Virus insuprimable ?

Salut,

- Télécharge HijackThis V 2.02 (HijackThis Installer) :
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

- Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

- Clique sur Install ensuite sur I Accept

- Clique sur Do a scan system and save log file

- Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.

ok je vais faire sa tout de suite, je te dis sa merci.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:13:19, on 19/08/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Steam\steam.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://gamespace.daemon-tools.cc/fra/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: run="C:\Users\Florent\AppData\Roaming\Adobe\Manager.exe"
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} - C:\Windows\system32\pmnkKcaX.dll (file missing)
O2 - BHO: XMLDP Class - {72A128E0-2240-40c8-9E92-5387D64F839E} - C:\Windows\xml2u32h.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: vwsrfton - {ABA69CF4-20FB-42CE-BB6D-B6171D64B8EC} - C:\Windows\vwsrfton.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HWSetup] \HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Desktop SMS] C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe /auto
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [\Win7613.exe] C:\Windows\system32\Win7613.exe
O4 - HKLM\..\Run: [\Win76DE.exe] C:\Windows\system32\Win76DE.exe
O4 - HKLM\..\Run: [\Win77A8.exe] C:\Windows\system32\Win77A8.exe
O4 - HKLM\..\Run: [\Win7A18.exe] C:\Windows\system32\Win7A18.exe
O4 - HKLM\..\Run: [\Win7E6C.exe] C:\Windows\system32\Win7E6C.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\pmnkKcaX.dll,#1
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [\Win7613.exe] C:\Windows\system32\Win7613.exe
O4 - HKCU\..\Run: [\Win76DE.exe] C:\Windows\system32\Win76DE.exe
O4 - HKCU\..\Run: [\Win77A8.exe] C:\Windows\system32\Win77A8.exe
O4 - HKCU\..\Run: [\Win7A18.exe] C:\Windows\system32\Win7A18.exe
O4 - HKCU\..\Run: [\Win7E6C.exe] C:\Windows\system32\Win7E6C.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Florent\AppData\Local\Temp\urqQgfDw.dll,c
O4 - HKCU\..\Run: [e65c87a1] rundll32.exe "C:\Users\Florent\AppData\Local\Temp\ufqtrmfe.dll",b
O4 - HKCU\..\Run: [BMe56fb43d] Rundll32.exe "C:\Users\Florent\AppData\Local\Temp\hjvysvxt.dll",s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR (file missing)
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - D:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Mon dieu...

---> Désactive l'UAC le temps de la désinfection :
https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

je le fais.

cela risque de me prendre un bout dtemps, je te dit sa dans 30 min ok ?

Oui.

