Virus "you have a security message" et a

J'ai fait ta démarche, mais il ne se passe rien quand je double clique sur runthis, il y a une petite fenêtre bleue qui s'ouvre mais se referme instantanément :s j'ai aussi essayé de l'exécuter en tant qu'administrateur mais il ne se passe rien non plus. Tu m'as dit de ne pas charger ma session administrateur mais ma session habituelle, mais je n'ai qu'une seule session sur ce pc, et elle est nécessairement administrateur. (je précise que j'utilise vista)

En tout cas merci pour l'aide, j'attends de voir si tu sais comment résoudre se problème ;)

-----------\\ ToolBar S&D 1.1.7 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6000 )
X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-62 )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Valentin ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 080905-0] 4.8.1229 (Activated)

"C:\ToolBar SD" ( MAJ : 04-09-2008|15:03 )
Option : [1] ( 06/09/2008|15:24 )

[ UAC => 1 ]

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF"
"Default_Page_URL"="https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\Valentin\.bitrock\rld-sssc-CRACK+KEYGEN
C:\Users\Valentin\.bitrock\rld-sssc-CRACK+KEYGEN.rar
C:\Users\Valentin\.bitrock\Sim City Societies - Patch4 + Crack
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack
C:\Users\Valentin\.bitrock\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED
C:\Users\Valentin\.bitrock\City Life\Crack
C:\Users\Valentin\.bitrock\City Life\Crack\BuildingImporter.exe
C:\Users\Valentin\.bitrock\City Life\Crack\CLD.exe
C:\Users\Valentin\.bitrock\City Life\Crack\CLD_editor.exe
C:\Users\Valentin\.bitrock\City Life\Crack\CLD_editor2.exe
C:\Users\Valentin\.bitrock\City Life\Crack\CLD_FullEdit.exe
C:\Users\Valentin\.bitrock\City Life\Crack\For Health & Prosperity Click Here!.url
C:\Users\Valentin\.bitrock\City Life\Crack\God's Yellow Pages.url
C:\Users\Valentin\.bitrock\City Life\Crack\MannaTech.url
C:\Users\Valentin\.bitrock\City Life\Crack\Work From Home!.url
C:\Users\Valentin\.bitrock\EE.III+Update\Update.1.1\Crack
C:\Users\Valentin\.bitrock\EE.III+Update\Update.1.1\Crack\EE3.exe
C:\Users\Valentin\.bitrock\histoire de naufrag‚s\The Sims Castaway Stories [PC]\ViTALiTY\keygen.exe
C:\Users\Valentin\.bitrock\rld-sssc-CRACK+KEYGEN\rld-scss.exe
C:\Users\Valentin\.bitrock\rld-sssc-CRACK+KEYGEN\SimCitySocieties.exe
C:\Users\Valentin\.bitrock\Sim City Societies\SimCitySocieties Keygen.exe
C:\Users\Valentin\.bitrock\Sim City Societies - Patch4 + Crack\SCS_103140B_H.exe
C:\Users\Valentin\.bitrock\Sim City Societies - Patch4 + Crack\SimCitySocieties.exe
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack\Crack
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack\Crack\JuboX Forum.txt
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack\Crack\jubox.us.nfo
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack\Crack\rld-tscs.exe
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack\Crack\SimsCS.exe
C:\Users\Valentin\.bitrock\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED\game.dat
C:\Users\Valentin\.bitrock\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED\reloaded.nfo
C:\Users\Valentin\.bitrock\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED\rld-bme2.exe
C:\Users\Valentin\.bitrock\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED\rld-bme2.rar
C:\Users\Valentin\AppData\Roaming\Microsoft\Windows\Recent\rld-sssc-CRACK+KEYGEN.lnk
C:\Users\Valentin\AppData\Roaming\Microsoft\Windows\Recent\U_The.Sims.Castaway.Stories-Crack.lnk
C:\Users\Valentin\AppData\Roaming\uTorrent\rld-sssc-CRACK+KEYGEN.rar.1.torrent
C:\Users\Valentin\AppData\Roaming\uTorrent\rld-sssc-CRACK+KEYGEN.rar.torrent
C:\Users\Valentin\AppData\Roaming\uTorrent\Sim City Societies - Patch4 + Crack.torrent
C:\Users\Valentin\AppData\Roaming\uTorrent\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED.torrent
C:\Users\Valentin\AppData\Roaming\uTorrent\[Pc Game] SimCity Societies New Crack By--XxSewerDawgxX.torrent

