewoo.lnk
C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\DW_Start.lnk
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\cevlvmxg.ini
C:\WINDOWS\system32\dcqnohul.ini
C:\WINDOWS\system32\iydsbu.dll
C:\WINDOWS\system32\jodsfbfe.dll
C:\WINDOWS\system32\kgprwgvs.dll
C:\WINDOWS\system32\kiaygkou.dll
C:\WINDOWS\system32\loutwf.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\nrucovlr.dll
C:\WINDOWS\system32\ozjysp.dll
C:\WINDOWS\system32\qysdollt.dll
C:\WINDOWS\system32\sbigpqrf.dll
C:\WINDOWS\system32\srynmujs.dll
C:\WINDOWS\system32\vxqsmifo.ini
C:\WINDOWS\system32\wlfyufsh.dll
C:\WINDOWS\system32\xrmirw.dll
C:\WINDOWS\ufdata2000.log

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-24 to 2008-07-24 ))))))))))))))))))))))))))))))))))))
.

2008-07-24 21:20 . 2008-07-24 21:51 200,704 --a------ C:\WINDOWS\SysNotifier.exe
2008-07-24 19:41 . 2008-07-24 19:42 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-24 19:41 . 2008-07-24 19:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-24 19:41 . 2008-07-23 20:09 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-24 19:41 . 2008-07-23 20:09 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-24 19:30 . 2008-07-24 21:51 <REP> d-------- C:\Program Files\Trend Micro
2008-07-24 19:11 . 2008-07-24 19:11 <REP> d-------- C:\WINDOWS\Sun
2008-07-24 19:09 . 2008-07-24 19:09 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2008-07-24 19:09 . 2008-07-24 19:09 286,720 --a------ C:\WINDOWS\PATCH.EXE
2008-07-24 19:09 . 2008-07-24 19:09 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2008-07-24 19:09 . 2008-07-24 19:09 40 --a------ C:\WINDOWS\TSC.INI
2008-07-24 11:05 . 2008-07-24 19:02 <REP> d-------- C:\Program Files\a-squared Free
2008-07-24 09:38 . 2008-07-24 09:38 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-07-24 09:05 . 2007-09-25 19:31 65,536 --a------ C:\WINDOWS\system32\Autodial2000.dll
2008-07-24 09:04 . 2008-07-24 09:04 <REP> d-------- C:\Program Files\Fichiers communs\France Telecom
2008-07-24 09:01 . 2008-07-24 09:01 <REP> d-------- C:\Program Files\SAGEM
2008-07-24 09:01 . 2008-07-24 09:01 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2008-07-24 09:01 . 2007-04-04 08:08 184,320 --a------ C:\WINDOWS\system32\coclassfast.dll
2008-07-24 09:00 . 2008-07-24 09:00 <REP> d-------- C:\Program Files\Securitoo
2008-07-23 15:00 . 2008-07-23 15:00 <REP> d-------- C:\Program Files\QuickTime
2008-07-23 13:17 . 2008-07-23 13:17 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-07-22 08:16 . 2008-07-22 08:17 <REP> d-------- C:\Temp\epr1
2008-07-21 19:46 . 2008-07-21 19:46 268 --ah----- C:\sqmdata00.sqm
2008-07-21 19:46 . 2008-07-21 19:46 244 --ah----- C:\sqmnoopt00.sqm
2008-07-21 08:29 . 2008-07-21 08:29 303,104 --a------ C:\WINDOWS\system32\dxpvboec.exe
2008-07-21 08:29 . 2008-07-22 08:30 43,941 ---hs---- C:\WINDOWS\system32\ybywikwy.ini
2008-07-20 17:21 . 2008-07-20 17:26 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2008-07-20 07:12 . 2008-07-24 18:20 <REP> d-------- C:\Program Files\PC Tools AntiVirus
2008-07-20 07:12 . 2008-07-20 07:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-07-20 07:12 . 2007-12-06 15:51 28,568 --a------ C:\WINDOWS\system32\drivers\AVHook.sys
2008-07-20 07:12 . 2007-12-06 15:51 21,912 --a------ C:\WINDOWS\system32\drivers\AVRec.sys
2008-07-20 07:12 . 2008-02-12 10:44 21,904 --a------ C:\WINDOWS\system32\drivers\AVFilter.sys
2008-07-20 07:09 . 2008-07-20 07:09 152,191 --a------ C:\WINDOWS\system32\g22.exe
2008-07-20 07:08 . 2008-07-24 21:17 <REP> d-------- C:\WINDOWS\system32\wnet
2008-07-20 07:08 . 2008-07-24 21:17 <REP> d-------- C:\WINDOWS\system32\vdf1
2008-07-20 07:08 . 2008-07-20 07:08 <REP> d-------- C:\WINDOWS\system32\confg
2008-07-19 14:37 . 2008-07-19 14:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-07-19 10:45 . 2008-07-19 10:45 <REP> d-------- C:\WINDOWS\system32\carH18
2008-07-19 10:45 . 2008-07-20 07:08 <REP> d-------- C:\Temp\btxv15
2008-07-19 10:45 . 2008-07-24 22:02 <REP> d-------- C:\Temp
2008-07-19 09:55 . 2008-07-19 09:55 164 --a------ C:\install.dat
2008-07-15 12:23 . 2008-07-15 12:23 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-07-15 12:23 . 2008-04-13 19:33 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-07-15 12:22 . 2008-07-15 12:22 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-07-15 12:22 . 2008-07-15 12:22 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-07-13 19:04 . 2008-07-13 19:04 <REP> d-------- C:\Program Files\Java
2008-07-13 19:04 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-07-13 19:00 . 2008-07-13 19:00 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-07-13 18:55 . 2008-07-13 18:57 <REP> d-------- C:\Program Files\LimeWire
2008-07-13 08:20 . 2008-07-13 08:20 <REP> d-------- C:\Program Files\VideoLAN
2008-07-08 23:26 . 2008-07-08 23:26 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-07-08 22:39 . 2008-07-08 22:39 <REP> d-------- C:\WINDOWS\Cache
2008-07-08 14:23 . 2008-07-08 14:23 <REP> d-------- C:\Program Files\MSBuild
2008-07-08 14:23 . 2008-07-08 14:23 <REP> d-------- C:\Program Files\Microsoft Works
2008-07-08 14:17 . 2008-07-08 14:22 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-07-08 14:16 . 2008-07-08 14:16 <REP> dr-h----- C:\MSOCache
2008-07-08 14:16 . 2008-07-17 14:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-08 07:18 . 2008-04-23 06:16 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-07-08 07:18 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-07-08 07:18 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-07-08 07:18 . 2008-04-23 06:16 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-07-08 07:18 . 2008-04-23 06:16 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-07-08 07:18 . 2008-04-23 06:16 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-07-08 07:18 . 2008-04-23 06:16 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-07-08 07:18 . 2008-04-23 06:16 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-07-08 07:18 . 2008-04-22 09:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-07-08 07:09 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-07-08 07:09 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-07-08 07:09 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-07-07 21:54 . 2003-11-04 15:11 159,744 --a------ C:\WINDOWS\system32\lfpng13n.dll