voila c'est fait, je t'envois le rapport:
ComboFix 08-08-18.04 - Florent 2008-08-19 11:37:07.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1233 [GMT 2:00]
Endroit: C:\Users\Florent\Downloads\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\PCHealthCenter
C:\Program Files\PCHealthCenter\[u]0/u.exe
C:\Program Files\PCHealthCenter\[u]0/u.gif
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\1.gif
C:\Program Files\PCHealthCenter\2.exe
C:\Program Files\PCHealthCenter\2.gif
C:\Program Files\PCHealthCenter\3.exe
C:\Program Files\PCHealthCenter\3.gif
C:\Program Files\PCHealthCenter\4.exe
C:\Program Files\PCHealthCenter\5.exe
C:\Program Files\PCHealthCenter\7.exe
C:\Program Files\PCHealthCenter\sc.html
C:\Program Files\PCHealthCenter\sex1.ico
C:\Program Files\PCHealthCenter\sex2.ico
C:\Program Files\VAV
C:\Program Files\VAV\vav0.dat
C:\Program Files\VAV\vav1.dat
C:\Users\Florent\AppData\Local\Temp\hjvysvxt.dll
C:\Users\Florent\AppData\Roaming\Adobe\crc.dat
C:\Users\Florent\AppData\Roaming\Adobe\Manager.exe
C:\Windows\ateqoflr.exe
C:\Windows\edpw.exe
C:\Windows\system32\sex1.ico
C:\Windows\system32\sex2.ico
C:\Windows\vwsrfton.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-19 to 2008-08-19 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier cr‚‚ dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-19 09:40 --------- d-----w C:\Program Files\Steam
2008-08-19 09:25 27,525 ----a-w C:\Users\Florent\AppData\Roaming\nvModes.dat
2008-08-19 09:19 --------- d-----w C:\Users\Florent\AppData\Roaming\uTorrent
2008-08-19 09:13 --------- d-----w C:\Program Files\Trend Micro
2008-08-19 09:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-17 13:13 --------- d-----w C:\Program Files\ESET
2008-08-17 01:02 --------- d-----w C:\Program Files\Windows Live
2008-08-16 17:26 --------- d-----w C:\Program Files\DAEMON Tools Toolbar
2008-08-16 17:26 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-08-15 10:01 --------- d-----w C:\Program Files\Thief - Deadly Shadows
2008-08-15 09:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-14 20:38 --------- d-----w C:\ProgramData\eMule
2008-08-14 20:38 --------- d-----w C:\Program Files\eMule
2008-08-14 20:17 717,296 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-08-14 20:16 --------- d-----w C:\Users\Florent\AppData\Roaming\DAEMON Tools
2008-08-14 15:05 --------- d-----w C:\ProgramData\ma-config.com
2008-08-14 10:16 1,231,041 ----a-w C:\Init.exe
2008-08-14 10:01 --------- d-----w C:\Users\Florent\AppData\Roaming\AdobeUM
2008-08-14 01:13 --------- d-----w C:\Program Files\Windows Mail
2008-08-14 01:04 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-08-14 01:02 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-08-14 01:02 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-08-14 01:02 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-08-13 14:56 --------- d-----w C:\Program Files\Common Files\Steam
2008-08-13 14:18 512,096 ----a-w C:\Windows\system32\drivers\amon.sys
2008-08-13 14:18 15,424 ----a-w C:\Windows\system32\drivers\nod32drv.sys
2008-08-13 14:11 --------- d-----w C:\ProgramData\Symantec
2008-08-13 14:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-12 18:01 --------- d-----w C:\Program Files\WallPerformer 2.0
2008-08-10 08:52 174 --sha-w C:\Program Files\desktop.ini
2008-08-10 08:44 --------- d-----w C:\Program Files\Windows Sidebar
2008-08-10 08:44 --------- d-----w C:\Program Files\Windows Calendar
2008-08-10 08:28 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys
2008-08-10 08:28 619,008 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-08-10 08:28 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys
2008-08-10 08:28 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys
2008-08-10 08:28 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys
2008-08-10 08:27 28,344 ----a-w C:\Windows\system32\drivers\battc.sys
2008-08-10 08:27 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-08-10 08:27 20,920 ----a-w C:\Windows\system32\drivers\compbatt.sys
2008-08-10 08:27 2,923,520 ----a-w C:\Windows\explorer.exe
2008-08-10 08:27 14,208 ----a-w C:\Windows\system32\drivers\CmBatt.sys
2008-08-10 08:26 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-08-10 08:23 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys
2008-08-10 08:23 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-08-10 08:21 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-08-10 08:21 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-08-10 08:21 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-08-10 08:21 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-08-10 08:20 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-08-10 08:20 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-08-10 08:20 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-08-10 08:20 17,464 ----a-w C:\Windows\system32\drivers\intelide.sys
2008-08-10 08:20 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-08-10 08:20 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-08-10 08:18 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-08-10 08:18 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-08-10 08:14 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-08-10 08:14 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-08-10 08:14 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-08-10 08:14 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-08-10 08:14 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-08-10 08:14 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-08-10 08:14 15,872 ----a-w C:\Windows\system32\drivers\mouhid.sys
2008-08-10 08:14 15,872 ----a-w C:\Windows\system32\drivers\kbdhid.sys
2008-08-10 08:13 82,432 ----a-w C:\Windows\system32\drivers\sdbus.sys
2008-08-10 08:11 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_xusb21_01005.Wdf
2008-08-10 08:09 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-08-10 08:08 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-08-10 08:08 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-08-10 08:07 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-08-10 08:07 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-08-10 08:07 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-08-10 08:07 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-08-10 08:06 148,992 ----a-w C:\Windows\system32\drivers\ks.sys
2008-08-10 08:06 12,800 ----a-w C:\Windows\system32\drivers\fs_rec.sys
2008-08-10 07:14 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-08-10 06:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-10 06:47 --------- d-----w C:\Program Files\uTorrent
2008-08-10 06:36 --------- d-----w C:\ProgramData\WLInstaller
2008-08-06 08:17 --------- d-----w C:\Users\Florent\AppData\Roaming\Toshiba
2008-07-28 01:47 --------- d-----w C:\Users\Florent\AppData\Roaming\vlc
2008-07-28 01:46 --------- d-----w C:\Program Files\VideoLAN
2008-07-26 08:00 --------- d--h--r C:\Users\Florent\AppData\Roaming\SecuROM
2008-07-26 07:39 --------- d-----w C:\Program Files\KONAMI
2008-07-26 07:07 --------- d-----w C:\Program Files\Common Files\Toshiba Shared
2008-07-26 07:06 --------- d-----w C:\Users\Florent\AppData\Roaming\InstallShield
2008-07-26 07:06 --------- d-----w C:\ProgramData\Toshiba
2008-07-26 07:06 --------- d-----w C:\Program Files\TOSHIBA
2008-07-26 07:05 --------- d-----w C:\Program Files\Intel
2008-07-26 07:03 --------- d-----w C:\ProgramData\ToshibaEurope
2008-07-26 06:21 --------- d-sh--w C:\ProgramData\Modèles
2008-07-26 06:21 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-07-26 06:21 --------- d-sh--w C:\ProgramData\Favoris
2008-07-26 06:21 --------- d-sh--w C:\ProgramData\Bureau
2008-07-26 06:21 --------- d-sh--w C:\Program Files\Fichiers communs
2008-07-26 06:17 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2008-07-26 06:17 --------- d-----w C:\Program Files\Synaptics
2008-07-26 06:16 0 --sha-r C:\Windows\system32\drivers\TOSHIBA_Satellite X200_05566-FR_PSPB9E-03M02.MRK
2008-07-26 06:12 --------- d-----w C:\Program Files\Camera Assistant Software for Toshiba
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2006-12-03 17:03 2854912 --a------ C:\Program Files\Protector Suite QL\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2006-12-03 17:03 2854912 --a------ C:\Program Files\Protector Suite QL\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-08-10 10:09 1232896]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 13:01 413696]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-08-13 16:28 1271032]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KeNotify"="C:\Program Files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-06 17:14 34352]
"SVPWUTIL"="C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-03-22 21:42 438272]
"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-04-02 12:48 577536]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-06-06 10:07 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-06-06 10:07 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-06-06 10:07 81920]
"Desktop SMS"="C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe" [2007-06-18 10:51 1507328]
"PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2006-12-03 16:29 49168]
"Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 16:40 413696]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 04:53 894512]
"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2007-02-19 16:00 571024]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 14:37 174872]
"IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-03-13 17:49 33048]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-08-13 16:18 949376]
"RtHDVCpl"="RtHDVCpl.exe" [2007-06-13 07:11 4489216 C:\Windows\RtHDVCpl.exe]
"NDSTray.exe"="NDSTray.exe" [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-12-03 16:50 90112 C:\Windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{67DC4F03-F56E-4C21-8898-82E75EF78AE3}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{1BA834E4-1FF4-4355-877F-F6241B99ECC1}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{CC133925-7CB6-4393-8128-BA593E9D2EC6}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{521F15A0-B12E-4546-832B-5FDC45D0E702}C:\\program files\\echanblard\\emule.exe"= UDP:C:\program files\echanblard\emule.exe:eChanblard
"UDP Query User{F520C50B-63AE-49C7-8061-88E87595EDBB}C:\\program files\\echanblard\\emule.exe"= TCP:C:\program files\echanblard\emule.exe:eChanblard
"TCP Query User{F7AE4743-2A9E-449F-9FDE-D1024A7480B0}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{764772EB-7646-4466-A83D-29B2F4DBCF5F}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{3164DDB9-DC4D-452D-8A56-1C76E7CBE4D4}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{AC1E8C88-1D14-4B14-BDA0-A2242B30D36C}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{9564A6A5-56E3-4C97-AE93-5AA692E26CCE}"= UDP:D:\Program Files\ma-config.com\maconfservice.exe:maconfservice
"{B922BC02-EBA1-4066-BED8-8D8A8D3912FA}"= TCP:D:\Program Files\ma-config.com\maconfservice.exe:maconfservice
"TCP Query User{5B849924-4DFB-4DB9-A3AD-DD0ED1640970}C:\\program files\\steam\\steamapps\\frereapool\\team fortress 2\\hl2.exe"= UDP:C:\program files\steam\steamapps\frereapool\team fortress 2\hl2.exe:hl2
"UDP Query User{261280A2-A589-4447-97BA-3D65A02B2BF6}C:\\program files\\steam\\steamapps\\frereapool\\team fortress 2\\hl2.exe"= TCP:C:\program files\steam\steamapps\frereapool\team fortress 2\hl2.exe:hl2