[ UAC => 1 ]

1 - "C:\ToolBar SD\TB_1.txt" - 06/09/2008|15:25 - Option : [1]

-----------\\ Fin du rapport a 15:25:06,42

Voici le rapport généré. Que faire ensuite :) ?

Merci beaucoup de donner du temps pour moi ?

Voici le dernier rapport effectué !

-----------\\ ToolBar S&D 1.1.7 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6000 )
X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-62 )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Valentin ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 080906-0] 4.8.1229 (Activated)

"C:\ToolBar SD" ( MAJ : 04-09-2008|15:03 )
Option : [2] ( 06/09/2008|17:51 )

[ UAC => 1 ]

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Default_Page_URL"="https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\Valentin\.bitrock\rld-sssc-CRACK+KEYGEN
C:\Users\Valentin\.bitrock\rld-sssc-CRACK+KEYGEN.rar
C:\Users\Valentin\.bitrock\Sim City Societies - Patch4 + Crack
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack
C:\Users\Valentin\.bitrock\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED
C:\Users\Valentin\.bitrock\City Life\Crack
C:\Users\Valentin\.bitrock\City Life\Crack\BuildingImporter.exe
C:\Users\Valentin\.bitrock\City Life\Crack\CLD.exe
C:\Users\Valentin\.bitrock\City Life\Crack\CLD_editor.exe
C:\Users\Valentin\.bitrock\City Life\Crack\CLD_editor2.exe
C:\Users\Valentin\.bitrock\City Life\Crack\CLD_FullEdit.exe
C:\Users\Valentin\.bitrock\City Life\Crack\For Health & Prosperity Click Here!.url
C:\Users\Valentin\.bitrock\City Life\Crack\God's Yellow Pages.url
C:\Users\Valentin\.bitrock\City Life\Crack\MannaTech.url
C:\Users\Valentin\.bitrock\City Life\Crack\Work From Home!.url
C:\Users\Valentin\.bitrock\EE.III+Update\Update.1.1\Crack
C:\Users\Valentin\.bitrock\EE.III+Update\Update.1.1\Crack\EE3.exe
C:\Users\Valentin\.bitrock\histoire de naufrag‚s\The Sims Castaway Stories [PC]\ViTALiTY\keygen.exe
C:\Users\Valentin\.bitrock\rld-sssc-CRACK+KEYGEN\rld-scss.exe
C:\Users\Valentin\.bitrock\rld-sssc-CRACK+KEYGEN\SimCitySocieties.exe
C:\Users\Valentin\.bitrock\Sim City Societies\SimCitySocieties Keygen.exe
C:\Users\Valentin\.bitrock\Sim City Societies - Patch4 + Crack\SCS_103140B_H.exe
C:\Users\Valentin\.bitrock\Sim City Societies - Patch4 + Crack\SimCitySocieties.exe
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack\Crack
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack\Crack\JuboX Forum.txt
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack\Crack\jubox.us.nfo
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack\Crack\rld-tscs.exe
C:\Users\Valentin\.bitrock\The.Sims.Castaway.Stories - Crack\Crack\SimsCS.exe
C:\Users\Valentin\.bitrock\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED\game.dat
C:\Users\Valentin\.bitrock\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED\reloaded.nfo
C:\Users\Valentin\.bitrock\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED\rld-bme2.exe
C:\Users\Valentin\.bitrock\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED\rld-bme2.rar
C:\Users\Valentin\AppData\Roaming\Microsoft\Windows\Recent\rld-sssc-CRACK+KEYGEN.lnk
C:\Users\Valentin\AppData\Roaming\Microsoft\Windows\Recent\U_The.Sims.Castaway.Stories-Crack.lnk
C:\Users\Valentin\AppData\Roaming\uTorrent\rld-sssc-CRACK+KEYGEN.rar.1.torrent
C:\Users\Valentin\AppData\Roaming\uTorrent\rld-sssc-CRACK+KEYGEN.rar.torrent
C:\Users\Valentin\AppData\Roaming\uTorrent\Sim City Societies - Patch4 + Crack.torrent
C:\Users\Valentin\AppData\Roaming\uTorrent\[NTi]_The.Lord.Of.The.Rings.Battle.For.Middle.Earth.2.CRACK.ONLY-RELOADED.torrent
C:\Users\Valentin\AppData\Roaming\uTorrent\[Pc Game] SimCity Societies New Crack By--XxSewerDawgxX.torrent