2008-07-07 16:48 . 2008-07-07 16:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-07-07 15:52 . 2008-07-07 15:55 <REP> d-------- C:\Program Files\PhotoFiltre Studio
2008-07-07 15:52 . 2008-07-07 15:52 45 ---h----- C:\WINDOWS\dsez0805.dat
2008-07-07 15:24 . 2008-07-07 15:24 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-07-07 14:39 . 2008-07-07 14:39 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-07-07 13:17 . 2008-07-07 14:43 <REP> d-------- C:\Program Files\Windows Live
2008-07-07 13:17 . 2008-07-07 14:39 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-07-07 13:17 . 2008-07-07 14:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-07 08:59 . 2008-06-14 19:33 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-07 08:59 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-07-06 19:27 . 2008-07-06 19:27 <REP> d-------- C:\Program Files\Fichiers communs\PC Tools
2008-07-06 19:27 . 2008-07-24 18:21 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-06 19:17 . 2008-07-06 19:17 <REP> d-------- C:\Documents and Settings\LocalService\Menu D‚marrer
2008-07-06 19:17 . 2008-07-15 12:22 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-07-06 18:13 . 2008-07-06 18:16 <REP> d-------- C:\WINDOWS\ServicePackFiles
2008-07-06 18:07 . 2006-12-28 12:01 19,569 --a------ C:\WINDOWS\[u]0[/u]02549_.tmp
2008-07-06 17:58 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2008-07-06 17:58 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2008-07-06 17:58 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2008-07-06 17:58 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2008-07-06 17:58 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2008-07-06 17:58 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2008-07-06 17:58 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2008-07-06 17:58 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2008-07-06 16:09 . 2008-07-23 13:21 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-07-06 16:09 . 2008-07-06 18:16 <REP> d-------- C:\WINDOWS\system32\fr
2008-07-06 16:09 . 2008-07-06 16:09 <REP> d-------- C:\WINDOWS\provisioning
2008-07-06 16:09 . 2008-07-06 18:16 <REP> d-------- C:\WINDOWS\peernet
2008-07-06 16:09 . 2008-07-06 18:16 <REP> d-------- C:\WINDOWS\l2schemas
2008-07-06 16:03 . 2006-12-28 12:01 19,569 --a------ C:\WINDOWS\[u]0[/u]02548_.tmp
2008-07-06 16:01 . 2008-04-13 19:31 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-07-06 16:00 . 2008-07-06 18:03 <REP> d-------- C:\WINDOWS\EHome
2008-07-06 15:06 . 2008-07-06 15:07 <REP> d-------- C:\f4d666697dbae3adceb0853efd
2008-07-01 21:48 . 2008-07-01 21:48 <REP> d-------- C:\Program Files\PCI Audio Applications
2008-07-01 21:47 . 2008-07-01 21:47 <REP> d-------- C:\Program Files\C-Media
2008-07-01 21:47 . 2002-10-15 12:00 1,818,624 --a------ C:\WINDOWS\mixer.exe
2008-07-01 21:15 . 2008-07-01 21:15 13,754 --a------ C:\WINDOWS\system32\wpa.bak
2008-07-01 21:07 . 2008-07-06 18:16 <REP> d-------- C:\WINDOWS\system32\bits
2008-07-01 21:06 . 2008-07-08 07:51 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-07-01 21:06 . 2007-08-10 08:18 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-24 07:08 --------- d-----w C:\Program Files\Orange
2008-07-01 19:48 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll
2008-07-01 19:48 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll
2008-07-01 17:10 558,142 ----a-w C:\WINDOWS\java\Packages\eiqbhnp7.zip
2008-07-01 17:10 155,995 ----a-w C:\WINDOWS\java\Packages\vjd7p3vh.zip
2008-07-01 17:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-01 17:09 --------- d-----w C:\Program Files\Services en ligne
2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:33 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-09 10:55 90,112 ----a-w C:\WINDOWS\system32\wshext.dll
2008-05-09 10:55 430,080 ----a-w C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:55 180,224 ----a-w C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:55 172,032 ----a-w C:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscript.exe
2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscript.exe
2008-05-07 05:11 1,294,336 ----a-w C:\WINDOWS\system32\quartz.dll
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC628875-53FE-4DE3-9CA8-E61652820398}]
2008-07-21 08:29 299008 --a------ C:\Program Files\Internet Explorer\SIGNUP\udpacc.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:34 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystrayORAHSS"="C:\Program Files\Orange\Systray\SystrayApp.exe" [2007-09-25 20:08 94208]
"ORAHSSSessionManager"="C:\Program Files\Orange\SessionManager\SessionManager.exe" [2007-09-25 19:10 102400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-13 19:34 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\udpacc]
2008-07-21 08:29 299008 C:\Program Files\Internet Explorer\SIGNUP\udpacc.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{78f173f8-5365-11dd-a3e7-e53088f9bf2c}]
\Shell\Auto\command - F:\Start.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9566b033-50fb-11dd-a3c8-26cfe51af07b}]
\Shell\AutoRun\command - F:\h.cmd
\Shell\explore\Command - F:\h.cmd
\Shell\open\Command - F:\h.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a482db8-564d-11dd-a40d-7a4dc2a823fa}]
\Shell\Auto\command - F:\Start.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c929ffba-5401-11dd-a3ed-80bfdacd833d}]
\Shell\Auto\command - Start.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d41dc90a-4bf1-11dd-a3a3-9b5dbdde0821}]
\Shell\AutoRun\command - F:\h.cmd
\Shell\explore\Command - F:\h.cmd
\Shell\open\Command - F:\h.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f2ea1f88-4cd6-11dd-a3ad-028acc589ab6}]
\Shell\AutoRun\command - F:\h.cmd
\Shell\explore\Command - F:\h.cmd
\Shell\open\Command - F:\h.cmd
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.skyblog.com/
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-24 22:08:57
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\Internet Explorer\SIGNUP\udpacc.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\Internet Explorer\SIGNUP\udpacc.dll
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\[u]0[/u]\FTRTSVC.exe
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\[u]0[/u]\AlertModule.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-24 22:15:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-24 20:15:09

