Virus "antivirus"
manbo49 -  
Bonjour,

J'ai attrapé un virus "antivirus" apparement assez courant en ce moment qui bien évidemment me dis que j'ai des trojans et qu'il fo que j'achete un antivirus, etc...
Lorsque mon pc s'allume, j'ai sur mon bureau une fenetre qui est impossible a fermer et qui se nomme "warning spyware detected on your computer..."

Serait il possible de m'aider svp ?

Si j'ai besoin de vous envoyer un rapport hijackthis ou SSD, pourriez vous m'expliquer la procédure pour savoir quelle ligne sont suspectes, cela m'éviterait de vous embeter régulirerement, d'autant que j'ai pas mal de connaissance en informatique et que je pense etre capable de comprendre et de m'en sortir seul si cela se reproduit un jour...

Merci d'avance...
Configuration: Windows XP
Firefox 3.0.1

21 réponses

  • Votes
  • Date
  • Date décroissante
  3. manbo49 Auteur
    VOici le rapport HIJACKTHIS !!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:11:25, on 25/08/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam\Quickcam.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\lphcv2tj0et39.exe
    C:\WINDOWS\system32\sysrest32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\PROGRA~1\MESSEN~1\msmsgs.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\qvevqpor.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\Program Files\eChanblard\emule.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Manu\Bureau\cool.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
    O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
    O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
    O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
    O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
    O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    1. geoffrey5 Contributeur sécurité
      Salut !!

      Télécharger sur le bureau malwarebytes à cette adresse :

      https://www.androidworld.fr/

      Voici un tuto pour bien l installer et bien l utiliser :

      https://www.androidworld.fr/

      Après l analyse, redémarrer le pc et poste le rapport !!

      ensuite :

      télécharger sur le bureau Navilog1 à cette adresse (c est le numéro 1 en bas de la page) : https://www.androidworld.fr/

      Si votre antivirus s'affole , le désactiver
      =sous vista : Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisis "Exécuter en tant qu'administrateur
      =sous XP : double-clic dessus pour l'installer et le lancer

      Quand installé
      = taper F
      = Appuyer sur une touche jusqu' arriver aux options
      = Choisir Recherche ( = taper 1 )
      ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes

      un rapport : fixnavi.txt
      dans ==> C :
      le copier et le coller dans la réponse
      2. manbo49 Auteur
        Bonsoir,

        Voici le rapport de malwarebytes

        Malwarebytes' Anti-Malware 1.25
        Version de la base de données: 1062
        Windows 5.1.2600 Service Pack 3

        21:59:26 25/08/2008
        mbam-log-08-25-2008 (21-59-26).txt

        Type de recherche: Examen complet (C:\|)
        Eléments examinés: 110630
        Temps écoulé: 37 minute(s), 58 second(s)

        Processus mémoire infecté(s): 2
        Module(s) mémoire infecté(s): 0
        Clé(s) du Registre infectée(s): 6
        Valeur(s) du Registre infectée(s): 6
        Elément(s) de données du Registre infecté(s): 2
        Dossier(s) infecté(s): 0
        Fichier(s) infecté(s): 13

        Processus mémoire infecté(s):
        C:\WINDOWS\system32\lphcv2tj0et39.exe (Trojan.FakeAlert) -> Unloaded process successfully.
        C:\WINDOWS\system32\sysrest32.exe (Rootkit.Agent) -> Failed to unload process.

        Module(s) mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Clé(s) du Registre infectée(s):
        HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

        Valeur(s) du Registre infectée(s):
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysrest32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcv2tj0et39 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

        Elément(s) de données du Registre infecté(s):
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

        Dossier(s) infecté(s):
        (Aucun élément nuisible détecté)

        Fichier(s) infecté(s):
        C:\WINDOWS\system32\sysrest32.exe (Trojan.Agent) -> Delete on reboot.
        C:\WINDOWS\system32\blphcv2tj0et39.scr (Trojan.FakeAlert) -> Delete on reboot.
        C:\WINDOWS\system32\lphcv2tj0et39.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\phcv2tj0et39.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Manu\Local Settings\temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Manu\Local Settings\temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Manu\Local Settings\temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Manu\Local Settings\temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Manu\Local Settings\temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Manu\Local Settings\temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Manu\Local Settings\temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Manu\Local Settings\temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
        1. manbo49 Auteur
          et voici le rapport de navilog

          Search Navipromo version 3.6.5 commencé le 25/08/2008 à 22:12:22,03

          !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
          !!! Postez ce rapport sur le forum pour le faire analyser !!!
          !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

          Outil exécuté depuis C:\Program Files\navilog1
          Session actuelle : "Manu"

          Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO

          Microsoft Windows XP [version 5.1.2600]
          Internet Explorer : 7.0.5730.13
          Système de fichiers : NTFS

          Recherche executé en mode normal

          *** Recherche Programmes installés ***

          *** Recherche dossiers dans "C:\WINDOWS" ***

          *** Recherche dossiers dans "C:\Program Files" ***

          *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

          *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***

          *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

          *** Recherche dossiers dans "C:\Documents and Settings\Manu\applic~1" ***

          *** Recherche dossiers dans "C:\Documents and Settings\Manu\locals~1\applic~1" ***

          *** Recherche dossiers dans "C:\Documents and Settings\Manu\menudm~1\progra~1" ***

          *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
          pour + d'infos : http://www.gmer.net

          *** Recherche avec GenericNaviSearch ***
          !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
          !!! A vérifier impérativement avant toute suppression manuelle !!!

          * Recherche dans "C:\WINDOWS\system32" *

          * Recherche dans "C:\Documents and Settings\Manu\locals~1\applic~1" *

          *** Recherche fichiers ***

          *** Recherche clés spécifiques dans le Registre ***

          *** Module de Recherche complémentaire ***
          (Recherche fichiers spécifiques)

          1)Recherche nouveaux fichiers Instant Access :

          2)Recherche Heuristique :

          * Dans "C:\WINDOWS\system32" :

          * Dans "C:\Documents and Settings\Manu\locals~1\applic~1" :

          3)Recherche Certificats :

          Certificat Egroup absent !
          Certificat Electronic-Group absent !
          Certificat Montorgueil absent !
          Certificat OOO-Favorit absent !
          Certificat Sunny-Day-Design-Ltd absent !

          4)Recherche fichiers connus :

          *** Analyse terminée le 25/08/2008 à 22:15:29,31 ***
          1. geoffrey5 Contributeur sécurité
            ok...refais un nouveau rapport hijackthis stp
            1. manbo49 Auteur
              Voila

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 23:08:47, on 25/08/2008
              Platform: Windows XP SP3 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16705)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\WINDOWS\Explorer.EXE
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
              C:\WINDOWS\eHome\ehRecvr.exe
              C:\WINDOWS\eHome\ehSched.exe
              C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
              C:\WINDOWS\ehome\ehtray.exe
              C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
              C:\WINDOWS\RTHDCPL.EXE
              C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
              C:\WINDOWS\system32\RUNDLL32.EXE
              C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
              C:\Program Files\Logitech\QuickCam\Quickcam.exe
              C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
              C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
              C:\WINDOWS\system32\lphcv2tj0et39.exe
              C:\Documents and Settings\Manu\Local Settings\temp\.tt6.tmp.exe
              C:\WINDOWS\system32\nvsvc32.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
              C:\Program Files\DAEMON Tools Lite\daemon.exe
              C:\PROGRA~1\MESSEN~1\msmsgs.exe
              C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
              C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              C:\WINDOWS\system32\qvevqpor.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
              C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
              C:\WINDOWS\eHome\ehmsas.exe
              C:\WINDOWS\system32\dllhost.exe
              C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
              C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
              C:\Program Files\Windows Live\Messenger\usnsvc.exe
              C:\WINDOWS\system32\wuauclt.exe
              C:\Program Files\Internet Explorer\IEXPLORE.EXE
              C:\Documents and Settings\Manu\Bureau\cool.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
              O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
              O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
              O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
              O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
              O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
              O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
              O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
              O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
              O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
              O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
              O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
              O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
              O4 - HKLM\..\Run: [inrhcr2tj0et39] C:\Documents and Settings\Manu\Local Settings\temp\.tt6.tmp.exe
              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
              O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
              O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
              O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
              O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
              O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
              O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
              O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
              O4 - HKCU\..\Run: [mntgen] C:\WINDOWS\system32\idylsvmz.exe
              O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
              O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
              O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
              O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
              O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
              O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
              O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
              O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
              O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
              O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
              O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
              O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
              O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
              O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
              O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
              O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
              O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
              O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
              O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
              O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
              1. geoffrey5 Contributeur sécurité
                télécharge combofix (par sUBs) à cette adresse :

                (c est le numéro 5 en bas de la page) : https://www.androidworld.fr/

                et enregistre le sur le Bureau.

                désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware)

                Voici un tuto pour bien l'installer et savoir l utiliser : https://www.androidworld.fr/

                ensuite envois le rapport et ensuite refais un nouveau rapport hijackthis stp
                1. manbo49 Auteur
                  Voici le rapport de combofix !
                  Le virus est toujours la !!!

                  ComboFix 08-08-24.03 - Manu 2008-08-26 2:23:24.4 - NTFSx86
                  Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1501 [GMT 2:00]
                  Endroit: C:\Documents and Settings\Manu\Bureau\ComboFix.exe

                  [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                  .

                  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                  .

                  C:\WINDOWS\system32\blphcv2tj0et39.scr
                  C:\WINDOWS\system32\lphcv2tj0et39.exe
                  C:\WINDOWS\system32\phcv2tj0et39.bmp
                  .
                  ---- Previous Run -------
                  .
                  C:\WINDOWS\system32\blphcv2tj0et39.scr
                  C:\WINDOWS\system32\lphcv2tj0et39.exe
                  C:\WINDOWS\system32\phcv2tj0et39.bmp

                  .
                  ((((((((((((((((((((((((((((( Fichiers créés 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))))))))
                  .