[ UAC => 1 ]

1 - "C:\ToolBar SD\TB_1.txt" - 06/09/2008|15:25 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 06/09/2008|17:52 - Option : [2]

-----------\\ Fin du rapport a 17:52:25,27

Merci beaucoup j'attends la prochaine étape si prochaine étape il y a :)

Slt a tous.
1...Télécharge malwarebyte AM [url=http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware](mbam.exe)[/url]
fais un scan et enregistre le log et poste sur le forum
2...Il faut arreter le torrent et le crack, les keygens, c'est illegal et c'est ca qui cause des virus (surtout les keygens).
3... Suis mes conseils !
A +

Ok je vais arrêter les cracks et les keygen, mais est-ce que ça veut dire que je dois supprimer ceux installés :s ?

Pour le torrent, tous les fichiers sont forcément corrompus ? Parce que en général je ne télécharge que des séries américaines, est-ce que ce sont aussi des fichiers à risque ?

voici le rapport tristan

ComboFix 08-09-05.02 - Valentin 2008-09-07 11:11:33.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.2210 [GMT 2:00]
Endroit: C:\Users\Valentin\Desktop\Tristan.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\KBL.LOG

.
((((((((((((((((((((((((((((( Fichiers créés 2008-08-07 to 2008-09-07 ))))))))))))))))))))))))))))))))))))
.