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 CplIR;Embedded IR Driver;C:\Windows\system32\DRIVERS\CplIR.SYS [2007-03-06 15:01]
R0 iaNvStor;Intel(R) Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-03-11 01:11]
S3 maconfservice;Ma-Config Service;D:\Program Files\ma-config.com\maconfservice.exe [2008-07-25 20:57]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-08-13 16:30]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5b442772-6ab8-11dd-8ce9-001b384b8109}]
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL H:\
\shell\²¥·Å\command - diskcheck.exe c:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{727c2177-6a3e-11dd-9b92-001b384b8109}]
\shell\AutoRun\command - E:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{baf45aac-6941-11dd-9a78-001b384b8109}]
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL diskcheck.exe h:
\shell\²¥·Å\command - diskcheck.exe h:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb7c16e8-5ad8-11dd-8820-806e6f6e6963}]
\shell\AutoRun\command - G:\autorun_PES2008.exe
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-\Win7613.exe - C:\Windows\system32\Win7613.exe
HKCU-Run-\Win76DE.exe - C:\Windows\system32\Win76DE.exe
HKCU-Run-\Win77A8.exe - C:\Windows\system32\Win77A8.exe
HKCU-Run-\Win7A18.exe - C:\Windows\system32\Win7A18.exe
HKCU-Run-\Win7E6C.exe - C:\Windows\system32\Win7E6C.exe
HKLM-Run-HWSetup - \HWSetup.exe
HKLM-Run-\Win7613.exe - C:\Windows\system32\Win7613.exe
HKLM-Run-\Win76DE.exe - C:\Windows\system32\Win76DE.exe
HKLM-Run-\Win77A8.exe - C:\Windows\system32\Win77A8.exe
HKLM-Run-\Win7A18.exe - C:\Windows\system32\Win7A18.exe
HKLM-Run-\Win7E6C.exe - C:\Windows\system32\Win7E6C.exe
HKLM-Run-MSServer - C:\Windows\system32\pmnkKcaX.dll