Pre-Run: 60,080,091,136 octets libres
Post-Run: 60,458,070,016 octets libres

260 --- E O F --- 2008-07-17 12:45:05

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:29:24, on 24/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Orange\browser\browser.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\PC Tools AntiVirus\PCTAV.exe
C:\WINDOWS\SysNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.skyrock.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe

AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 09:50:29 25/07/2008

+ Résultat de l'analyse:



C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP48\A0050729.dll -> Not-A-Virus.Adware.BB : Aucune action entreprise.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@advertising[1].txt -> TrackingCookie.Advertising : Aucune action entreprise.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@atdmt[1].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@bluestreak[2].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
C:\Documents and Settings\Propriétaire\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.69722 -> Trojan.OnLineGames.qip : Aucune action entreprise.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP48\A0050737.vbs -> Trojan.Small : Aucune action entreprise.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP53\A0068243.vbs -> Trojan.Small : Aucune action entreprise.


Fin du rapport

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 09:58:04 25/07/2008

+ Résultat de l'analyse:



C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP48\A0050729.dll -> Not-A-Virus.Adware.BB : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@atdmt[1].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Propriétaire\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.69722 -> Trojan.OnLineGames.qip : Nettoyé.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP48\A0050737.vbs -> Trojan.Small : Nettoyé.
C:\System Volume Information\_restore{B2D7CFC8-4E68-41BD-9111-3109342BE9B8}\RP53\A0068243.vbs -> Trojan.Small : Nettoyé.


Fin du rapport

okey mercii pOur toUs!!