2008-09-06 15:23 . 2008-09-06 17:52 <REP> d-------- C:\ToolBar SD
2008-09-04 10:02 . 2008-09-04 10:02 <REP> d-------- C:\Users\All Users\webcmdwin
2008-09-04 10:02 . 2008-09-04 10:02 <REP> d-------- C:\Users\All Users\mntsrv
2008-09-04 10:02 . 2008-09-04 10:02 <REP> d-------- C:\ProgramData\webcmdwin
2008-09-04 10:02 . 2008-09-04 10:02 <REP> d-------- C:\ProgramData\mntsrv
2008-09-04 08:29 . 2008-09-04 08:29 <REP> d-------- C:\Users\Valentin\AppData\Roaming\Malwarebytes
2008-09-04 08:29 . 2008-09-04 08:29 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-09-04 08:29 . 2008-09-04 08:29 <REP> d-------- C:\ProgramData\Malwarebytes
2008-09-04 08:29 . 2008-09-04 08:29 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-04 08:29 . 2008-09-02 00:16 38,528 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-09-04 08:29 . 2008-09-02 00:16 17,200 --a------ C:\Windows\System32\drivers\mbam.sys
2008-09-03 18:06 . 2008-09-03 18:07 <REP> d-------- C:\Users\Valentin\AppData\Roaming\SPORE
2008-09-03 17:30 . 2008-09-03 17:30 <REP> dr-h----- C:\Users\Valentin\AppData\Roaming\SecuROM
2008-09-03 17:21 . 2008-09-03 17:21 10,872 --a------ C:\Windows\System32\ealregsnapshot1.reg
2008-09-03 09:21 . 2008-09-03 09:21 <REP> d-------- C:\Users\All Users\ufodidml
2008-09-03 09:21 . 2008-09-06 00:08 <REP> d-------- C:\Users\All Users\srvcomsys
2008-09-03 09:21 . 2008-09-04 09:57 <REP> d-------- C:\Users\All Users\smartmonsys
2008-09-03 09:21 . 2008-09-03 09:21 <REP> d-------- C:\ProgramData\ufodidml
2008-09-03 09:21 . 2008-09-06 00:08 <REP> d-------- C:\ProgramData\srvcomsys
2008-09-03 09:21 . 2008-09-04 09:57 <REP> d-------- C:\ProgramData\smartmonsys
2008-09-02 14:37 . 2008-09-02 14:37 <REP> d-------- C:\Program Files\Alwil Software
2008-09-02 14:37 . 2008-07-19 16:36 51,280 --a------ C:\Windows\System32\drivers\aswMonFlt.sys
2008-09-01 13:29 . 2008-09-01 14:01 <REP> d-------- C:\Users\Valentin\AppData\Roaming\La Bataille pour la Terre du Milieu ™ II
2008-08-31 21:58 . 2008-08-31 21:58 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-08-30 09:43 . 2008-08-30 09:43 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-08-29 11:34 . 2008-08-29 11:34 <REP> d-------- C:\Users\Valentin\AppData\Roaming\Sierra Entertainment
2008-08-29 11:29 . 2008-08-29 11:29 <REP> d-------- C:\Windows\System32\AGEIA
2008-08-29 11:29 . 2008-08-29 11:29 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-29 11:29 . 2008-08-29 11:29 <REP> d-------- C:\Program Files\AGEIA Technologies
2008-08-29 11:13 . 2008-08-29 11:13 <REP> d-------- C:\Program Files\Sierra Entertainment
2008-08-29 07:25 . 2008-08-29 07:25 <REP> d-------- C:\Users\Valentin\AppData\Roaming\InstallShield
2008-08-24 18:34 . 2008-08-24 18:34 <REP> d-------- C:\Users\Valentin\AppData\Roaming\skypePM
2008-08-24 18:34 . 2008-08-24 18:34 56 --ah----- C:\Windows\System32\ezsidmv.dat
2008-08-24 18:31 . 2008-08-25 12:40 <REP> d-------- C:\Users\All Users\Skype
2008-08-24 18:31 . 2008-08-25 12:40 <REP> d-------- C:\ProgramData\Skype
2008-08-24 13:15 . 2008-09-02 18:05 <REP> d-------- C:\Users\Valentin\AppData\Roaming\SPORE Creature Creator
2008-08-24 13:15 . 2008-08-24 13:15 107,888 --a------ C:\Windows\System32\CmdLineExt.dll
2008-08-21 23:59 . 2008-08-21 23:59 <REP> d-------- C:\Users\All Users\LightScribe
2008-08-21 23:59 . 2008-08-21 23:59 <REP> d-------- C:\ProgramData\LightScribe
2008-08-14 15:30 . 2008-08-14 15:30 <REP> d-------- C:\Windows\Sun
2008-08-13 03:36 . 2008-07-16 01:48 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-13 03:17 . 2008-04-10 07:01 737,792 --a------ C:\Windows\System32\inetcomm.dll
2008-08-13 03:17 . 2008-04-10 04:43 84,480 --a------ C:\Windows\System32\INETRES.dll
2008-08-10 00:34 . 2008-08-10 00:35 363,104,444 --a------ C:\Windows\MEMORY.DMP
2008-08-07 21:00 . 2008-08-07 21:00 268 --ah----- C:\sqmdata00.sqm
2008-08-07 21:00 . 2008-08-07 21:00 244 --ah----- C:\sqmnoopt00.sqm
2008-08-07 11:43 . 2008-08-07 11:43 <REP> d-------- C:\Program Files\Common Files\INCA Shared
2008-08-07 11:39 . 2003-07-20 20:17 5,174 --a------ C:\Windows\System32\nppt9x.vxd
2008-08-07 11:39 . 2005-01-04 11:43 4,682 --a------ C:\Windows\System32\npptNT2.sys
2008-08-07 11:07 . 2008-08-07 11:07 <REP> d-------- C:\Program Files\Gpotato.eu