                  2008-08-26 00:31 . 2008-08-26 00:31 102,400 --a------ C:\WINDOWS\system32\xajerwjo.exe
                  2008-08-25 23:08 . 2008-08-25 23:08 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
                  2008-08-25 22:49 . 2008-08-25 22:49 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
                  2008-08-25 22:48 . 2008-08-25 22:48 <REP> d--h----- C:\CanonMP
                  2008-08-25 22:48 . 2005-05-06 21:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7K.DLL
                  2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
                  2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
                  2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
                  2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
                  2008-08-25 22:48 . 2005-05-06 21:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7K.DLL
                  2008-08-25 22:11 . 2008-08-25 22:17 <REP> d-------- C:\Program Files\Navilog1
                  2008-08-25 22:10 . 2008-08-25 22:10 102,400 --a------ C:\WINDOWS\system32\idylsvmz.exe
                  2008-08-25 01:13 . 2008-08-25 01:13 <REP> d-------- C:\Program Files\RogueRemover FREE
                  2008-08-24 17:04 . 2008-08-24 17:04 90,112 --a------ C:\WINDOWS\system32\byhuxone.exe
                  2008-08-23 19:23 . 2008-08-23 19:23 102,400 --a------ C:\WINDOWS\system32\ehmfezwp.exe
                  2008-08-23 15:46 . 2008-08-23 15:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\upszslwp
                  2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Program Files\ptigbqe
                  2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\qrgfqvuj
                  2008-08-23 15:45 . 2008-08-23 15:45 106,496 --a------ C:\WINDOWS\system32\qvevqpor.exe
                  2008-08-21 01:19 . 2008-08-21 01:19 <REP> d-------- C:\Program Files\Camfrog
                  2008-08-18 13:11 . 2008-08-24 17:17 <REP> d-------- C:\WINDOWS\BDOSCAN8
                  2008-08-18 04:54 . 2008-08-19 01:52 <REP> d-------- C:\Documents and Settings\Manu\Application Data\gtk-2.0
                  2008-08-18 04:54 . 2008-08-18 04:54 <REP> d-------- C:\Documents and Settings\Manu\.thumbnails
                  2008-08-18 04:54 . 2008-08-19 02:14 <REP> d-------- C:\Documents and Settings\Manu\.gimp-2.4
                  2008-08-18 04:51 . 2008-08-18 04:51 <REP> d-------- C:\Program Files\GIMP-2.0
                  2008-08-17 23:58 . 2008-08-26 01:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WholeSecurity
                  2008-08-17 23:52 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
                  2008-08-17 23:52 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
                  2008-08-17 23:52 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
                  2008-08-17 23:52 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
                  2008-08-17 23:52 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
                  2008-08-17 23:52 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
                  2008-08-17 23:52 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
                  2008-08-17 23:52 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
                  2008-08-17 23:52 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
                  2008-08-17 00:42 . 2008-08-17 00:42 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Malwarebytes
                  2008-08-17 00:41 . 2008-08-25 21:16 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                  2008-08-17 00:41 . 2008-08-17 00:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                  2008-08-17 00:41 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                  2008-08-17 00:41 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                  2008-08-17 00:35 . 2008-08-17 00:35 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Grisoft
                  2008-08-17 00:34 . 2008-08-17 00:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                  2008-08-17 00:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                  2008-08-16 04:38 . 2006-12-26 16:50 91,547 --a------ C:\Documents and Settings\Manu\EasyBanner_3.0.zip
                  2008-08-16 04:35 . 2008-08-16 04:35 <REP> d-------- C:\Program Files\EasyBanner 4
                  2008-08-16 04:35 . 2006-06-28 14:24 509,920 --a------ C:\WINDOWS\system32\SEGOEUI.TTF
                  2008-08-16 04:35 . 2006-06-28 14:24 490,852 --a------ C:\WINDOWS\system32\SEGOEUIB.TTF
                  2008-08-16 04:35 . 2006-06-28 14:24 393,068 --a------ C:\WINDOWS\system32\SEGOEUIZ.TTF
                  2008-08-16 04:35 . 2006-06-28 14:24 380,456 --a------ C:\WINDOWS\system32\SEGOEUII.TTF
                  2008-08-15 18:57 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
                  2008-08-15 18:57 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
                  2008-08-13 22:22 . 2008-08-13 22:22 <REP> d-------- C:\Program Files\Windows Media Connect 2
                  2008-08-13 22:21 . 2008-08-13 22:21 <REP> d-------- C:\WINDOWS\system32\LogFiles
                  2008-08-13 22:21 . 2008-08-13 22:22 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
                  2008-08-13 22:16 . 2008-08-13 22:16 <REP> d-------- C:\Documents and Settings\Manu\Application Data\DivX
                  2008-08-13 22:15 . 2008-08-13 22:15 <REP> d-------- C:\Program Files\DivX
                  2008-08-13 18:26 . 2008-08-22 18:42 69 --a------ C:\WINDOWS\NeroDigital.ini
                  2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Program Files\eBay
                  2008-08-13 15:54 . 2008-08-17 23:49 <REP> d-------- C:\Documents and Settings\Manu\Application Data\WholeSecurity
                  2008-08-13 15:54 . 2008-08-17 05:55 <REP> d-------- C:\Documents and Settings\Manu\Application Data\eBay
                  2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\eBay
                  2008-08-13 15:53 . 2008-08-13 15:53 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield
                  2008-08-13 15:34 . 2008-08-13 15:34 <REP> d-------- C:\Program Files\MAGIX
                  2008-08-13 15:34 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
                  2008-08-10 23:44 . 2008-08-10 23:44 <REP> d-------- C:\WINDOWS\Downloaded Installations
                  2008-08-10 23:26 . 2008-08-26 00:35 51 --a------ C:\WINDOWS\npornap.INI
                  2008-08-10 23:24 . 2008-08-10 23:24 <REP> d-------- C:\Program Files\Orange
                  2008-08-09 16:17 . 2008-08-09 16:17 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield Installation Information
                  2008-08-09 16:07 . 2008-08-09 16:07 <REP> d-------- C:\Program Files\Unreal Tournament 3
                  2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\WINDOWS\system32\AGEIA
                  2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\Program Files\AGEIA Technologies
                  2008-08-09 14:35 . 2008-08-09 14:35 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
                  2008-08-08 16:51 . 2008-08-08 16:51 <REP> d-------- C:\Program Files\IK Multimedia
                  2008-08-08 14:15 . 2008-08-08 14:15 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Nero
                  2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Program Files\Nero
                  2008-08-08 14:12 . 2008-08-08 14:14 <REP> d-------- C:\Program Files\Fichiers communs\Nero
                  2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
                  2008-08-07 20:34 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
                  2008-08-07 20:34 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
                  2008-08-07 20:34 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
                  2008-08-07 20:34 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
                  2008-08-07 20:34 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
                  2008-08-07 20:34 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
                  2008-08-07 20:34 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
                  2008-08-07 20:34 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
                  2008-08-07 20:27 . 2008-08-07 20:27 <REP> d-------- C:\Program Files\Microsoft.NET
                  2008-08-07 20:25 . 2008-08-07 20:25 <REP> d-------- C:\WINDOWS\SHELLNEW
                  2008-08-07 20:25 . 2008-08-07 20:25 <REP> dr-h----- C:\MSOCache
                  2008-08-07 20:25 . 2008-08-15 23:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
                  2008-08-07 20:19 . 2008-08-07 20:19 <REP> d-------- C:\Documents and Settings\Manu\Application Data\MAGIX
                  2008-08-07 14:22 . 2005-07-25 08:13 1,201,664 -ra------ C:\WINDOWS\system32\xgusb.cpl
                  2008-08-07 14:22 . 2005-07-25 08:13 14,464 -ra------ C:\WINDOWS\system32\drivers\ymidusb.sys
                  2008-08-06 18:21 . 2008-08-06 18:21 101,376 --a------ C:\WINDOWS\system32\drivers\ACEDRV07.sys
                  2008-08-06 18:21 . 2008-08-22 18:19 951 --a------ C:\WINDOWS\MusicStudio.INI
                  2008-08-06 18:17 . 2004-08-11 20:53 38,912 --a------ C:\WINDOWS\system32\mgxasio.dll
                  2008-08-06 18:16 . 2008-08-13 15:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
                  2008-08-06 18:14 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
                  2008-08-06 18:14 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax
                  2008-08-06 18:12 . 2008-08-06 18:12 <REP> d-------- C:\Program Files\Fichiers communs\MAGIX Shared
                  2008-08-06 18:09 . 2008-08-13 15:34 <REP> d-------- C:\WINDOWS\system32\MAGIX
                  2008-08-06 18:09 . 2008-08-09 16:09 <REP> d-------- C:\MAGIX
                  2008-08-06 18:09 . 2002-09-21 00:33 1,089,536 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
                  2008-08-06 18:09 . 2007-07-11 11:53 697,560 --a------ C:\WINDOWS\system32\mgxoschk.dll
                  2008-08-06 18:09 . 1998-10-15 17:28 85,504 --a------ C:\WINDOWS\system32\HtmlWH.dll
                  2008-08-06 18:09 . 1999-01-28 14:44 49,152 --a------ C:\WINDOWS\system32\INETWH32.dll
                  2008-08-06 18:09 . 2008-08-13 15:34 6,768 --a------ C:\WINDOWS\mgxoschk.ini
                  2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a------ C:\WINDOWS\system32\drivers\usbohci.sys
                  2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a--c--- C:\WINDOWS\system32\dllcache\usbohci.sys
                  2008-08-05 18:34 . 2008-08-17 23:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
                  2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\fr
                  2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\bits
                  2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\l2schemas
                  2008-08-05 18:33 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\ServicePackFiles
                  2008-08-05 16:58 . 2008-08-05 16:58 <REP> d-------- C:\WINDOWS\Sun
                  2008-08-05 16:44 . 2008-08-05 16:44 <REP> d-------- C:\Program Files\MSXML 4.0
                  2008-08-05 16:44 . 2008-08-05 16:44 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
                  2008-08-05 14:58 . 2008-08-05 14:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Codemasters
                  2008-08-05 14:57 . 2008-08-05 14:57 <REP> d-------- C:\Program Files\OpenAL
                  2008-08-05 14:57 . 2008-08-05 14:57 444,952 --a------ C:\WINDOWS\system32\wrap_oal.dll
                  2008-08-05 14:57 . 2008-08-05 14:57 109,080 --a------ C:\WINDOWS\system32\OpenAL32.dll
                  2008-08-05 14:42 . 2008-08-05 14:42 <REP> d-------- C:\Program Files\Codemasters
                  2008-08-05 02:01 . 2008-08-05 02:20 <REP> d-------- C:\UT2004
                  2008-08-04 16:23 . 2008-08-04 16:23 360,320 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
                  2008-08-04 14:59 . 2008-08-04 14:59 <REP> d-------- C:\Program Files\Java
                  2008-08-04 14:59 . 2008-08-04 14:59 <REP> d-------- C:\Program Files\Fichiers communs\Java

                  .
                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2008-08-13 13:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
                  2008-08-10 21:44 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
                  2008-08-03 14:00 --------- d-----w C:\Program Files\ASUS
                  2008-08-03 13:55 --------- d-----w C:\Program Files\Attansic
                  2008-08-03 13:52 --------- d-----w C:\Program Files\Realtek
                  2008-08-03 13:50 --------- d-----w C:\Program Files\Intel
                  2008-08-03 13:38 --------- d-----w C:\Program Files\microsoft frontpage
                  2008-08-03 13:37 --------- d-----w C:\Program Files\Services en ligne
                  2008-08-03 13:34 --------- d-----w C:\Program Files\Windows Plus
                  2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
                  2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
                  2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
                  2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
                  2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
                  2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
                  2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
                  2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
                  2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
                  2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
                  2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
                  2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
                  2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
                  2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
                  2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
                  2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                  2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
                  2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                  2006-06-22 23:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
                  .