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.daemon-search.com/startpage
R0 -: HKLM-Main,Start Page = hxxp://www.ustart.org
O9 -: {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR
.
.
------- File Associations (Beta) -------
.
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
vbefile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
vbsfile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
jsefile\shell\open\command=%SystemRoot%\System32\WScript.exe "%1" %*
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 11:40:59
Windows 6.0.6000 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

C:\Users\Florent\AppData\Local\Microsoft\Windows\WER\ReportArchive\store.lock
C:\Users\Florent\AppData\Local\Microsoft\Windows\WER\ReportQueue\store.lock

Scan termin‚ avec succŠs
Les fichiers cach‚s: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"\\Win7613.exe"="C:\\Windows\\system32\\Win7613.exe"
"\\Win76DE.exe"="C:\\Windows\\system32\\Win76DE.exe"
"\\Win77A8.exe"="C:\\Windows\\system32\\Win77A8.exe"
"\\Win7A18.exe"="C:\\Windows\\system32\\Win7A18.exe"
"\\Win7E6C.exe"="C:\\Windows\\system32\\Win7E6C.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\Win7613.exe"="C:\\Windows\\system32\\Win7613.exe"
"\\Win76DE.exe"="C:\\Windows\\system32\\Win76DE.exe"
"\\Win77A8.exe"="C:\\Windows\\system32\\Win77A8.exe"
"\\Win7A18.exe"="C:\\Windows\\system32\\Win7A18.exe"
"\\Win7E6C.exe"="C:\\Windows\\system32\\Win7E6C.exe"
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\Windows\Explorer.exe
-> C:\Program Files\IDM\Desktop SMS\oehook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\System32\audiodg.exe
C:\Program Files\Protector Suite QL\upeksvr.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\System32\agrsmsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\Program Files\ESET\nod32krn.exe
C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\System32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-19 11:43:28 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-19 09:43:16

Pre-Run: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Post-Run: 9,162,452,992 octets libres

313 --- E O F --- 2008-08-17 15:24:05

- Télécharge et installe MalwareByte's Anti-Malware :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

- Mets-le à jour

- Redémarre en mode sans échec (Recommandé) :
https://www.malekal.com/demarrer-windows-mode-sans-echec/

- Choisis ta session habituelle

- Fais un scan complet avec MalwareByte's Anti-Malware

- Supprime tout ce que le logiciel trouve, enregistre le rapport

- Redémarre en mode normal et poste le rapport ici

Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

ok donne moi 10 min

Il t'en faudra plus que ça.

Donne lui en 30.

2-3h je dirais xD

sa y'est c'st fait, je t'envoie le rapport:

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1062
Windows 6.0.6000

12:39:27 19/08/2008
mbam-log-08-19-2008 (12-39-27).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 137717
Temps écoulé: 23 minute(s), 55 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\0.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\PCHealthCenter\5.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Users\Florent\AppData\Roaming\Adobe\Manager.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Windows\ateqoflr.exe.vir (Trojan.Vapsup) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Windows\edpw.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\setup(1).exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Init.exe (Rogue.Agent) -> Quarantined and deleted successfully.