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-03 16:16 27,620 ----a-w C:\Users\Valentin\AppData\Roaming\nvModes.dat
2008-09-03 15:55 --------- d-----w C:\Users\Valentin\AppData\Roaming\SystemRequirementsLab
2008-09-03 15:55 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-09-03 15:44 --------- d-----w C:\Program Files\Electronic Arts
2008-09-03 15:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-03 15:42 --------- d-----w C:\ProgramData\WildTangent
2008-09-03 08:09 --------- d-----w C:\Users\Valentin\AppData\Roaming\uTorrent
2008-09-02 12:39 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-09-02 12:33 --------- d-----w C:\ProgramData\Symantec
2008-09-01 06:36 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-20 01:00 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-13 02:44 --------- d-----w C:\Program Files\Windows Mail
2008-08-13 01:38 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-09 08:15 --------- d-----w C:\Users\Valentin\AppData\Roaming\BSplayer
2008-08-03 19:41 414 ----a-w C:\Users\Valentin\AppData\Roaming\wklnhst.dat
2008-08-02 11:55 --------- d-----w C:\Program Files\MSN Games
2008-08-02 11:52 --------- d---a-w C:\ProgramData\TEMP
2008-08-01 18:55 --------- d-----w C:\ProgramData\FreshGames
2008-07-31 18:03 --------- d-----w C:\Program Files\EA GAMES
2008-07-31 15:00 --------- d-----w C:\Program Files\Yahoo!
2008-07-31 14:48 --------- d-----w C:\ProgramData\Yahoo!
2008-07-29 02:26 --------- d-----w C:\Users\Valentin\AppData\Roaming\dvdcss
2008-07-28 19:45 --------- d-----w C:\Program Files\Microsoft Games
2008-07-28 14:00 --------- d-----w C:\Program Files\PhotoFiltre
2008-07-28 08:55 271,360 ----a-w C:\Windows\system32\drivers\atksgt.sys
2008-07-28 08:55 18,048 ----a-w C:\Windows\system32\drivers\lirsgt.sys
2008-07-27 20:49 --------- d-----w C:\Users\Valentin\AppData\Roaming\DAEMON Tools
2008-07-27 20:49 --------- d-----w C:\Program Files\Microsoft Works
2008-07-27 09:18 --------- d-----w C:\Users\Valentin\AppData\Roaming\Template
2008-07-25 10:36 --------- d-----w C:\ProgramData\SimCity Societies
2008-07-20 16:01 717,296 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-07-18 07:43 --------- d-----w C:\Program Files\Java
2008-07-15 14:02 --------- d-----w C:\Program Files\Sierra On-Line
2008-07-10 17:33 --------- d-----w C:\ProgramData\CyberLink
2008-07-10 13:35 --------- d-----w C:\ProgramData\AOL
2008-07-10 13:25 --------- d-----w C:\Users\Valentin\AppData\Roaming\BSplayer Pro
2008-07-10 13:25 --------- d-----w C:\Program Files\Webteh
2008-07-10 06:51 --------- d-----w C:\Users\Valentin\AppData\Roaming\vlc
2008-07-10 06:49 --------- d-----w C:\Program Files\VideoLAN
2008-07-10 01:08 174 --sha-w C:\Program Files\desktop.ini
2008-07-09 17:44 --------- d-----w C:\Program Files\uTorrent
2008-07-09 13:31 --------- d-----w C:\Program Files\Audacity
2008-07-07 16:55 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-07 14:42 --------- d-----w C:\Program Files\QuickTime
2008-07-07 14:41 --------- d-----w C:\ProgramData\Apple Computer
2008-07-07 14:40 --------- d-----w C:\ProgramData\Apple
2008-07-07 14:40 --------- d-----w C:\Program Files\Apple Software Update
2008-07-05 07:52 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll
2008-07-05 07:52 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe
2008-07-05 07:36 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-07-05 07:32 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-07-05 07:32 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-07-05 07:31 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-07-05 07:31 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-07-05 07:31 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-07-05 07:30 1,585,664 ----a-w C:\Windows\System32\setupapi.dll
2008-07-05 07:28 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-07-05 07:27 296,448 ----a-w C:\Windows\System32\gdi32.dll
2008-07-05 07:27 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-07-05 07:27 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-07-05 07:26 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-05 07:26 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-05 07:25 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-05 07:25 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-07-05 07:19 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-07-05 07:18 428,032 ----a-w C:\Windows\System32\EncDec.dll
2008-07-05 07:18 292,352 ----a-w C:\Windows\System32\psisdecd.dll
2008-07-05 07:18 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-07-04 20:28 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-07-04 20:28 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-07-04 20:28 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-07-04 20:28 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-07-04 20:27 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-07-04 20:27 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-07-04 20:27 33,624 ----a-w C:\Windows\System32\wups.dll
2008-07-04 20:27 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-07-04 20:27 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
2008-06-19 03:25 272,896 ----a-w C:\Windows\System32\polstore.dll
2008-06-12 06:54 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-06-12 06:54 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-12 01:21 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-07-05 1232896]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 125440]
"z0aKb8nieO"="C:\ProgramData\ufodidml\azgvwtsl.exe" [2008-09-03 65536]
"webcmdwin"="C:\ProgramData\webcmdwin\gzcdqrcj.exe" [2008-09-04 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-19 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-19 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-19 81920]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-09-30 181544]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