                  ((((((((((((((((((((((((((((( snapshot@2008-08-26_ 0.05.03.42 )))))))))))))))))))))))))))))))))))))))))
                  .
                  + 2008-08-26 00:21:01 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5d4.dat
                  .
                  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                  REGEDIT4

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
                  "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
                  "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952]
                  "MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [2008-04-14 04:34 1695232]
                  "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
                  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024]
                  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]
                  "UtilCmd"="C:\WINDOWS\system32\qvevqpor.exe" [2008-08-23 15:45 106496]
                  "hlpcfg"="C:\WINDOWS\system32\ehmfezwp.exe" [2008-08-23 19:23 102400]
                  "ComCfgChk"="C:\WINDOWS\system32\byhuxone.exe" [2008-08-24 17:04 90112]
                  "mntgen"="C:\WINDOWS\system32\idylsvmz.exe" [2008-08-25 22:10 102400]
                  "CfgMsgCom"="C:\WINDOWS\system32\xajerwjo.exe" [2008-08-26 00:31 102400]

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:34 64512]
                  "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
                  "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
                  "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
                  "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
                  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
                  "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
                  "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
                  "eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-08-06 16:41 652528]
                  "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
                  "lphcv2tj0et39"="C:\WINDOWS\system32\lphcv2tj0et39.exe" [BU]
                  "inrhcr2tj0et39"="C:\Documents and Settings\Manu\Local Settings\temp\.tt6.tmp.exe" [2008-08-26 00:31 1612958]
                  "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
                  "RTHDCPL"="RTHDCPL.EXE" [2006-09-12 10:58 16264192 C:\WINDOWS\RTHDCPL.exe]
                  "nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]

                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:33 15360]

                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                  "WUAppSetup"="C:\Program Files\Fichiers communs\logishrd\WUApp32.exe" [2007-10-12 04:03 439568]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
                  "zBXnjZhEwz"="C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe" [2008-08-23 15:45 65536]

                  C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                  Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
                  "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
                  "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
                  "ComMntWin"= {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll [2008-08-23 15:45 131072]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
                  "AppInit_DLLs"=ksdorg.dll esrlyl.dll

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                  "midi4"= xgusb.cpl

                  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
                  SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                  "%windir%\\system32\\sessmgr.exe"=
                  "C:\\Program Files\\eChanblard\\emule.exe"=
                  "C:\\UT2004\\System\\UT2004.exe"=
                  "C:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
                  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                  "C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
                  "C:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=

                  R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
                  R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
                  R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-08-22 07:36]
                  S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 15:37]
                  S3 US122;US122 Driver;C:\WINDOWS\system32\Drivers\US122.sys [2007-08-29 15:50]
                  S3 US122DL;US122 Firmware Downloader;C:\WINDOWS\system32\Drivers\US122DL.sys [2007-08-29 15:50]
                  S3 Us122WdmService;US122 Wdm Audio;C:\WINDOWS\system32\Drivers\US122Wdm.sys [2007-08-29 15:50]
                  .
                  .
                  ------- Supplementary Scan -------
                  .
                  FireFox -: Profile - C:\Documents and Settings\Manu\Application Data\Mozilla\Firefox\Profiles\sic4estv.default\
                  FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.fr
                  FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
                  FF -: plugin - C:\Program Files\ma-config.com\nphardwaredetection.dll
                  FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npornap.dll
                  .

                  **************************************************************************

                  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2008-08-26 02:37:59
                  Windows 5.1.2600 Service Pack 3 NTFS

                  Balayage processus cachés ...

                  Balayage caché autostart entries ...

                  Balayage des fichiers cachés ...

                  Scan terminé avec succès
                  Les fichiers cachés: 0

                  **************************************************************************
                  .
                  Temps d'accomplissement: 2008-08-26 2:57:01
                  ComboFix-quarantined-files.txt 2008-08-26 00:56:12

                  Pre-Run: 137,074,212,864 octets libres
                  Post-Run: 137,068,539,904 octets libres

                  275 --- E O F --- 2008-08-20 12:15:19
                  1. geoffrey5 Contributeur sécurité
                    Salut !!

                    on continue...

                    Option 1 - Recherche :

                    télécharge smitfraudfix et enregistre le sur le bureau à cette adresse (c est le numéro 2 en bas de la page) :

                    https://www.androidworld.fr/

                    Ensuite double clique sur smitfraudfix puis exécuter

                    Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

                    copier/coller le rapport dans la réponse.
                    1. manbo49 Auteur
                      Voici le rapport smitfraudfix !

                      SmitFraudFix v2.339

                      Rapport fait à 21:03:23,42, 26/08/2008
                      Executé à partir de C:\Documents and Settings\Manu\Bureau\SmitfraudFix
                      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                      Le type du système de fichiers est NTFS
                      Fix executé en mode normal

                      »»»»»»»»»»»»»»»»»»»»»»»» Process

                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
                      C:\WINDOWS\ehome\ehtray.exe
                      C:\WINDOWS\RTHDCPL.EXE
                      C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                      C:\WINDOWS\system32\RUNDLL32.EXE
                      C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                      C:\Program Files\Logitech\QuickCam\Quickcam.exe
                      C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                      C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                      C:\WINDOWS\system32\lphcv2tj0et39.exe
                      C:\Documents and Settings\Manu\Local Settings\temp\.tt9.tmp.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                      C:\Program Files\DAEMON Tools Lite\daemon.exe
                      C:\PROGRA~1\MESSEN~1\msmsgs.exe
                      C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
                      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                      C:\WINDOWS\system32\qvevqpor.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      C:\WINDOWS\eHome\ehRecvr.exe
                      C:\WINDOWS\eHome\ehSched.exe
                      C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                      C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                      C:\WINDOWS\system32\nvsvc32.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                      C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                      C:\WINDOWS\system32\dllhost.exe
                      C:\WINDOWS\eHome\ehmsas.exe
                      C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
                      C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
                      C:\Program Files\Windows Live\Messenger\usnsvc.exe
                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                      C:\Documents and Settings\Manu\Bureau\SmitfraudFix\Policies.exe
                      C:\WINDOWS\system32\cmd.exe

                      »»»»»»»»»»»»»»»»»»»»»»»» hosts

                      »»»»»»»»»»»»»»»»»»»»»»»» C:\

                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Manu

                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Manu\Application Data

                      »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Manu\Favoris

                      »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                      »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                      »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                      "Source"="About:Home"
                      "SubscribedURL"="About:Home"
                      "FriendlyName"="Ma page d'accueil"

                      »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                      IEDFix
                      Credits: Malware Analysis & Diagnostic
                      Code: S!Ri

                      »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                      VACFix
                      Credits: Malware Analysis & Diagnostic
                      Code: S!Ri

                      »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                      404Fix
                      Credits: Malware Analysis & Diagnostic
                      Code: S!Ri

                      »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                      AntiXPVSTFix
                      Credits: Malware Analysis & Diagnostic
                      Code: S!Ri

                      [!] Malware.Win32.EncPk-DA.gen
                      O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe (Running)

                      [!] Suspicious file
                      C:\WINDOWS\system32\phcv2tj0et39.bmp

                      [!] Suspicious file
                      C:\WINDOWS\system32\blphcv2tj0et39.scr

                      [!] Malware.Win32.EncPk-CZ.gen
                      O4 - HKLM\..\Run: [inrhcr2tj0et39] C:\Documents and Settings\Manu\Local Settings\temp\.tt9.tmp.exe (Running)

                      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                      SrchSTS.exe by S!Ri
                      Search SharedTaskScheduler's .dll

                      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                      "AppInit_DLLs"="ksdorg.dll esrlyl.dll"

                      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                      "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
                      "System"=""

                      »»»»»»»»»»»»»»»»»»»»»»»» RK

                      »»»»»»»»»»»»»»»»»»»»»»»» DNS

                      Description: Attansic L1 Gigabit Ethernet 10/100/1000Base-T Adapter - Miniport d'ordonnancement de paquets
                      DNS Server Search Order: 212.27.53.252
                      DNS Server Search Order: 212.27.54.252

                      HKLM\SYSTEM\CCS\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
                      HKLM\SYSTEM\CS1\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
                      HKLM\SYSTEM\CS2\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
                      HKLM\SYSTEM\CS3\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
                      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
                      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
                      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
                      HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252

                      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                      »»»»»»»»»»»»»»»»»»»»»»»» Fin
                      1. geoffrey5 Contributeur sécurité
                        ok maintenant :

                        Option 2 - Nettoyage :

                        Redémarrer l'ordinateur en mode sans échec (tapoter F8 au boot pour obtenir le menu de démarrage).

                        Double cliquer sur smitfraudfix

                        Sélectionner 2 pour supprimer les fichiers responsables de l'infection.

                        A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.

                        Le fix déterminera si le fichier wininet.dll est infecté. A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.

                        Redémarrer en mode normal et poster le rapport.

                        ensuite refais un nouveau rapport hijackthis stp
                        1. manbo49 Auteur
                          Bonsoir, Et tout d'abord merci pour toute votre aide !!!
                          Le virus ne semble plus etre la, du moins il n'y aplus de fentres intempestives pour acheter un antivirus !! ce qui est un tres bon point !!!!

                          voici les rapports :

                          CELUI DE SMITFRAUDFIX :

                          SmitFraudFix v2.339

                          Rapport fait à 2:03:21,17, 27/08/2008
                          Executé à partir de C:\Documents and Settings\Manu\Bureau\SmitfraudFix
                          OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                          Le type du système de fichiers est NTFS
                          Fix executé en mode sans echec

                          »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
                          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                          SrchSTS.exe by S!Ri
                          Search SharedTaskScheduler's .dll

                          »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

                          »»»»»»»»»»»»»»»»»»»»»»»» hosts

                          127.0.0.1 localhost

                          »»»»»»»»»»»»»»»»»»»»»»»» VACFix

                          VACFix
                          Credits: Malware Analysis & Diagnostic
                          Code: S!Ri

                          »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

                          S!Ri's WS2Fix: LSP not Found.

                          »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

                          GenericRenosFix by S!Ri

                          »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

                          »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

                          IEDFix
                          Credits: Malware Analysis & Diagnostic
                          Code: S!Ri

                          »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

                          404Fix
                          Credits: Malware Analysis & Diagnostic
                          Code: S!Ri

                          »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

                          »»»»»»»»»»»»»»»»»»»»»»»» RK

                          »»»»»»»»»»»»»»»»»»»»»»»» DNS

                          HKLM\SYSTEM\CCS\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
                          HKLM\SYSTEM\CS1\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
                          HKLM\SYSTEM\CS2\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
                          HKLM\SYSTEM\CS3\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
                          HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
                          HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
                          HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
                          HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252

                          »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

                          »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                          "System"=""

                          »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

                          Nettoyage terminé.

                          »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
                          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                          SrchSTS.exe by S!Ri
                          Search SharedTaskScheduler's .dll

                          »»»»»»»»»»»»»»»»»»»»»»»» Fin

                          CELUI DE HIJACKTHIS :

                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 02:14:54, on 27/08/2008
                          Platform: Windows XP SP3 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                          C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
                          C:\WINDOWS\ehome\ehtray.exe
                          C:\WINDOWS\RTHDCPL.EXE
                          C:\WINDOWS\system32\RUNDLL32.EXE
                          C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                          C:\Program Files\Logitech\QuickCam\Quickcam.exe
                          C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                          C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
                          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                          C:\Program Files\DAEMON Tools Lite\daemon.exe
                          C:\PROGRA~1\MESSEN~1\msmsgs.exe
                          C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
                          C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                          C:\WINDOWS\system32\byhuxone.exe
                          C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                          C:\WINDOWS\eHome\ehRecvr.exe
                          C:\WINDOWS\eHome\ehSched.exe
                          C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                          C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                          C:\WINDOWS\system32\nvsvc32.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                          C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                          C:\WINDOWS\system32\dllhost.exe
                          C:\WINDOWS\eHome\ehmsas.exe
                          C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
                          C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
                          C:\Program Files\Windows Live\Messenger\usnsvc.exe
                          C:\WINDOWS\system32\wuauclt.exe
                          C:\Program Files\Internet Explorer\IEXPLORE.EXE
                          C:\Documents and Settings\Manu\Bureau\cool.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                          O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
                          O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                          O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
                          O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                          O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
                          O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                          O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
                          O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
                          O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
                          O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                          O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
                          O4 - HKLM\..\Run: [inrhcr2tj0et39] C:\Documents and Settings\Manu\Local Settings\temp\.tt9.tmp.exe
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                          O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
                          O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
                          O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
                          O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
                          O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                          O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
                          O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
                          O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
                          O4 - HKCU\..\Run: [mntgen] C:\WINDOWS\system32\idylsvmz.exe
                          O4 - HKCU\..\Run: [CfgMsgCom] C:\WINDOWS\system32\xajerwjo.exe
                          O4 - HKCU\..\Run: [StrHlpUtil] C:\WINDOWS\system32\dkfqdszm.exe
                          O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                          O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
                          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                          O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
                          O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                          O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                          O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                          O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
                          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
                          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                          O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
                          O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
                          O20 - AppInit_DLLs: ksdorg.dll esrlyl.dll
                          O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
                          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                          O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
                          O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                          O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                          O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                          O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                          O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                          O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                          1. geoffrey5 Contributeur sécurité
                            ok...c est déjà bien mais y a encore des infections...fais ceci stp :

                            télécharge combofix (par sUBs) à cette adresse :

                            (c est le numéro 5 en bas de la page) : https://www.androidworld.fr/

                            et enregistre le sur le Bureau.

                            désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware)

                            Voici un tuto pour bien l'installer et savoir l utiliser : https://www.androidworld.fr/

                            ensuite envois le rapport et refais un nouveau rapport hijackthis stp
                            1. manbo49 Auteur
                              Effectivement il est toujours la.... :'(

                              rapport combofix

                              ComboFix 08-08-26.02 - Manu 2008-08-27 2:48:11.5 - NTFSx86
                              Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1521 [GMT 2:00]
                              Endroit: C:\Documents and Settings\Manu\Bureau\ComboFix.exe
                              * Création d'un nouveau point de restauration

                              [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                              .

                              ((((((((((((((((((((((((((((( Fichiers créés 2008-07-27 to 2008-08-27 ))))))))))))))))))))))))))))))))))))
                              .

                              2008-08-27 02:01 . 2008-08-03 17:27 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
                              2008-08-27 02:01 . 2008-08-03 17:27 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
                              2008-08-27 02:01 . 2008-08-03 15:32 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
                              2008-08-27 02:01 . 2008-08-03 17:27 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
                              2008-08-27 02:01 . 2008-08-03 17:27 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
                              2008-08-27 02:01 . 2008-08-03 17:27 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
                              2008-08-27 02:01 . 2008-08-27 02:09 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
                              2008-08-27 02:01 . 2008-08-27 02:01 <REP> d-------- C:\Documents and Settings\Administrateur
                              2008-08-26 21:03 . 2008-08-27 02:09 2,318 --a------ C:\WINDOWS\system32\tmp.reg
                              2008-08-26 03:11 . 2008-08-26 03:11 102,400 --a------ C:\WINDOWS\system32\dkfqdszm.exe
                              2008-08-26 00:31 . 2008-08-26 00:31 102,400 --a------ C:\WINDOWS\system32\xajerwjo.exe
                              2008-08-25 23:08 . 2008-08-25 23:08 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
                              2008-08-25 22:49 . 2008-08-25 22:49 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
                              2008-08-25 22:48 . 2008-08-25 22:48 <REP> d--h----- C:\CanonMP
                              2008-08-25 22:48 . 2005-05-06 21:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7K.DLL
                              2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
                              2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
                              2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
                              2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
                              2008-08-25 22:48 . 2005-05-06 21:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7K.DLL
                              2008-08-25 22:11 . 2008-08-25 22:17 <REP> d-------- C:\Program Files\Navilog1
                              2008-08-25 22:10 . 2008-08-25 22:10 102,400 --a------ C:\WINDOWS\system32\idylsvmz.exe
                              2008-08-25 01:13 . 2008-08-25 01:13 <REP> d-------- C:\Program Files\RogueRemover FREE
                              2008-08-24 17:04 . 2008-08-24 17:04 90,112 --a------ C:\WINDOWS\system32\byhuxone.exe
                              2008-08-23 19:23 . 2008-08-23 19:23 102,400 --a------ C:\WINDOWS\system32\ehmfezwp.exe
                              2008-08-23 15:46 . 2008-08-23 15:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\upszslwp
                              2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Program Files\ptigbqe
                              2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\qrgfqvuj
                              2008-08-23 15:45 . 2008-08-23 15:45 106,496 --a------ C:\WINDOWS\system32\qvevqpor.exe
                              2008-08-21 01:19 . 2008-08-21 01:19 <REP> d-------- C:\Program Files\Camfrog
                              2008-08-18 13:11 . 2008-08-24 17:17 <REP> d-------- C:\WINDOWS\BDOSCAN8
                              2008-08-18 04:54 . 2008-08-19 01:52 <REP> d-------- C:\Documents and Settings\Manu\Application Data\gtk-2.0
                              2008-08-18 04:54 . 2008-08-18 04:54 <REP> d-------- C:\Documents and Settings\Manu\.thumbnails
                              2008-08-18 04:54 . 2008-08-19 02:14 <REP> d-------- C:\Documents and Settings\Manu\.gimp-2.4
                              2008-08-18 04:51 . 2008-08-18 04:51 <REP> d-------- C:\Program Files\GIMP-2.0
                              2008-08-17 23:58 . 2008-08-27 02:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WholeSecurity
                              2008-08-17 23:52 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
                              2008-08-17 23:52 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
                              2008-08-17 23:52 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
                              2008-08-17 23:52 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
                              2008-08-17 23:52 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
                              2008-08-17 23:52 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
                              2008-08-17 23:52 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
                              2008-08-17 23:52 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
                              2008-08-17 23:52 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
                              2008-08-17 00:42 . 2008-08-17 00:42 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Malwarebytes
                              2008-08-17 00:41 . 2008-08-25 21:16 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                              2008-08-17 00:41 . 2008-08-17 00:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                              2008-08-17 00:41 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                              2008-08-17 00:41 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                              2008-08-17 00:35 . 2008-08-17 00:35 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Grisoft
                              2008-08-17 00:34 . 2008-08-17 00:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                              2008-08-17 00:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                              2008-08-16 04:38 . 2006-12-26 16:50 91,547 --a------ C:\Documents and Settings\Manu\EasyBanner_3.0.zip
                              2008-08-16 04:35 . 2008-08-16 04:35 <REP> d-------- C:\Program Files\EasyBanner 4
                              2008-08-16 04:35 . 2006-06-28 14:24 509,920 --a------ C:\WINDOWS\system32\SEGOEUI.TTF
                              2008-08-16 04:35 . 2006-06-28 14:24 490,852 --a------ C:\WINDOWS\system32\SEGOEUIB.TTF
                              2008-08-16 04:35 . 2006-06-28 14:24 393,068 --a------ C:\WINDOWS\system32\SEGOEUIZ.TTF
                              2008-08-16 04:35 . 2006-06-28 14:24 380,456 --a------ C:\WINDOWS\system32\SEGOEUII.TTF
                              2008-08-15 18:57 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
                              2008-08-15 18:57 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
                              2008-08-13 22:22 . 2008-08-13 22:22 <REP> d-------- C:\Program Files\Windows Media Connect 2
                              2008-08-13 22:21 . 2008-08-13 22:21 <REP> d-------- C:\WINDOWS\system32\LogFiles
                              2008-08-13 22:21 . 2008-08-13 22:22 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
                              2008-08-13 22:16 . 2008-08-13 22:16 <REP> d-------- C:\Documents and Settings\Manu\Application Data\DivX
                              2008-08-13 22:15 . 2008-08-13 22:15 <REP> d-------- C:\Program Files\DivX
                              2008-08-13 18:26 . 2008-08-26 18:02 69 --a------ C:\WINDOWS\NeroDigital.ini
                              2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Program Files\eBay
                              2008-08-13 15:54 . 2008-08-17 23:49 <REP> d-------- C:\Documents and Settings\Manu\Application Data\WholeSecurity
                              2008-08-13 15:54 . 2008-08-17 05:55 <REP> d-------- C:\Documents and Settings\Manu\Application Data\eBay
                              2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\eBay
                              2008-08-13 15:53 . 2008-08-13 15:53 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield
                              2008-08-13 15:34 . 2008-08-13 15:34 <REP> d-------- C:\Program Files\MAGIX
                              2008-08-13 15:34 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
                              2008-08-10 23:44 . 2008-08-10 23:44 <REP> d-------- C:\WINDOWS\Downloaded Installations
                              2008-08-10 23:26 . 2008-08-26 00:35 51 --a------ C:\WINDOWS\npornap.INI
                              2008-08-10 23:24 . 2008-08-10 23:24 <REP> d-------- C:\Program Files\Orange
                              2008-08-09 16:17 . 2008-08-09 16:17 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield Installation Information
                              2008-08-09 16:07 . 2008-08-09 16:07 <REP> d-------- C:\Program Files\Unreal Tournament 3
                              2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\WINDOWS\system32\AGEIA
                              2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\Program Files\AGEIA Technologies
                              2008-08-09 14:35 . 2008-08-09 14:35 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
                              2008-08-08 16:51 . 2008-08-08 16:51 <REP> d-------- C:\Program Files\IK Multimedia
                              2008-08-08 14:15 . 2008-08-08 14:15 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Nero
                              2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Program Files\Nero
                              2008-08-08 14:12 . 2008-08-08 14:14 <REP> d-------- C:\Program Files\Fichiers communs\Nero
                              2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
                              2008-08-07 20:34 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
                              2008-08-07 20:34 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
                              2008-08-07 20:34 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
                              2008-08-07 20:34 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
                              2008-08-07 20:34 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
                              2008-08-07 20:34 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
                              2008-08-07 20:34 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
                              2008-08-07 20:34 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
                              2008-08-07 20:27 . 2008-08-07 20:27 <REP> d-------- C:\Program Files\Microsoft.NET
                              2008-08-07 20:25 . 2008-08-07 20:25 <REP> d-------- C:\WINDOWS\SHELLNEW
                              2008-08-07 20:25 . 2008-08-07 20:25 <REP> dr-h----- C:\MSOCache
                              2008-08-07 20:25 . 2008-08-15 23:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
                              2008-08-07 20:19 . 2008-08-07 20:19 <REP> d-------- C:\Documents and Settings\Manu\Application Data\MAGIX
                              2008-08-07 14:22 . 2005-07-25 08:13 1,201,664 -ra------ C:\WINDOWS\system32\xgusb.cpl
                              2008-08-07 14:22 . 2005-07-25 08:13 14,464 -ra------ C:\WINDOWS\system32\drivers\ymidusb.sys
                              2008-08-06 18:21 . 2008-08-06 18:21 101,376 --a------ C:\WINDOWS\system32\drivers\ACEDRV07.sys
                              2008-08-06 18:21 . 2008-08-22 18:19 951 --a------ C:\WINDOWS\MusicStudio.INI
                              2008-08-06 18:17 . 2004-08-11 20:53 38,912 --a------ C:\WINDOWS\system32\mgxasio.dll
                              2008-08-06 18:16 . 2008-08-13 15:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
                              2008-08-06 18:14 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
                              2008-08-06 18:14 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax
                              2008-08-06 18:12 . 2008-08-06 18:12 <REP> d-------- C:\Program Files\Fichiers communs\MAGIX Shared
                              2008-08-06 18:09 . 2008-08-13 15:34 <REP> d-------- C:\WINDOWS\system32\MAGIX
                              2008-08-06 18:09 . 2008-08-09 16:09 <REP> d-------- C:\MAGIX
                              2008-08-06 18:09 . 2002-09-21 00:33 1,089,536 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
                              2008-08-06 18:09 . 2007-07-11 11:53 697,560 --a------ C:\WINDOWS\system32\mgxoschk.dll
                              2008-08-06 18:09 . 1998-10-15 17:28 85,504 --a------ C:\WINDOWS\system32\HtmlWH.dll
                              2008-08-06 18:09 . 1999-01-28 14:44 49,152 --a------ C:\WINDOWS\system32\INETWH32.dll
                              2008-08-06 18:09 . 2008-08-13 15:34 6,768 --a------ C:\WINDOWS\mgxoschk.ini
                              2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a------ C:\WINDOWS\system32\drivers\usbohci.sys
                              2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a--c--- C:\WINDOWS\system32\dllcache\usbohci.sys
                              2008-08-05 18:34 . 2008-08-17 23:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
                              2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\fr
                              2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\bits
                              2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\l2schemas
                              2008-08-05 18:33 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\ServicePackFiles
                              2008-08-05 16:58 . 2008-08-05 16:58 <REP> d-------- C:\WINDOWS\Sun
                              2008-08-05 16:44 . 2008-08-05 16:44 <REP> d-------- C:\Program Files\MSXML 4.0

                              .
                              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              2008-08-13 13:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
                              2008-08-10 21:44 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
                              2008-08-03 14:00 --------- d-----w C:\Program Files\ASUS
                              2008-08-03 13:55 --------- d-----w C:\Program Files\Attansic
                              2008-08-03 13:52 --------- d-----w C:\Program Files\Realtek
                              2008-08-03 13:50 --------- d-----w C:\Program Files\Intel
                              2008-08-03 13:38 --------- d-----w C:\Program Files\microsoft frontpage
                              2008-08-03 13:37 --------- d-----w C:\Program Files\Services en ligne
                              2008-08-03 13:34 --------- d-----w C:\Program Files\Windows Plus
                              2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
                              2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
                              2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
                              2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
                              2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
                              2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
                              2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
                              2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
                              2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
                              2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
                              2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
                              2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
                              2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
                              2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
                              2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
                              2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                              2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
                              2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                              2006-06-22 23:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
                              .

                              ((((((((((((((((((((((((((((( snapshot@2008-08-26_ 0.05.03.42 )))))))))))))))))))))))))))))))))))))))))
                              .
                              + 2008-08-27 00:42:37 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5c8.dat
                              .
                              ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              .
                              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                              REGEDIT4

                              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
                              "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
                              "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952]
                              "MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [2008-04-14 04:34 1695232]
                              "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
                              "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024]
                              "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]
                              "UtilCmd"="C:\WINDOWS\system32\qvevqpor.exe" [2008-08-23 15:45 106496]
                              "hlpcfg"="C:\WINDOWS\system32\ehmfezwp.exe" [2008-08-23 19:23 102400]
                              "ComCfgChk"="C:\WINDOWS\system32\byhuxone.exe" [2008-08-24 17:04 90112]
                              "mntgen"="C:\WINDOWS\system32\idylsvmz.exe" [2008-08-25 22:10 102400]
                              "CfgMsgCom"="C:\WINDOWS\system32\xajerwjo.exe" [2008-08-26 00:31 102400]
                              "StrHlpUtil"="C:\WINDOWS\system32\dkfqdszm.exe" [2008-08-26 03:11 102400]

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:34 64512]
                              "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
                              "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
                              "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
                              "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
                              "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
                              "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
                              "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
                              "eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-08-06 16:41 652528]
                              "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
                              "lphcv2tj0et39"="C:\WINDOWS\system32\lphcv2tj0et39.exe" [BU]
                              "inrhcr2tj0et39"="C:\Documents and Settings\Manu\Local Settings\temp\.tt9.tmp.exe" [BU]
                              "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
                              "RTHDCPL"="RTHDCPL.EXE" [2006-09-12 10:58 16264192 C:\WINDOWS\RTHDCPL.exe]
                              "nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]

                              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                              "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:33 15360]

                              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                              "WUAppSetup"="C:\Program Files\Fichiers communs\logishrd\WUApp32.exe" [2007-10-12 04:03 439568]

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
                              "zBXnjZhEwz"="C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe" [2008-08-23 15:45 65536]

                              C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                              Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
                              "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
                              "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
                              "ComMntWin"= {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll [2008-08-23 15:45 131072]

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
                              "AppInit_DLLs"=ksdorg.dll esrlyl.dll

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                              "midi4"= xgusb.cpl

                              [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
                              SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                              "%windir%\\system32\\sessmgr.exe"=
                              "C:\\Program Files\\eChanblard\\emule.exe"=
                              "C:\\UT2004\\System\\UT2004.exe"=
                              "C:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
                              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                              "C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
                              "C:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=

                              .
                              .
                              ------- Supplementary Scan -------
                              .
                              FireFox -: Profile - C:\Documents and Settings\Manu\Application Data\Mozilla\Firefox\Profiles\sic4estv.default\
                              FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.fr
                              FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
                              FF -: plugin - C:\Program Files\ma-config.com\nphardwaredetection.dll
                              FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npornap.dll
                              .

                              **************************************************************************

                              catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                              Rootkit scan 2008-08-27 03:36:54
                              Windows 5.1.2600 Service Pack 3 NTFS

                              Balayage processus cachés ...

                              Balayage caché autostart entries ...

                              Balayage des fichiers cachés ...

                              Scan terminé avec succès
                              Les fichiers cachés: 0

                              **************************************************************************
                              .
                              --------------------- DLLs a chargé sous des processus courants ---------------------

                              PROCESS: C:\WINDOWS\explorer.exe
                              -> C:\Program Files\ptigbqe\ComMntWin.dll
                              .
                              Temps d'accomplissement: 2008-08-27 4:33:12
                              ComboFix-quarantined-files.txt 2008-08-27 02:28:25
                              ComboFix2.txt 2008-08-26 00:57:44

                              Pre-Run: 136,975,536,128 octets libres
                              Post-Run: 137,007,779,840 octets libres

                              263 --- E O F --- 2008-08-20 12:15:19

                              RAPPORRT HIJACKTHIS

                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 09:54:31, on 27/08/2008
                              Platform: Windows XP SP3 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                              C:\Program Files\Alwil Software\Avast4\ashServ.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                              C:\WINDOWS\eHome\ehRecvr.exe
                              C:\WINDOWS\eHome\ehSched.exe
                              C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                              C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                              C:\WINDOWS\system32\nvsvc32.exe
                              C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
                              C:\WINDOWS\ehome\ehtray.exe
                              C:\WINDOWS\RTHDCPL.EXE
                              C:\WINDOWS\system32\RUNDLL32.EXE
                              C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                              C:\Program Files\Logitech\QuickCam\Quickcam.exe
                              C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
                              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                              C:\Program Files\DAEMON Tools Lite\daemon.exe
                              C:\PROGRA~1\MESSEN~1\msmsgs.exe
                              C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
                              C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                              C:\WINDOWS\system32\qvevqpor.exe
                              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                              C:\WINDOWS\system32\dllhost.exe
                              C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                              C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                              C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
                              C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
                              C:\WINDOWS\eHome\ehmsas.exe
                              C:\WINDOWS\system32\ehgpavyx.exe
                              C:\Documents and Settings\Manu\Local Settings\temp\.tt5.tmp
                              C:\Program Files\Internet Explorer\iexplore.exe
                              C:\WINDOWS\system32\qvevqpor.exe
                              C:\Documents and Settings\Manu\Bureau\cool.exe

                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                              O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
                              O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                              O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
                              O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                              O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                              O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                              O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
                              O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
                              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                              O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
                              O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
                              O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
                              O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                              O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
                              O4 - HKLM\..\Run: [inrhcr2tj0et39] C:\Documents and Settings\Manu\Local Settings\temp\.tt5.tmp.exe
                              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                              O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
                              O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
                              O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
                              O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
                              O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                              O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
                              O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
                              O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
                              O4 - HKCU\..\Run: [mntgen] C:\WINDOWS\system32\idylsvmz.exe
                              O4 - HKCU\..\Run: [CfgMsgCom] C:\WINDOWS\system32\xajerwjo.exe
                              O4 - HKCU\..\Run: [StrHlpUtil] C:\WINDOWS\system32\dkfqdszm.exe
                              O4 - HKCU\..\Run: [dsccfg] C:\WINDOWS\system32\ovixohaj.exe
                              O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
                              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                              O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
                              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                              O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
                              O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                              O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                              O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                              O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                              O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                              O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                              O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
                              O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
                              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                              O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
                              O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
                              O20 - AppInit_DLLs: ksdorg.dll esrlyl.dll
                              O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
                              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                              O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                              O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                              O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                              O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                              O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
                              O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                              O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                              O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                              O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                              O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                              O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                              1. geoffrey5 Contributeur sécurité
                                Salut !!

                                Copie le texte ci-dessous :

                                File::
                                c:\documents and settings\manu\local settings\temp\.tt5.tmp.exe

                                Folder::

                                Registry::

                                Ouvre le Bloc-Notes puis colle le texte copié.
                                (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
                                Sauvegarde ce fichier sous le nom de CFScript.txt.

                                Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

                                http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

                                Cela va relancer Combofix,

                                Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                                Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                                Ne touche à rien tant que le scan n'est pas terminé.

                                Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

                                S'il n'y a pas de rédémarrage, poste quand même les rapports.

                                ensuite refais un nouveau rapport hijackthis pour vérifier stp
                                1. manbo49 Auteur
                                  Rapport combofix :

                                  ComboFix 08-08-26.02 - Manu 2008-08-28 1:14:44.8 - NTFSx86
                                  Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1540 [GMT 2:00]
                                  Endroit: C:\Documents and Settings\Manu\Bureau\ComboFix.exe
                                  Command switches used :: C:\Documents and Settings\Manu\Bureau\CFScript.txt
                                  * Création d'un nouveau point de restauration

                                  [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                                  FILE ::
                                  c:\documents and settings\manu\local settings\temp\.tt5.tmp.exe
                                  .

                                  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                                  .
                                  .
                                  ---- Previous Run -------
                                  .
                                  c:\documents and settings\manu\local settings\temp\.tt5.tmp.exe
                                  C:\WINDOWS\system32\blphcv2tj0et39.scr
                                  C:\WINDOWS\system32\lphcv2tj0et39.exe
                                  C:\WINDOWS\system32\phcv2tj0et39.bmp

                                  .
                                  ((((((((((((((((((((((((((((( Fichiers créés 2008-07-27 to 2008-08-27 ))))))))))))))))))))))))))))))))))))
                                  .

                                  2008-08-27 09:43 . 2008-08-27 09:43 90,112 --a------ C:\WINDOWS\system32\ovixohaj.exe
                                  2008-08-27 02:01 . 2008-08-03 17:27 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
                                  2008-08-27 02:01 . 2008-08-03 17:27 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
                                  2008-08-27 02:01 . 2008-08-03 15:32 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
                                  2008-08-27 02:01 . 2008-08-03 17:27 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
                                  2008-08-27 02:01 . 2008-08-03 17:27 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
                                  2008-08-27 02:01 . 2008-08-03 17:27 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
                                  2008-08-27 02:01 . 2008-08-27 02:09 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
                                  2008-08-27 02:01 . 2008-08-27 02:01 <REP> d-------- C:\Documents and Settings\Administrateur
                                  2008-08-26 21:03 . 2008-08-27 02:09 2,318 --a------ C:\WINDOWS\system32\tmp.reg
                                  2008-08-26 03:11 . 2008-08-26 03:11 102,400 --a------ C:\WINDOWS\system32\dkfqdszm.exe
                                  2008-08-26 00:31 . 2008-08-26 00:31 102,400 --a------ C:\WINDOWS\system32\xajerwjo.exe
                                  2008-08-25 23:08 . 2008-08-25 23:08 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
                                  2008-08-25 22:49 . 2008-08-25 22:49 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
                                  2008-08-25 22:48 . 2008-08-25 22:48 <REP> d--h----- C:\CanonMP
                                  2008-08-25 22:48 . 2005-05-06 21:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7K.DLL
                                  2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
                                  2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
                                  2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
                                  2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
                                  2008-08-25 22:48 . 2005-05-06 21:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7K.DLL
                                  2008-08-25 22:11 . 2008-08-25 22:17 <REP> d-------- C:\Program Files\Navilog1
                                  2008-08-25 22:10 . 2008-08-25 22:10 102,400 --a------ C:\WINDOWS\system32\idylsvmz.exe
                                  2008-08-25 01:13 . 2008-08-25 01:13 <REP> d-------- C:\Program Files\RogueRemover FREE
                                  2008-08-24 17:04 . 2008-08-24 17:04 90,112 --a------ C:\WINDOWS\system32\byhuxone.exe
                                  2008-08-23 19:23 . 2008-08-23 19:23 102,400 --a------ C:\WINDOWS\system32\ehmfezwp.exe
                                  2008-08-23 15:46 . 2008-08-23 15:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\upszslwp
                                  2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Program Files\ptigbqe
                                  2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\qrgfqvuj
                                  2008-08-23 15:45 . 2008-08-23 15:45 106,496 --a------ C:\WINDOWS\system32\qvevqpor.exe
                                  2008-08-21 01:19 . 2008-08-21 01:19 <REP> d-------- C:\Program Files\Camfrog
                                  2008-08-18 13:11 . 2008-08-24 17:17 <REP> d-------- C:\WINDOWS\BDOSCAN8
                                  2008-08-18 04:54 . 2008-08-19 01:52 <REP> d-------- C:\Documents and Settings\Manu\Application Data\gtk-2.0
                                  2008-08-18 04:54 . 2008-08-18 04:54 <REP> d-------- C:\Documents and Settings\Manu\.thumbnails
                                  2008-08-18 04:54 . 2008-08-19 02:14 <REP> d-------- C:\Documents and Settings\Manu\.gimp-2.4
                                  2008-08-18 04:51 . 2008-08-18 04:51 <REP> d-------- C:\Program Files\GIMP-2.0
                                  2008-08-17 23:58 . 2008-08-28 01:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WholeSecurity
                                  2008-08-17 23:52 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
                                  2008-08-17 23:52 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
                                  2008-08-17 23:52 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
                                  2008-08-17 23:52 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
                                  2008-08-17 23:52 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
                                  2008-08-17 23:52 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
                                  2008-08-17 23:52 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
                                  2008-08-17 23:52 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
                                  2008-08-17 23:52 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
                                  2008-08-17 00:42 . 2008-08-17 00:42 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Malwarebytes
                                  2008-08-17 00:41 . 2008-08-25 21:16 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                                  2008-08-17 00:41 . 2008-08-17 00:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                                  2008-08-17 00:41 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                                  2008-08-17 00:41 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                                  2008-08-17 00:35 . 2008-08-17 00:35 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Grisoft
                                  2008-08-17 00:34 . 2008-08-17 00:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                                  2008-08-17 00:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                                  2008-08-16 04:38 . 2006-12-26 16:50 91,547 --a------ C:\Documents and Settings\Manu\EasyBanner_3.0.zip
                                  2008-08-16 04:35 . 2008-08-16 04:35 <REP> d-------- C:\Program Files\EasyBanner 4
                                  2008-08-16 04:35 . 2006-06-28 14:24 509,920 --a------ C:\WINDOWS\system32\SEGOEUI.TTF
                                  2008-08-16 04:35 . 2006-06-28 14:24 490,852 --a------ C:\WINDOWS\system32\SEGOEUIB.TTF
                                  2008-08-16 04:35 . 2006-06-28 14:24 393,068 --a------ C:\WINDOWS\system32\SEGOEUIZ.TTF
                                  2008-08-16 04:35 . 2006-06-28 14:24 380,456 --a------ C:\WINDOWS\system32\SEGOEUII.TTF
                                  2008-08-15 18:57 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
                                  2008-08-15 18:57 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
                                  2008-08-13 22:22 . 2008-08-13 22:22 <REP> d-------- C:\Program Files\Windows Media Connect 2
                                  2008-08-13 22:21 . 2008-08-13 22:21 <REP> d-------- C:\WINDOWS\system32\LogFiles
                                  2008-08-13 22:21 . 2008-08-13 22:22 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
                                  2008-08-13 22:16 . 2008-08-13 22:16 <REP> d-------- C:\Documents and Settings\Manu\Application Data\DivX
                                  2008-08-13 22:15 . 2008-08-13 22:15 <REP> d-------- C:\Program Files\DivX
                                  2008-08-13 18:26 . 2008-08-26 18:02 69 --a------ C:\WINDOWS\NeroDigital.ini
                                  2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Program Files\eBay
                                  2008-08-13 15:54 . 2008-08-17 23:49 <REP> d-------- C:\Documents and Settings\Manu\Application Data\WholeSecurity
                                  2008-08-13 15:54 . 2008-08-17 05:55 <REP> d-------- C:\Documents and Settings\Manu\Application Data\eBay
                                  2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\eBay
                                  2008-08-13 15:53 . 2008-08-13 15:53 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield
                                  2008-08-13 15:34 . 2008-08-13 15:34 <REP> d-------- C:\Program Files\MAGIX
                                  2008-08-13 15:34 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
                                  2008-08-10 23:44 . 2008-08-10 23:44 <REP> d-------- C:\WINDOWS\Downloaded Installations
                                  2008-08-10 23:26 . 2008-08-26 00:35 51 --a------ C:\WINDOWS\npornap.INI
                                  2008-08-10 23:24 . 2008-08-10 23:24 <REP> d-------- C:\Program Files\Orange
                                  2008-08-09 16:17 . 2008-08-09 16:17 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield Installation Information
                                  2008-08-09 16:07 . 2008-08-09 16:07 <REP> d-------- C:\Program Files\Unreal Tournament 3
                                  2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\WINDOWS\system32\AGEIA
                                  2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\Program Files\AGEIA Technologies
                                  2008-08-09 14:35 . 2008-08-09 14:35 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
                                  2008-08-08 16:51 . 2008-08-08 16:51 <REP> d-------- C:\Program Files\IK Multimedia
                                  2008-08-08 14:15 . 2008-08-08 14:15 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Nero
                                  2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Program Files\Nero
                                  2008-08-08 14:12 . 2008-08-08 14:14 <REP> d-------- C:\Program Files\Fichiers communs\Nero
                                  2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
                                  2008-08-07 20:34 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
                                  2008-08-07 20:34 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
                                  2008-08-07 20:34 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
                                  2008-08-07 20:34 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
                                  2008-08-07 20:34 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
                                  2008-08-07 20:34 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
                                  2008-08-07 20:34 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
                                  2008-08-07 20:34 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
                                  2008-08-07 20:27 . 2008-08-07 20:27 <REP> d-------- C:\Program Files\Microsoft.NET
                                  2008-08-07 20:25 . 2008-08-07 20:25 <REP> d-------- C:\WINDOWS\SHELLNEW
                                  2008-08-07 20:25 . 2008-08-07 20:25 <REP> dr-h----- C:\MSOCache
                                  2008-08-07 20:25 . 2008-08-15 23:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
                                  2008-08-07 20:19 . 2008-08-07 20:19 <REP> d-------- C:\Documents and Settings\Manu\Application Data\MAGIX
                                  2008-08-07 14:22 . 2005-07-25 08:13 1,201,664 -ra------ C:\WINDOWS\system32\xgusb.cpl
                                  2008-08-07 14:22 . 2005-07-25 08:13 14,464 -ra------ C:\WINDOWS\system32\drivers\ymidusb.sys
                                  2008-08-06 18:21 . 2008-08-06 18:21 101,376 --a------ C:\WINDOWS\system32\drivers\ACEDRV07.sys
                                  2008-08-06 18:21 . 2008-08-22 18:19 951 --a------ C:\WINDOWS\MusicStudio.INI
                                  2008-08-06 18:17 . 2004-08-11 20:53 38,912 --a------ C:\WINDOWS\system32\mgxasio.dll
                                  2008-08-06 18:16 . 2008-08-13 15:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
                                  2008-08-06 18:14 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
                                  2008-08-06 18:14 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax
                                  2008-08-06 18:12 . 2008-08-06 18:12 <REP> d-------- C:\Program Files\Fichiers communs\MAGIX Shared
                                  2008-08-06 18:09 . 2008-08-13 15:34 <REP> d-------- C:\WINDOWS\system32\MAGIX
                                  2008-08-06 18:09 . 2008-08-09 16:09 <REP> d-------- C:\MAGIX
                                  2008-08-06 18:09 . 2002-09-21 00:33 1,089,536 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
                                  2008-08-06 18:09 . 2007-07-11 11:53 697,560 --a------ C:\WINDOWS\system32\mgxoschk.dll
                                  2008-08-06 18:09 . 1998-10-15 17:28 85,504 --a------ C:\WINDOWS\system32\HtmlWH.dll
                                  2008-08-06 18:09 . 1999-01-28 14:44 49,152 --a------ C:\WINDOWS\system32\INETWH32.dll
                                  2008-08-06 18:09 . 2008-08-13 15:34 6,768 --a------ C:\WINDOWS\mgxoschk.ini
                                  2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a------ C:\WINDOWS\system32\drivers\usbohci.sys
                                  2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a--c--- C:\WINDOWS\system32\dllcache\usbohci.sys
                                  2008-08-05 18:34 . 2008-08-17 23:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
                                  2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\fr
                                  2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\bits
                                  2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\l2schemas
                                  2008-08-05 18:33 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\ServicePackFiles
                                  2008-08-05 16:58 . 2008-08-05 16:58 <REP> d-------- C:\WINDOWS\Sun

                                  .
                                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                  .
                                  2008-08-13 13:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
                                  2008-08-10 21:44 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
                                  2008-08-03 14:00 --------- d-----w C:\Program Files\ASUS
                                  2008-08-03 13:55 --------- d-----w C:\Program Files\Attansic
                                  2008-08-03 13:52 --------- d-----w C:\Program Files\Realtek
                                  2008-08-03 13:50 --------- d-----w C:\Program Files\Intel
                                  2008-08-03 13:38 --------- d-----w C:\Program Files\microsoft frontpage
                                  2008-08-03 13:37 --------- d-----w C:\Program Files\Services en ligne
                                  2008-08-03 13:34 --------- d-----w C:\Program Files\Windows Plus
                                  2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
                                  2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
                                  2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
                                  2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
                                  2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
                                  2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
                                  2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
                                  2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
                                  2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
                                  2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
                                  2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
                                  2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
                                  2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
                                  2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
                                  2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
                                  2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                                  2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
                                  2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                                  2006-06-22 23:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
                                  .

                                  ((((((((((((((((((((((((((((( snapshot@2008-08-26_ 0.05.03.42 )))))))))))))))))))))))))))))))))))))))))
                                  .
                                  + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe
                                  + 2007-03-06 01:35:47 394,976 -c----w C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\updspapi.dll
                                  + 2007-08-13 16:54:10 765,952 -c----w C:\WINDOWS\ie7updates\KB938127-v2-IE7\vgx.dll
                                  - 2007-08-13 16:54:10 765,952 -c----w C:\WINDOWS\system32\dllcache\VGX.dll
                                  + 2008-05-27 17:25:06 765,952 -c----w C:\WINDOWS\system32\dllcache\vgx.dll
                                  + 2008-08-27 23:10:51 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5c8.dat
                                  .
                                  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                                  .
                                  .
                                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                                  REGEDIT4

                                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
                                  "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
                                  "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952]
                                  "MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [2008-04-14 04:34 1695232]
                                  "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
                                  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024]
                                  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]
                                  "UtilCmd"="C:\WINDOWS\system32\qvevqpor.exe" [2008-08-23 15:45 106496]
                                  "hlpcfg"="C:\WINDOWS\system32\ehmfezwp.exe" [2008-08-23 19:23 102400]
                                  "ComCfgChk"="C:\WINDOWS\system32\byhuxone.exe" [2008-08-24 17:04 90112]
                                  "mntgen"="C:\WINDOWS\system32\idylsvmz.exe" [2008-08-25 22:10 102400]
                                  "CfgMsgCom"="C:\WINDOWS\system32\xajerwjo.exe" [2008-08-26 00:31 102400]
                                  "StrHlpUtil"="C:\WINDOWS\system32\dkfqdszm.exe" [2008-08-26 03:11 102400]
                                  "dsccfg"="C:\WINDOWS\system32\ovixohaj.exe" [2008-08-27 09:43 90112]

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                  "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:34 64512]
                                  "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
                                  "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
                                  "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
                                  "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
                                  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
                                  "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
                                  "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
                                  "eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-08-06 16:41 652528]
                                  "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
                                  "lphcv2tj0et39"="C:\WINDOWS\system32\lphcv2tj0et39.exe" [BU]
                                  "inrhcr2tj0et39"="C:\Documents and Settings\Manu\Local Settings\temp\.tt5.tmp.exe" [BU]
                                  "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
                                  "RTHDCPL"="RTHDCPL.EXE" [2006-09-12 10:58 16264192 C:\WINDOWS\RTHDCPL.exe]
                                  "nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]

                                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                                  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:33 15360]

                                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                                  "WUAppSetup"="C:\Program Files\Fichiers communs\logishrd\WUApp32.exe" [2007-10-12 04:03 439568]

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
                                  "zBXnjZhEwz"="C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe" [2008-08-23 15:45 65536]

                                  C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                                  Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
                                  "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
                                  "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
                                  "ComMntWin"= {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll [2008-08-23 15:45 131072]

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
                                  "AppInit_DLLs"=ksdorg.dll esrlyl.dll

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                                  "midi4"= xgusb.cpl

                                  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
                                  SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

                                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                  "%windir%\\system32\\sessmgr.exe"=
                                  "C:\\Program Files\\eChanblard\\emule.exe"=
                                  "C:\\UT2004\\System\\UT2004.exe"=
                                  "C:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
                                  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                                  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                                  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                                  "C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
                                  "C:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=

                                  R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
                                  R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
                                  R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-08-22 07:36]
                                  S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 15:18]
                                  S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 15:37]
                                  S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-07-25 20:57]
                                  S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-08-17 15:01]
                                  S3 US122;US122 Driver;C:\WINDOWS\system32\Drivers\US122.sys [2007-08-29 15:50]
                                  S3 US122DL;US122 Firmware Downloader;C:\WINDOWS\system32\Drivers\US122DL.sys [2007-08-29 15:50]
                                  S3 Us122WdmService;US122 Wdm Audio;C:\WINDOWS\system32\Drivers\US122Wdm.sys [2007-08-29 15:50]
                                  .

                                  **************************************************************************

                                  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                  Rootkit scan 2008-08-28 01:26:23
                                  Windows 5.1.2600 Service Pack 3 NTFS

                                  Balayage processus cachés ...

                                  Balayage caché autostart entries ...

                                  Balayage des fichiers cachés ...

                                  Scan terminé avec succès
                                  Les fichiers cachés: 0

                                  **************************************************************************
                                  .
                                  Temps d'accomplissement: 2008-08-28 1:31:35
                                  ComboFix-quarantined-files.txt 2008-08-27 23:31:17
                                  ComboFix2.txt 2008-08-27 02:34:05
                                  ComboFix3.txt 2008-08-26 00:57:44

                                  Pre-Run: 136,903,290,880 octets libres
                                  Post-Run: 136,906,137,600 octets libres

                                  280 --- E O F --- 2008-08-27 22:36:15

                                  Et celui d'hikjackthis :

                                  Logfile of Trend Micro HijackThis v2.0.2
                                  Scan saved at 01:35:04, on 28/08/2008
                                  Platform: Windows XP SP3 (WinNT 5.01.2600)
                                  MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                                  Boot mode: Normal

                                  Running processes:
                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                                  C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
                                  C:\WINDOWS\ehome\ehtray.exe
                                  C:\WINDOWS\RTHDCPL.EXE
                                  C:\WINDOWS\system32\RUNDLL32.EXE
                                  C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                                  C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                                  C:\WINDOWS\system32\ctfmon.exe
                                  C:\PROGRA~1\MESSEN~1\msmsgs.exe
                                  C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
                                  C:\WINDOWS\system32\byhuxone.exe
                                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                  C:\WINDOWS\eHome\ehRecvr.exe
                                  C:\WINDOWS\eHome\ehSched.exe
                                  C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                                  C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                                  C:\WINDOWS\system32\nvsvc32.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                  C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                                  C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                                  C:\WINDOWS\system32\dllhost.exe
                                  C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
                                  C:\WINDOWS\eHome\ehmsas.exe
                                  C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
                                  C:\Program Files\Windows Live\Messenger\usnsvc.exe
                                  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                  C:\WINDOWS\explorer.exe
                                  C:\Program Files\Internet Explorer\iexplore.exe
                                  C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
                                  C:\Documents and Settings\Manu\Bureau\cool.exe

                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                  O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
                                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                  O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
                                  O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                                  O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
                                  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                                  O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
                                  O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
                                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                                  O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
                                  O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
                                  O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
                                  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                  O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
                                  O4 - HKLM\..\Run: [inrhcr2tj0et39] C:\Documents and Settings\Manu\Local Settings\temp\.tt5.tmp.exe
                                  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                                  O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
                                  O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
                                  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
                                  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
                                  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                  O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
                                  O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
                                  O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
                                  O4 - HKCU\..\Run: [mntgen] C:\WINDOWS\system32\idylsvmz.exe
                                  O4 - HKCU\..\Run: [CfgMsgCom] C:\WINDOWS\system32\xajerwjo.exe
                                  O4 - HKCU\..\Run: [StrHlpUtil] C:\WINDOWS\system32\dkfqdszm.exe
                                  O4 - HKCU\..\Run: [dsccfg] C:\WINDOWS\system32\ovixohaj.exe
                                  O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
                                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                  O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
                                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                  O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
                                  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                                  O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
                                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                                  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                                  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                                  O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                                  O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
                                  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
                                  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                                  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
                                  O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
                                  O20 - AppInit_DLLs: ksdorg.dll esrlyl.dll
                                  O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
                                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                  O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
                                  O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                                  O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                                  O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                                  O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                                  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                                  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                                  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                  1. geoffrey5 Contributeur sécurité
                                    Salut !!

                                    ca devrait partir en faisant ceci :

                                    télécharge OtMoveIt

                                    Télécharge OTMoveIt (de Old_Timer) sur ton Bureau à cette adresse :

                                    (c est le numéro 7 en bas de la page) : https://www.androidworld.fr/

                                    Double-clique sur OTMoveIt.exe pour le lancer.
                                    Assure toi que la case Unregister Dll's and Ocx's soit bien cochée.
                                    Copie la liste qui se trouve en gras dans la citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste List of Files/Folders to move.

                                    c:\documents and settings\all users\application data\qrgfqvuj\spmdyzah.exe
                                    c:\documents and settings\manu\local settings\temp\.tt5.tmp.exe

                                    clique sur MoveIt! pour lancer la suppression.
                                    Le résultat apparaitra dans le cadre "Results".
                                    Clique sur Exit pour fermer.
                                    Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

                                    Il te sera peut-être demandé de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

                                    ensuite :

                                    Fix.reg

                                    Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisi nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en gras dans la citation ci-dessous (copie tout d'un trait sans les barres(x)) :

                                    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

                                    REGEDIT4

                                    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
                                    "inrhcr2tj0et39"=-

                                    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
                                    Note : Regedit4 est sur la premiere ligne dans le bloc note et il y a une ligne blanche a la fin.
                                    Puis click sur "fichier"/"enregistrer sous" :
                                    dans : sur le bureau
                                    Nom du fichier : fix.reg
                                    Type de fichier : "tous les fichiers"
                                    clique sur "enregistrer"

                                    ca doit ressembler à ca une fois enregistré :

                                    http://img520.imageshack.us/img520/4251/screenshot005ps2.png

                                    double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
                                    Si c'est bien le cas, clique sur "oui"

                                    ensuite redémarre le pc et refais un nouveau rapport hijackthis stp
                                    1. manbo49 Auteur
                                      RE !!

                                      j'ai tout fait mais c'est encore la !!

                                      Rapport ot move it !

                                      c:\documents and settings\all users\application data\qrgfqvuj\spmdyzah.exe moved successfully.
                                      c:\documents and settings\manu\local settings\temp\.tt5.tmp.exe moved successfully.

                                      OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08282008_020421

                                      rapport hijackthis :

                                      Logfile of Trend Micro HijackThis v2.0.2
                                      Scan saved at 02:16:05, on 28/08/2008
                                      Platform: Windows XP SP3 (WinNT 5.01.2600)
                                      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                                      Boot mode: Normal

                                      Running processes:
                                      C:\WINDOWS\System32\smss.exe
                                      C:\WINDOWS\system32\winlogon.exe
                                      C:\WINDOWS\system32\services.exe
                                      C:\WINDOWS\system32\lsass.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                      C:\WINDOWS\system32\spoolsv.exe
                                      C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                                      C:\WINDOWS\Explorer.EXE
                                      C:\WINDOWS\ehome\ehtray.exe
                                      C:\WINDOWS\RTHDCPL.EXE
                                      C:\WINDOWS\system32\RUNDLL32.EXE
                                      C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                                      C:\Program Files\Logitech\QuickCam\Quickcam.exe
                                      C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                                      C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
                                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                                      C:\WINDOWS\system32\lphcv2tj0et39.exe
                                      C:\WINDOWS\system32\ctfmon.exe
                                      C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                                      C:\Program Files\DAEMON Tools Lite\daemon.exe
                                      C:\PROGRA~1\MESSEN~1\msmsgs.exe
                                      C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
                                      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                      C:\WINDOWS\system32\ehmfezwp.exe
                                      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                      C:\WINDOWS\eHome\ehRecvr.exe
                                      C:\WINDOWS\eHome\ehSched.exe
                                      C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                                      C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                                      C:\WINDOWS\system32\nvsvc32.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                      C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                      C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                                      C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
                                      C:\WINDOWS\system32\dllhost.exe
                                      C:\WINDOWS\eHome\ehmsas.exe
                                      C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
                                      C:\Program Files\Windows Live\Messenger\usnsvc.exe
                                      C:\WINDOWS\system32\wuauclt.exe
                                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                                      C:\Documents and Settings\Manu\Bureau\cool.exe

                                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                      O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
                                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                      O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
                                      O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                                      O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
                                      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                                      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                                      O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
                                      O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
                                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                                      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
                                      O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
                                      O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
                                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                      O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
                                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                                      O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
                                      O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
                                      O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
                                      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
                                      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                      O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
                                      O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
                                      O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
                                      O4 - HKCU\..\Run: [mntgen] C:\WINDOWS\system32\idylsvmz.exe
                                      O4 - HKCU\..\Run: [CfgMsgCom] C:\WINDOWS\system32\xajerwjo.exe
                                      O4 - HKCU\..\Run: [StrHlpUtil] C:\WINDOWS\system32\dkfqdszm.exe
                                      O4 - HKCU\..\Run: [dsccfg] C:\WINDOWS\system32\ovixohaj.exe
                                      O4 - HKCU\..\Run: [uichk] C:\WINDOWS\system32\lspipqxg.exe
                                      O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
                                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                      O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
                                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                      O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
                                      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                                      O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
                                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                                      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                                      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                                      O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                                      O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
                                      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
                                      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                                      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
                                      O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
                                      O20 - AppInit_DLLs: ksdorg.dll esrlyl.dll
                                      O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
                                      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                      O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
                                      O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                                      O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                                      O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                                      O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                                      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                                      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                                      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                      • 1
                                      • 2

                                      Discussions similaires

                                      Softonic,est-ce un virus ?
                                      techmel1

                                      6 réponses
                                      Chrome://newtab
                                      Nova

                                      14 réponses
                                      Désinstaller Softonic
                                      Diguimette

                                      5 réponses
                                      Google Chrome "  Échec de l'analyse antivirus "
                                      jmpower

                                      18 réponses