C:\Users\Valentin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'‚cran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 101784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BC064E70-32DE-4DB1-BF5F-0E8A1F5BB8E9}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{F7FF614E-A0A2-47BB-8B48-0AEEF5D2D326}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{46218270-9523-4EB1-A9B5-C7BC53FDFF8E}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{85F3E4A2-15C8-41EC-92BB-340AF7B1161B}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{B59C9D50-D069-464B-9354-E0E731DB870A}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{BEF99B73-0EC2-4531-95BC-0698BAF6DE11}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{296695F5-CE7C-42DA-BA90-EB625B761037}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{AFA58BFB-D02D-4B4D-8A15-D5E4ECEEE7F4}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{BC1A36EC-AF3C-4BC1-AE02-F15959BD5A9B}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{48F3755A-C1BD-4737-8692-FA53999FC2F0}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{B2B3EDAD-6706-4920-957F-994A2E5A5E6F}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{404B00FE-8C05-46DD-B64E-684D259807FA}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{F7A4F39F-455B-4324-9998-DE37CF27FA7C}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7856427A-0158-403A-B4F6-0FFBAF4CA30A}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{71726E1E-4103-42D3-A5FC-346FF25A5333}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{1BEDCA8F-6C48-4666-BC82-AC5D32D051AB}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{E522369F-0D72-4779-BF24-3387B9A8AC35}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{AAAD6C8E-D7EB-462E-BFE9-0650D89DEE70}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{87D7A011-AF27-4D85-BDB5-AC070C7528F2}"= UDP:C:\Program Files\Sierra Entertainment\Empire Earth III\EE3.exe:Empire Earth III
"{C30D842F-EA92-4B5C-ADD4-936489C354A2}"= TCP:C:\Program Files\Sierra Entertainment\Empire Earth III\EE3.exe:Empire Earth III
"{E6E211F2-EA82-4E33-8116-ED44FBE344CB}"= UDP:C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat:La Bataille pour la Terre du Milieu ™ II
"{DECAC04E-905F-4CB2-9D31-8E8217FB975C}"= TCP:C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat:La Bataille pour la Terre du Milieu ™ II
"TCP Query User{0C8A3757-D26C-4EDC-A9F9-0F3AE35E18C6}C:\\program files\\electronic arts\\eadm\\core.exe"= UDP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{71379336-FA96-4F71-B0E8-9ED78CB52CA4}C:\\program files\\electronic arts\\eadm\\core.exe"= TCP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280]
R2 QPCapSvc;QuickPlay Background Capture Service (QBCS);C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [2007-09-30 271760]
R2 QPSched;QuickPlay Task Scheduler (QTS);C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [2007-09-30 112016]
R3 HpqRemHid;HP Remote Control HID Device;C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 7168]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4cb3f964-5675-11dd-ab3a-001e6863f1e1}]
\shell\AutoRun\command - F:\EE3AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0fe0534-7738-11dd-a822-001e6863f1e1}]
\shell\AutoRun\command - F:\Autorun.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-srvcomsys - C:\ProgramData\srvcomsys\lotifwzg.exe
HKCU-Run-lphc987j0e1wv - C:\Windows\system32\lphc987j0e1wv.exe
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\Valentin\AppData\Roaming\Mozilla\Firefox\Profiles\t6ehdmfs.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.fr/
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-07 11:16:10
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-09-07 11:17:16
ComboFix-quarantined-files.txt 2008-09-07 09:17:03

Pre-Run: 112,512,827,392 octets libres
Post-Run: 112,829,480,960 octets libres

262 --- E O F --- 2008-09-06 08:49:05

voici le rapport Hijack après la démarche que tu m'as dit de faire

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:45:27, on 08/09/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\ProgramData\webcmdwin\gzcdqrcj.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Users\Valentin\Downloads\HiJackThis(2).exe
C:\Windows\explorer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [z0aKb8nieO] C:\ProgramData\ufodidml\azgvwtsl.exe
O4 - HKCU\..\Run: [webcmdwin] C:\ProgramData\webcmdwin\gzcdqrcj.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

j'ai fait l'analyse ! voici le rapport Malwarebytes' Anti-Malware 1.26
Version de la base de données: 1112
Windows 6.0.6000

04/09/2008 09:57:51
mbam-log-2008-09-04 (09-57-51).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 247740
Temps écoulé: 1 hour(s), 26 minute(s), 26 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 27
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
C:\Users\Valentin\AppData\Local\Temp\a.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Users\Valentin\AppData\Local\Temp\a..exe (Trojan.FakeAlert) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphc987j0e1wv (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Somefox (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\Valentin\AppData\Local\Temp\a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\smartmonsys\xyvqvyji.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Valentin\AppData\Local\Temp\a..exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C'est tout ce que j'ai à faire ?

J'ai l'impression qu'il m'en reste un mais pas sûr

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:17:57, on 05/09/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\ProgramData\ufodidml\azgvwtsl.exe
C:\ProgramData\webcmdwin\gzcdqrcj.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Program Files\Hewlett-Packard\SDP\hpsdpapp.exe
C:\ProgramData\webcmdwin\gzcdqrcj.exe
C:\Users\Valentin\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [srvcomsys] C:\ProgramData\srvcomsys\lotifwzg.exe
O4 - HKCU\..\Run: [z0aKb8nieO] C:\ProgramData\ufodidml\azgvwtsl.exe
O4 - HKCU\..\Run: [webcmdwin] C:\ProgramData\webcmdwin\gzcdqrcj.exe
O4 - HKCU\..\Run: [lphc987j0e1wv] C:\Windows\system32\lphc987j0e1wv.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe