Virus micro antivirus 2008

Résolu
maryline2108 -  
Bonjour,

J'ai besoin d'aide.... J'ai été infecté par le Virus Micro AV.... je suis perdue je ne c pas comment faire. J'ai McAffee comment anti virus mais il ne la pas supprimé...
JE vous remercie par avance pour votre aide.

Une débutante en anti virus.

Maryline
Configuration: Windows XP
Firefox 3.0.1

40 réponses

Résumé de la discussion

Une utilisatrice signale une infection par le virus MicroAV sur Windows XP (Firefox 3.0.1) malgré McAfee, et cherche des solutions efficaces pour nettoyer le système. Des utilisateurs proposent FindyKill en mode sécurité et des rapports à poster, puis Malwarebytes Anti-Malware avec redémarrage en mode sans échec, et enfin des analyses via Avira et HijackThis. D'autres conseils préconisent la suppression de composants McAfee via sc delete McAfeeFramework, l'élimination d'outils non fiables comme ComboFix et Tools Cleaner, puis l'usage de rapports pour orienter la décontamination. En cas de doute, la discussion souligne l'importance de sauvegarder les rapports et de redémarrer en mode sans échec pour éviter de compromettre les outils de détection.

Bobot (l’IA à votre service)
  1. Destrio5 Modérateur
    Salut,

    - Télécharge HijackThis V 2.02 (HijackThis Installer) :
    http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

    - Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

    - Clique sur Install ensuite sur I Accept

    - Clique sur Do a scan system and save log file

    - Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
    0
    1. maryline2108
      Merci pour votre réponse rapide.
      J'ai voulu installer votre logiciel et il me met que ce n'est pas un Win32 valide.
      Au secours.......
      0
      1. Destrio5 Modérateur
        Bagle peut-être.

        --> Télécharge FindyKill sur ton bureau :
        http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

        --> Lance l'installation avec les paramètres par defaut

        --> Double-clique sur le raccourci FindyKill sur ton bureau

        --> Au menu principal, choisis l'option 1 (Recherche)

        --> Poste le rapport FindyKill.txt

        Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.
        0
        1. maryline2108
          Voici le resultat

          ----------------- FindyKill V3.095 ------------------

          * User : FAMILY DOLLARD Platform : Windows XP
          * Emplacement : C:\Program Files\FindyKill\FindyKill.exe
          * Outils Mis a jours le 20/09/08 par Chiquitine29
          * Recherche effectuée à 12:34:47 le 20/09/2008

          ----------------- *** Recherche *** ------------------

          »»»» Presence des fichiers dans C:

          »»»» Presence des fichiers dans C:\WINDOWS

          »»»» Presence des fichiers dans C:\WINDOWS\Prefetch

          Present ! - C:\WINDOWS\Prefetch\SETUP.EXE-13EB2E3D.pf
          Present ! - C:\WINDOWS\Prefetch\KEYGEN.EXE-321E87CE.pf

          »»»» Presence des fichiers dans C:\WINDOWS\system32

          »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

          »»»» Presence des fichiers dans C:\Documents and Settings\FAMILY DOLLARD\Application Data

          »»»» Presence des fichiers dans C:\DOCUME~1\FAMILY~1\LOCALS~1\Temp

          »»»» Registre :

          ! REG.EXE VERSION 3.0

          HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
          ATIPTA REG_SZ "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
          RTHDCPL REG_SZ RTHDCPL.EXE
          Alcmtr REG_SZ ALCMTR.EXE
          SynTPLpr REG_SZ C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
          SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
          LtMoh REG_SZ C:\Program Files\ltmoh\Ltmoh.exe
          AGRSMMSG REG_SZ AGRSMMSG.exe
          THotkey REG_SZ C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
          Tvs REG_SZ C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
          TPSMain REG_SZ TPSMain.exe
          SmoothView REG_SZ C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
          PadTouch REG_SZ C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
          DLA REG_SZ C:\WINDOWS\System32\DLA\DLACTRLW.EXE
          CFSServ.exe REG_SZ CFSServ.exe -NoClient
          OpwareSE2 REG_SZ "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
          ShStatEXE REG_SZ "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
          McAfeeUpdaterUI REG_SZ "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
          \YUR145.exe REG_SZ C:\Windows\system32\YUR145.exe
          \YUR146.exe REG_SZ C:\Windows\system32\YUR146.exe
          \YUR147.exe REG_SZ C:\Windows\system32\YUR147.exe
          \YUR148.exe REG_SZ C:\Windows\system32\YUR148.exe
          ANTIVIRUS REG_SZ C:\Program Files\MicroAV\MicroAV.exe
          \YUR3.exe REG_SZ C:\Windows\system32\YUR3.exe
          \YUR4.exe REG_SZ C:\Windows\system32\YUR4.exe
          \YUR6.exe REG_SZ C:\Windows\system32\YUR6.exe
          \YUR7.exe REG_SZ C:\Windows\system32\YUR7.exe
          BM2bcfe9d1 REG_SZ Rundll32.exe "C:\WINDOWS\system32\owvkgyyb.dll",s
          28fcda4d REG_SZ rundll32.exe "C:\WINDOWS\system32\qjqshldq.dll",b

          HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

          ! REG.EXE VERSION 3.0

          HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
          CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
          msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
          \YUR3.exe REG_SZ C:\Windows\system32\YUR3.exe
          \YUR4.exe REG_SZ C:\Windows\system32\YUR4.exe
          \YUR6.exe REG_SZ C:\Windows\system32\YUR6.exe
          \YUR7.exe REG_SZ C:\Windows\system32\YUR7.exe
          ANTIVIRUS REG_SZ C:\Program Files\MicroAV\MicroAV.exe

          »»»» Presence d infections dans Support amovible :

          ----------- ! Recherche realisée avec success ! -----------
          0
          2. Destrio5 Modérateur
            --> Branche tes disques amovibles à ton PC (clefs USB, disque dur externe, etc...) sans les ouvrir

            --> Double-clique sur le raccourci FindyKill sur ton bureau

            --> Au menu principal, choisis l'option 2 (Suppression)

            /!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

            --> Ensuite, poste le rapport FindyKill.txt

            Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.
            0
            1. maryline2108
              je ne possede que une cle USB c un ordi portable... ca va qd meme
              désolée pour c question qui peuvent paraitre bête...
              0
              1. Destrio5 Modérateur
                Tu peux lancer FindyKill.
                0
                1. maryline2108
                  CA Y EST JE PEUX A NOUVEAU ACCEDER AU SITE MAIS TJRS LES MM PROBLEMES...
                  fichier quality porn + MicroAV + Best zoo Pern..
                  je galere que faire....
                  je recommence findykill ?

                  Merci d'avance
                  0
                  1. Destrio5 Modérateur
                    - Télécharge et installe MalwareByte's Anti-Malware :
                    http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

                    - Mets-le à jour

                    - Redémarre en mode sans échec (Recommandé) :
                    https://www.malekal.com/demarrer-windows-mode-sans-echec/

                    - Choisis ta session habituelle

                    - Fais un scan complet avec MalwareByte's Anti-Malware

                    - Supprime tout ce que le logiciel trouve, enregistre le rapport

                    - Redémarre en mode normal et poste le rapport ici
                    0
                    1. maryline2108
                      Bjr

                      Voila le resultat en sachant que plus rien n'apparait son mon ordi
                      Dois-je faire encore quelque chose? Quel anti virus pour pu que ca m'arrive ?

                      Malwarebytes' Anti-Malware 1.28
                      Version de la base de données: 1182
                      Windows 5.1.2600 Service Pack 3

                      21/09/2008 07:29:54
                      mbam-log-2008-09-21 (07-29-54).txt

                      Type de recherche: Examen complet (C:\|)
                      Eléments examinés: 82337
                      Temps écoulé: 3 hour(s), 46 minute(s), 25 second(s)

                      Processus mémoire infecté(s): 0
                      Module(s) mémoire infecté(s): 2
                      Clé(s) du Registre infectée(s): 17
                      Valeur(s) du Registre infectée(s): 42
                      Elément(s) de données du Registre infecté(s): 2
                      Dossier(s) infecté(s): 1
                      Fichier(s) infecté(s): 27

                      Processus mémoire infecté(s):
                      (Aucun élément nuisible détecté)

                      Module(s) mémoire infecté(s):
                      C:\WINDOWS\system32\urqRIxur.dll (Trojan.Vundo.H) -> Delete on reboot.
                      C:\WINDOWS\system32\nnnkHbXN.dll (Trojan.Vundo) -> Delete on reboot.

                      Clé(s) du Registre infectée(s):
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo.H) -> Delete on reboot.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nnnkhbxn (Trojan.Vundo.H) -> Delete on reboot.
                      HKEY_CLASSES_ROOT\CLSID\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo.H) -> Delete on reboot.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7e97de64-94b9-4ecf-9c15-4dde0cad4f15} (Trojan.Vundo.H) -> Delete on reboot.
                      HKEY_CLASSES_ROOT\CLSID\{7e97de64-94b9-4ecf-9c15-4dde0cad4f15} (Trojan.Vundo.H) -> Delete on reboot.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

                      Valeur(s) du Registre infectée(s):
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\28fcda4d (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo) -> Delete on reboot.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur145.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur146.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur147.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur148.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yura.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur6.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yure.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur23.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur24.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur26.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yura.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur6.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yure.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur23.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur24.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur26.exe (Trojan.Agent) -> Quarantined and deleted successfully.

                      Elément(s) de données du Registre infecté(s):
                      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqrixur -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqrixur -> Delete on reboot.

                      Dossier(s) infecté(s):
                      C:\Program Files\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

                      Fichier(s) infecté(s):
                      C:\WINDOWS\system32\nnnkHbXN.dll (Trojan.Vundo.H) -> Delete on reboot.
                      C:\WINDOWS\system32\urqRIxur.dll (Trojan.Vundo.H) -> Delete on reboot.
                      C:\WINDOWS\system32\ruxIRqru.ini (Trojan.Vundo.H) -> Delete on reboot.
                      C:\WINDOWS\system32\ruxIRqru.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\aaflnjre.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\erjnlfaa.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                      C:\System Volume Information\_restore{7C613A87-BF99-4606-961B-887F813D12F7}\RP43\A0015129.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                      C:\System Volume Information\_restore{7C613A87-BF99-4606-961B-887F813D12F7}\RP45\A0016191.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                      C:\System Volume Information\_restore{7C613A87-BF99-4606-961B-887F813D12F7}\RP45\A0017184.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\nnnnMExV.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\qjqshldq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
                      C:\Program Files\MicroAV\MicroAV.exe (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                      C:\Program Files\MicroAV\MicroAV.ooo (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                      C:\Program Files\MicroAV\MicroAV0.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                      C:\Program Files\MicroAV\MicroAV1.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\YUR145.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\YUR146.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\YUR147.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\YUR148.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\YUR25.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\YUR26.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Quarantined and deleted successfully.
                      C:\WINDOWS\BM2bcfe9d1.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
                      C:\WINDOWS\BM2bcfe9d1.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
                      C:\x (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                      C:\Documents and Settings\FAMILY DOLLARD\Bureau\BEST ZOO PORN.url (Rogue.Link) -> Quarantined and deleted successfully.
                      C:\Documents and Settings\FAMILY DOLLARD\Bureau\QUALITY PORN.url (Rogue.Link) -> Quarantined and deleted successfully.
                      0
                      1. Destrio5 Modérateur
                        ---> Relance MBAM, va dans Quarantaine et supprime tout

                        ---> Fais ceci :

                        - Télécharge HijackThis V 2.02 (HijackThis Installer) :
                        http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

                        - Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

                        - Clique sur Install ensuite sur I Accept

                        - Clique sur Do a scan system and save log file

                        - Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
                        0
                        1. maryline2108
                          Voici la reponse

                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 11:30:38, on 21/09/2008
                          Platform: Windows XP SP3 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\Ati2evxx.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\Ati2evxx.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\WINDOWS\system32\acs.exe
                          C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\McAfee\Common Framework\FrameworkService.exe
                          C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                          C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                          C:\WINDOWS\system32\wscntfy.exe
                          C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                          C:\WINDOWS\RTHDCPL.EXE
                          C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                          C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                          C:\Program Files\ltmoh\Ltmoh.exe
                          C:\WINDOWS\AGRSMMSG.exe
                          C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                          C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
                          C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
                          C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
                          C:\WINDOWS\System32\DLA\DLACTRLW.EXE
                          C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
                          C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
                          C:\Program Files\McAfee\Common Framework\UdaterUI.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                          C:\Program Files\McAfee\Common Framework\McTray.exe
                          C:\WINDOWS\system32\TPSBattM.exe
                          C:\Program Files\Mozilla Firefox\firefox.exe
                          C:\Program Files\LimeWire\LimeWire.exe
                          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.6play.fr/m6#/choisir-par-genre
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                          O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
                          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                          O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                          O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
                          O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                          O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                          O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                          O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                          O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
                          O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                          O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                          O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
                          O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
                          O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
                          O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
                          O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
                          O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
                          O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
                          O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
                          O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
                          O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                          O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                          O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                          O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
                          O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                          O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                          O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                          O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                          O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://maryline2108.spaces.live.com/PhotoUpload/MsnPUpld.cab
                          O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                          O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
                          O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                          O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                          O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
                          O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                          O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                          O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                          0
                          1. Destrio5 Modérateur
                            ---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
                            http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                            /!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

                            ---> Double-clique sur Combofix.exe
                            Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
                            Accepte en cliquant sur "Oui"

                            ---> Mets-le en langue française F
                            Tape sur la touche 1 (Yes) pour démarrer le scan.

                            /!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

                            En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

                            Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

                            /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

                            Note : Le rapport se trouve également là : C:\ComboFix.txt
                            0
                            1. maryline2108
                              voici la réponse

                              ComboFix 08-09-20.05 - FAMILY DOLLARD 2008-09-21 12:38:31.1 - NTFSx86
                              Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.192 [GMT 2:00]
                              Lancé depuis: C:\Documents and Settings\FAMILY DOLLARD\Bureau\ComboFix.exe
                              * Un nouveau point de restauration a été créé

                              [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                              .

                              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                              .

                              C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
                              C:\InfoSat.txt
                              C:\WINDOWS\temp\perflib_perfdata_1cc.dat

                              .
                              ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                              .

                              -------\Legacy_TDSSSERV

                              ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-21 au 2008-09-21 ))))))))))))))))))))))))))))))))))))
                              .

                              2008-09-21 11:30 . 2008-09-21 11:30 <REP> d-------- C:\Program Files\Trend Micro
                              2008-09-20 22:59 . 2008-09-20 22:59 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
                              2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                              2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Malwarebytes
                              2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                              2008-09-20 22:17 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                              2008-09-20 22:17 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                              2008-09-20 18:23 . 2008-09-20 18:27 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
                              2008-09-20 18:23 . 2008-09-20 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                              2008-09-20 18:17 . 2008-09-20 18:17 <REP> d-------- C:\Program Files\Lavasoft
                              2008-09-20 18:17 . 2008-09-20 18:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
                              2008-09-20 18:16 . 2008-09-20 18:16 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
                              2008-09-20 16:48 . 2008-09-20 17:33 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
                              2008-09-20 16:46 . 2008-09-20 16:48 <REP> d-------- C:\Program Files\Trojan Remover
                              2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Simply Super Software
                              2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software
                              2008-09-20 16:46 . 2006-05-25 15:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
                              2008-09-20 16:46 . 2003-02-02 20:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
                              2008-09-20 16:46 . 2005-08-26 01:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
                              2008-09-20 16:46 . 2002-03-06 01:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
                              2008-09-20 16:46 . 2006-06-19 13:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
                              2008-09-20 16:42 . 2008-09-20 16:42 65 --a------ C:\WINDOWS\system32\28fcc8c3
                              2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
                              2008-09-20 16:34 . 2008-08-28 14:34 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage r‚seau
                              2008-09-20 16:34 . 2005-12-09 08:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
                              2008-09-20 16:34 . 2008-08-28 19:46 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
                              2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
                              2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
                              2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
                              2008-09-20 16:34 . 2005-12-12 12:16 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
                              2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\toshiba
                              2008-09-20 16:34 . 2005-12-09 12:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
                              2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sonic
                              2008-09-20 16:34 . 2008-09-20 16:34 <REP> d-------- C:\Documents and Settings\Administrateur
                              2008-09-20 12:33 . 2008-09-20 14:04 <REP> d-------- C:\Program Files\FindyKill
                              2008-09-20 12:07 . 2008-09-20 12:07 97,280 --a------ C:\WINDOWS\system32\owvkgyyb.dll
                              2008-09-20 12:06 . 2008-09-20 12:06 257,536 --a------ C:\WINDOWS\system32\jkkiIbYs.dll.vir
                              2008-09-19 20:34 . 2008-09-19 20:34 <REP> d-------- C:\Program Files\Windows Media Connect 2
                              2008-09-19 20:27 . 2008-09-19 20:27 <REP> d-------- C:\WINDOWS\system32\LogFiles
                              2008-09-19 20:27 . 2008-09-19 20:30 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
                              2008-09-19 19:56 . 2008-09-21 10:47 <REP> d-------- C:\QUARANTINE
                              2008-09-19 13:39 . 2008-09-19 13:39 <REP> d--h----- C:\WINDOWS\PIF
                              2008-09-19 12:52 . 2008-09-19 12:55 <REP> d-------- C:\Program Files\PhotoFiltre
                              2008-09-18 14:44 . 2008-09-18 14:45 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
                              2008-09-18 13:50 . 2008-09-18 14:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\AdobeUM
                              2008-09-18 13:30 . 2008-09-18 13:30 <REP> d-------- C:\Program Files\Alice
                              2008-09-18 13:29 . 2008-09-18 13:29 268 --ah----- C:\sqmdata02.sqm
                              2008-09-18 13:29 . 2008-09-18 13:29 244 --ah----- C:\sqmnoopt02.sqm
                              2008-09-18 13:23 . 2008-09-18 13:23 268 --ah----- C:\sqmdata01.sqm
                              2008-09-18 13:23 . 2008-09-18 13:23 244 --ah----- C:\sqmnoopt01.sqm
                              2008-09-16 10:18 . 2008-09-16 10:18 268 --ah----- C:\sqmdata00.sqm
                              2008-09-16 10:18 . 2008-09-16 10:18 244 --ah----- C:\sqmnoopt00.sqm
                              2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\Fichiers communs\Cisco Systems
                              2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
                              2008-09-12 17:24 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
                              2008-09-12 17:24 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
                              2008-09-12 17:23 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\McAfee
                              2008-09-12 17:23 . 2008-09-12 17:23 <REP> d-------- C:\Program Files\Fichiers communs\McAfee
                              2008-09-12 17:23 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
                              2008-09-12 17:23 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
                              2008-09-12 17:23 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
                              2008-09-12 17:23 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
                              2008-09-12 17:23 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
                              2008-09-06 13:59 . 2008-09-12 16:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Canon
                              2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr
                              2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\bits
                              2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\l2schemas
                              2008-09-06 11:56 . 2008-09-06 12:01 <REP> d-------- C:\WINDOWS\ServicePackFiles
                              2008-09-06 11:48 . 2008-09-06 11:48 <REP> d-------- C:\WINDOWS\EHome
                              2008-09-03 15:13 . 2008-09-03 15:13 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Media Player Classic
                              2008-09-03 15:11 . 2008-09-03 15:11 <REP> d-------- C:\Program Files\K-Lite Codec Pack
                              2008-09-03 14:41 . 2008-09-03 14:41 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\divx_3.22b
                              2008-09-01 14:34 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
                              2008-09-01 14:34 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
                              2008-09-01 14:34 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
                              2008-09-01 14:34 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
                              2008-09-01 14:34 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
                              2008-09-01 14:34 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
                              2008-09-01 14:34 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
                              2008-09-01 14:34 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
                              2008-09-01 14:34 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
                              2008-09-01 14:33 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr-fr
                              2008-09-01 14:26 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
                              2008-08-31 03:21 . 2008-08-31 03:21 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
                              2008-08-30 13:44 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
                              2008-08-30 13:44 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
                              2008-08-30 13:44 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
                              2008-08-29 19:03 . 2008-08-29 19:03 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
                              2008-08-29 19:02 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7J.DLL
                              2008-08-29 19:02 . 2008-04-13 20:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
                              2008-08-29 19:02 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
                              2008-08-29 19:02 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
                              2008-08-29 19:02 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7J.DLL
                              2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\ScanSoft
                              2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanWizard
                              2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
                              2008-08-29 15:21 . 2008-08-29 15:21 532 --a------ C:\WINDOWS\MAXLINK.INI
                              2008-08-29 15:20 . 2008-08-29 15:20 <REP> d-------- C:\Program Files\ScanSoft
                              2008-08-29 15:20 . 2008-08-29 15:21 <REP> d-------- C:\Program Files\Fichiers communs\ScanSoft Shared
                              2008-08-29 15:12 . 2008-09-10 22:40 <REP> d-------- C:\WINDOWS\CAVTemp
                              2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
                              2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\CanonMP
                              2008-08-29 15:11 . 2005-08-04 03:46 221,184 --a------ C:\WINDOWS\system32\CNCC170.DLL
                              2008-08-29 15:11 . 2005-05-30 12:46 139,264 --a------ C:\WINDOWS\system32\CNCL170.DLL
                              2008-08-29 15:11 . 2005-08-04 03:46 69,632 --a------ C:\WINDOWS\system32\CNCI170.DLL
                              2008-08-29 15:11 . 2005-08-04 03:47 49,152 --a------ C:\WINDOWS\system32\cncisco.dll
                              2008-08-29 15:09 . 2008-08-29 15:12 <REP> d-------- C:\Program Files\Canon
                              2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
                              2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys
                              2008-08-29 14:29 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Favorites
                              2008-08-29 14:28 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Toolbar
                              2008-08-29 14:27 . 2008-08-30 00:04 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Contacts
                              2008-08-29 14:27 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
                              2008-08-29 14:26 . 2008-08-29 14:26 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
                              2008-08-29 14:25 . 2008-08-29 14:25 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
                              2008-08-29 14:21 . 2008-08-31 03:04 <REP> d-------- C:\Program Files\Windows Live
                              2008-08-29 14:21 . 2008-08-29 14:23 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
                              2008-08-29 14:20 . 2008-08-29 14:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
                              2008-08-28 18:05 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
                              2008-08-28 18:03 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
                              2008-08-28 18:03 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
                              2008-08-28 17:14 . 2004-08-04 00:38 327,168 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys
                              2008-08-28 16:57 . 2008-09-21 12:34 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\LimeWire
                              2008-08-28 16:56 . 2008-08-28 16:57 <REP> d-------- C:\Program Files\LimeWire
                              2008-08-28 16:50 . 2008-08-28 16:50 0 --a------ C:\WINDOWS\nsreg.dat

                              .
                              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              2008-08-28 18:18 --------- d-----w C:\Program Files\TOSHIBA
                              2008-08-28 18:17 --------- d-----w C:\Program Files\Synaptics
                              2008-08-28 18:16 --------- d---a-w C:\Program Files\Offre Wanadoo
                              2008-08-28 18:16 --------- d-----w C:\Program Files\Sonic
                              2008-08-28 18:16 --------- d-----w C:\Program Files\Services en ligne
                              2008-08-28 18:16 --------- d-----w C:\Program Files\Realtek
                              2008-08-28 18:14 --------- d-----w C:\Program Files\Microsoft.NET
                              2008-08-28 18:13 --------- d-----w C:\Program Files\microsoft frontpage
                              2008-08-28 18:13 --------- d-----w C:\Program Files\ltmoh
                              2008-08-28 18:12 --------- d-----w C:\Program Files\Java
                              2008-08-28 18:12 --------- d-----w C:\Program Files\InterVideo
                              2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\Java
                              2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
                              2008-08-28 18:06 --------- d-----w C:\Program Files\ATI Technologies
                              2008-08-28 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\SBSI
                              2008-08-28 13:57 --------- d-----w C:\Program Files\Symantec
                              2008-08-28 13:39 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
                              2008-08-28 13:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
                              2008-08-28 13:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
                              2008-08-28 12:32 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
                              2008-08-28 12:32 --------- d-----w C:\Program Files\Atheros
                              2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
                              2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
                              2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
                              2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
                              2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
                              2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
                              2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
                              2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
                              2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
                              2008-07-18 20:08 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
                              2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
                              2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
                              2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                              2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
                              2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
                              .

                              ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              .
                              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                              REGEDIT4

                              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
                              "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
                              "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
                              "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-15 98394]
                              "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-15 688218]
                              "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-19 188416]
                              "THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-12-08 352256]
                              "Tvs"="C:\Program Files\TOSHIBA\Tvs\TvsTray.exe" [2005-11-30 73728]
                              "SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2005-05-17 118784]
                              "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-08-30 1077328]
                              "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-01 122940]
                              "OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
                              "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
                              "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
                              "TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-09-15 920144]
                              "RTHDCPL"="RTHDCPL.EXE" [2005-11-10 C:\WINDOWS\RTHDCPL.exe]
                              "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 C:\WINDOWS\agrsmmsg.exe]
                              "TPSMain"="TPSMain.exe" [2005-08-03 C:\WINDOWS\system32\TPSMain.exe]
                              "CFSServ.exe"="CFSServ.exe" [BU]

                              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                              "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                              "VIDC.YV12"= yv12vfw.dll

                              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys]
                              @=""

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                              "%windir%\\system32\\sessmgr.exe"=
                              "C:\\Program Files\\Messenger\\msmsgs.exe"=
                              "C:\\Program Files\\LimeWire\\LimeWire.exe"=
                              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                              "C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

                              .
                              Contenu du dossier 'Tâches planifiées'
                              .
                              .
                              ------- Examen supplémentaire -------
                              .
                              FireFox -: Profile - C:\Documents and Settings\FAMILY DOLLARD\Application Data\Mozilla\Firefox\Profiles\6lmz0wdh.default\
                              FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
                              FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava11.dll
                              FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava12.dll
                              FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava13.dll
                              FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava14.dll
                              FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava32.dll
                              FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
                              FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPOJI610.dll
                              FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
                              FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
                              .

                              **************************************************************************

                              catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                              Rootkit scan 2008-09-21 12:43:50
                              Windows 5.1.2600 Service Pack 3 NTFS

                              Recherche de processus cachés ...

                              Recherche d'éléments en démarrage automatique cachés ...

                              Recherche de fichiers cachés ...

                              Scan terminé avec succès
                              Fichiers cachés: 0

                              **************************************************************************
                              .
                              ------------------------ Autres processus actifs ------------------------
                              .
                              C:\WINDOWS\system32\ati2evxx.exe
                              C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                              C:\WINDOWS\system32\ati2evxx.exe
                              C:\WINDOWS\system32\acs.exe
                              C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                              C:\Program Files\McAfee\Common Framework\FrameworkService.exe
                              C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                              C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                              C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                              C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
                              C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
                              C:\Program Files\McAfee\Common Framework\Mctray.exe
                              C:\WINDOWS\system32\TPSBattM.exe
                              C:\WINDOWS\system32\wscntfy.exe
                              .
                              **************************************************************************
                              .
                              Heure de fin: 2008-09-21 12:48:34 - La machine a redémarré
                              ComboFix-quarantined-files.txt 2008-09-21 10:48:25

                              Avant-CF: 55ÿ989ÿ051ÿ392 octets libres
                              Après-CF: 55,961,808,896 octets libres

                              275 --- E O F --- 2008-09-20 15:53:01
                              0
                              1. Destrio5 Modérateur
                                /!\ Seul maryline2108 peut suivre cette procédure /!\

                                1/

                                ---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

                                ---> Copie le texte ci-dessous par sélection puis Ctrl+C :

                                KillAll::

                                File::
                                C:\WINDOWS\system32\tdssinit.dll
                                C:\WINDOWS\system32\drivers\TDSSjcxe.sys
                                C:\WINDOWS\system32\drivers\tdsserv.sys
                                C:\WINDOWS\system32\tdssadw.dll
                                C:\WINDOWS\system32\TDSSerrors.log
                                C:\WINDOWS\system32\tdssl.dll
                                C:\WINDOWS\system32\tdssmain.dll
                                C:\WINDOWS\system32\tdssservers.dat
                                C:\WINDOWS\system32\epoPGPsdk.dll.sig
                                C:\WINDOWS\system32\epoPGPsdk.dll
                                C:\WINDOWS\system32\jkkiIbYs.dll.vir
                                C:\WINDOWS\system32\owvkgyyb.dll

                                Registry::
                                [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys]

                                ---> Colle la sélection dans le bloc-notes

                                ---> Enregistre ce fichier sur le bureau (Impératif)

                                ---> Nom du fichier : CFScript
                                ---> Type du fichier : tous les fichiers
                                ---> Clique sur Enregistrer
                                ---> Quitte le bloc-notes

                                2/

                                ---> Redémarre en mode sans échec

                                ---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
                                http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

                                [*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

                                [*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
                                Ne touche à rien tant que le scan n'est pas terminé.

                                [*] Une fois le scan achevé, un rapport va s'afficher : poste-le

                                [*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt
                                0
                                1. maryline2108
                                  voila le resultat

                                  ComboFix 08-09-20.05 - FAMILY DOLLARD 2008-09-21 13:22:10.2 - NTFSx86 MINIMAL
                                  Lancé depuis: C:\Documents and Settings\FAMILY DOLLARD\Bureau\ComboFix.exe
                                  Commutateurs utilisés :: C:\Documents and Settings\FAMILY DOLLARD\Bureau\CFScript.txt

                                  [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                                  FILE ::
                                  C:\WINDOWS\system32\drivers\tdsserv.sys
                                  C:\WINDOWS\system32\drivers\TDSSjcxe.sys
                                  C:\WINDOWS\system32\epoPGPsdk.dll
                                  C:\WINDOWS\system32\epoPGPsdk.dll.sig
                                  C:\WINDOWS\system32\jkkiIbYs.dll.vir
                                  C:\WINDOWS\system32\owvkgyyb.dll
                                  C:\WINDOWS\system32\tdssadw.dll
                                  C:\WINDOWS\system32\TDSSerrors.log
                                  C:\WINDOWS\system32\tdssinit.dll
                                  C:\WINDOWS\system32\tdssl.dll
                                  C:\WINDOWS\system32\tdssmain.dll
                                  C:\WINDOWS\system32\tdssservers.dat
                                  .

                                  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                                  .

                                  C:\WINDOWS\system32\epoPGPsdk.dll
                                  C:\WINDOWS\system32\epoPGPsdk.dll.sig
                                  C:\WINDOWS\system32\jkkiIbYs.dll.vir
                                  C:\WINDOWS\system32\owvkgyyb.dll

                                  .
                                  ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-21 au 2008-09-21 ))))))))))))))))))))))))))))))))))))
                                  .

                                  2008-09-21 11:30 . 2008-09-21 11:30 <REP> d-------- C:\Program Files\Trend Micro
                                  2008-09-20 22:59 . 2008-09-20 22:59 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
                                  2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                                  2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Malwarebytes
                                  2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                                  2008-09-20 22:17 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                                  2008-09-20 22:17 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                                  2008-09-20 18:23 . 2008-09-20 18:27 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
                                  2008-09-20 18:23 . 2008-09-20 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                                  2008-09-20 18:17 . 2008-09-20 18:17 <REP> d-------- C:\Program Files\Lavasoft
                                  2008-09-20 18:17 . 2008-09-20 18:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
                                  2008-09-20 18:16 . 2008-09-20 18:16 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
                                  2008-09-20 16:48 . 2008-09-20 17:33 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
                                  2008-09-20 16:46 . 2008-09-20 16:48 <REP> d-------- C:\Program Files\Trojan Remover
                                  2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Simply Super Software
                                  2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software
                                  2008-09-20 16:46 . 2006-05-25 15:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
                                  2008-09-20 16:46 . 2003-02-02 20:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
                                  2008-09-20 16:46 . 2005-08-26 01:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
                                  2008-09-20 16:46 . 2002-03-06 01:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
                                  2008-09-20 16:46 . 2006-06-19 13:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
                                  2008-09-20 16:42 . 2008-09-20 16:42 65 --a------ C:\WINDOWS\system32\28fcc8c3
                                  2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
                                  2008-09-20 16:34 . 2008-08-28 14:34 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage r‚seau
                                  2008-09-20 16:34 . 2005-12-09 08:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
                                  2008-09-20 16:34 . 2008-08-28 19:46 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
                                  2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
                                  2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
                                  2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
                                  2008-09-20 16:34 . 2005-12-12 12:16 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
                                  2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\toshiba
                                  2008-09-20 16:34 . 2005-12-09 12:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
                                  2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sonic
                                  2008-09-20 16:34 . 2008-09-20 16:34 <REP> d-------- C:\Documents and Settings\Administrateur
                                  2008-09-20 12:33 . 2008-09-20 14:04 <REP> d-------- C:\Program Files\FindyKill
                                  2008-09-19 20:34 . 2008-09-19 20:34 <REP> d-------- C:\Program Files\Windows Media Connect 2
                                  2008-09-19 20:27 . 2008-09-19 20:27 <REP> d-------- C:\WINDOWS\system32\LogFiles
                                  2008-09-19 20:27 . 2008-09-19 20:30 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
                                  2008-09-19 19:56 . 2008-09-21 10:47 <REP> d-------- C:\QUARANTINE
                                  2008-09-19 13:39 . 2008-09-19 13:39 <REP> d--h----- C:\WINDOWS\PIF
                                  2008-09-19 12:52 . 2008-09-19 12:55 <REP> d-------- C:\Program Files\PhotoFiltre
                                  2008-09-18 14:44 . 2008-09-18 14:45 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
                                  2008-09-18 13:50 . 2008-09-18 14:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\AdobeUM
                                  2008-09-18 13:30 . 2008-09-18 13:30 <REP> d-------- C:\Program Files\Alice
                                  2008-09-18 13:29 . 2008-09-18 13:29 268 --ah----- C:\sqmdata02.sqm
                                  2008-09-18 13:29 . 2008-09-18 13:29 244 --ah----- C:\sqmnoopt02.sqm
                                  2008-09-18 13:23 . 2008-09-18 13:23 268 --ah----- C:\sqmdata01.sqm
                                  2008-09-18 13:23 . 2008-09-18 13:23 244 --ah----- C:\sqmnoopt01.sqm
                                  2008-09-16 10:18 . 2008-09-16 10:18 268 --ah----- C:\sqmdata00.sqm
                                  2008-09-16 10:18 . 2008-09-16 10:18 244 --ah----- C:\sqmnoopt00.sqm
                                  2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\Fichiers communs\Cisco Systems
                                  2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
                                  2008-09-12 17:23 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\McAfee
                                  2008-09-12 17:23 . 2008-09-12 17:23 <REP> d-------- C:\Program Files\Fichiers communs\McAfee
                                  2008-09-12 17:23 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
                                  2008-09-12 17:23 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
                                  2008-09-12 17:23 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
                                  2008-09-12 17:23 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
                                  2008-09-12 17:23 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
                                  2008-09-06 13:59 . 2008-09-12 16:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Canon
                                  2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr
                                  2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\bits
                                  2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\l2schemas
                                  2008-09-06 11:56 . 2008-09-06 12:01 <REP> d-------- C:\WINDOWS\ServicePackFiles
                                  2008-09-06 11:48 . 2008-09-06 11:48 <REP> d-------- C:\WINDOWS\EHome
                                  2008-09-03 15:13 . 2008-09-03 15:13 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Media Player Classic
                                  2008-09-03 15:11 . 2008-09-03 15:11 <REP> d-------- C:\Program Files\K-Lite Codec Pack
                                  2008-09-03 14:41 . 2008-09-03 14:41 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\divx_3.22b
                                  2008-09-01 14:34 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
                                  2008-09-01 14:34 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
                                  2008-09-01 14:34 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
                                  2008-09-01 14:34 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
                                  2008-09-01 14:34 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
                                  2008-09-01 14:34 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
                                  2008-09-01 14:34 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
                                  2008-09-01 14:34 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
                                  2008-09-01 14:34 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
                                  2008-09-01 14:33 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr-fr
                                  2008-09-01 14:26 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
                                  2008-08-31 03:21 . 2008-08-31 03:21 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
                                  2008-08-30 13:44 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
                                  2008-08-30 13:44 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
                                  2008-08-30 13:44 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
                                  2008-08-29 19:03 . 2008-08-29 19:03 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
                                  2008-08-29 19:02 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7J.DLL
                                  2008-08-29 19:02 . 2008-04-13 20:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
                                  2008-08-29 19:02 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
                                  2008-08-29 19:02 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
                                  2008-08-29 19:02 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7J.DLL
                                  2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\ScanSoft
                                  2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanWizard
                                  2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
                                  2008-08-29 15:21 . 2008-08-29 15:21 532 --a------ C:\WINDOWS\MAXLINK.INI
                                  2008-08-29 15:20 . 2008-08-29 15:20 <REP> d-------- C:\Program Files\ScanSoft
                                  2008-08-29 15:20 . 2008-08-29 15:21 <REP> d-------- C:\Program Files\Fichiers communs\ScanSoft Shared
                                  2008-08-29 15:12 . 2008-09-10 22:40 <REP> d-------- C:\WINDOWS\CAVTemp
                                  2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
                                  2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\CanonMP
                                  2008-08-29 15:11 . 2005-08-04 03:46 221,184 --a------ C:\WINDOWS\system32\CNCC170.DLL
                                  2008-08-29 15:11 . 2005-05-30 12:46 139,264 --a------ C:\WINDOWS\system32\CNCL170.DLL
                                  2008-08-29 15:11 . 2005-08-04 03:46 69,632 --a------ C:\WINDOWS\system32\CNCI170.DLL
                                  2008-08-29 15:11 . 2005-08-04 03:47 49,152 --a------ C:\WINDOWS\system32\cncisco.dll
                                  2008-08-29 15:09 . 2008-08-29 15:12 <REP> d-------- C:\Program Files\Canon
                                  2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
                                  2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys
                                  2008-08-29 14:29 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Favorites
                                  2008-08-29 14:28 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Toolbar
                                  2008-08-29 14:27 . 2008-08-30 00:04 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Contacts
                                  2008-08-29 14:27 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
                                  2008-08-29 14:26 . 2008-08-29 14:26 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
                                  2008-08-29 14:25 . 2008-08-29 14:25 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
                                  2008-08-29 14:21 . 2008-08-31 03:04 <REP> d-------- C:\Program Files\Windows Live
                                  2008-08-29 14:21 . 2008-08-29 14:23 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
                                  2008-08-29 14:20 . 2008-08-29 14:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
                                  2008-08-28 18:05 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
                                  2008-08-28 18:03 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
                                  2008-08-28 18:03 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
                                  2008-08-28 17:14 . 2004-08-04 00:38 327,168 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys
                                  2008-08-28 16:57 . 2008-09-21 13:12 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\LimeWire
                                  2008-08-28 16:56 . 2008-08-28 16:57 <REP> d-------- C:\Program Files\LimeWire
                                  2008-08-28 16:50 . 2008-08-28 16:50 0 --a------ C:\WINDOWS\nsreg.dat
                                  2008-08-28 16:48 . 2008-06-14 19:33 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
                                  2008-08-28 16:48 . 2008-06-14 19:33 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
                                  2008-08-28 16:44 . 2008-07-18 22:10 45,768 --a------ C:\WINDOWS\system32\wups2.dll
                                  2008-08-28 16:44 . 2008-07-18 22:10 38,088 --a------ C:\WINDOWS\system32\wucltui.dll.mui

                                  .
                                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                  .
                                  2008-08-28 18:18 --------- d-----w C:\Program Files\TOSHIBA
                                  2008-08-28 18:17 --------- d-----w C:\Program Files\Synaptics
                                  2008-08-28 18:16 --------- d---a-w C:\Program Files\Offre Wanadoo
                                  2008-08-28 18:16 --------- d-----w C:\Program Files\Sonic
                                  2008-08-28 18:16 --------- d-----w C:\Program Files\Services en ligne
                                  2008-08-28 18:16 --------- d-----w C:\Program Files\Realtek
                                  2008-08-28 18:14 --------- d-----w C:\Program Files\Microsoft.NET
                                  2008-08-28 18:13 --------- d-----w C:\Program Files\microsoft frontpage
                                  2008-08-28 18:13 --------- d-----w C:\Program Files\ltmoh
                                  2008-08-28 18:12 --------- d-----w C:\Program Files\Java
                                  2008-08-28 18:12 --------- d-----w C:\Program Files\InterVideo
                                  2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\Java
                                  2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
                                  2008-08-28 18:06 --------- d-----w C:\Program Files\ATI Technologies
                                  2008-08-28 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\SBSI
                                  2008-08-28 13:57 --------- d-----w C:\Program Files\Symantec
                                  2008-08-28 13:39 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
                                  2008-08-28 13:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
                                  2008-08-28 13:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
                                  2008-08-28 12:32 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
                                  2008-08-28 12:32 --------- d-----w C:\Program Files\Atheros
                                  2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
                                  .

                                  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                                  .
                                  .
                                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                                  REGEDIT4

                                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
                                  "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
                                  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                  "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
                                  "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-15 98394]
                                  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-15 688218]
                                  "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-19 188416]
                                  "THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-12-08 352256]
                                  "Tvs"="C:\Program Files\TOSHIBA\Tvs\TvsTray.exe" [2005-11-30 73728]
                                  "SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2005-05-17 118784]
                                  "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-08-30 1077328]
                                  "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-01 122940]
                                  "OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
                                  "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
                                  "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
                                  "TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-09-15 920144]
                                  "MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 172544]
                                  "RTHDCPL"="RTHDCPL.EXE" [2005-11-10 C:\WINDOWS\RTHDCPL.exe]
                                  "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 C:\WINDOWS\agrsmmsg.exe]
                                  "TPSMain"="TPSMain.exe" [2005-08-03 C:\WINDOWS\system32\TPSMain.exe]
                                  "CFSServ.exe"="CFSServ.exe" [BU]

                                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                                  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                                  "VIDC.YV12"= yv12vfw.dll

                                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                  "%windir%\\system32\\sessmgr.exe"=
                                  "C:\\Program Files\\Messenger\\msmsgs.exe"=
                                  "C:\\Program Files\\LimeWire\\LimeWire.exe"=
                                  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                                  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                                  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                                  "C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

                                  .
                                  Contenu du dossier 'Tâches planifiées'
                                  .

                                  **************************************************************************

                                  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                  Rootkit scan 2008-09-21 13:32:29
                                  Windows 5.1.2600 Service Pack 3 NTFS

                                  Recherche de processus cachés ...

                                  Recherche d'éléments en démarrage automatique cachés ...

                                  Recherche de fichiers cachés ...

                                  Scan terminé avec succès
                                  Fichiers cachés: 0

                                  **************************************************************************
                                  .
                                  Heure de fin: 2008-09-21 13:39:07 - La machine a redémarré
                                  ComboFix-quarantined-files.txt 2008-09-21 11:38:55
                                  ComboFix2.txt 2008-09-21 10:48:36

                                  Avant-CF: 55ÿ964ÿ999ÿ680 octets libres
                                  Après-CF: 55,952,515,072 octets libres

                                  237 --- E O F --- 2008-09-20 15:53:01
                                  0
                                  2. maryline2108
                                    VOILA LE RESULTAT

                                    Logfile of Trend Micro HijackThis v2.0.2
                                    Scan saved at 16:40:49, on 21/09/2008
                                    Platform: Windows XP SP3 (WinNT 5.01.2600)
                                    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                                    Boot mode: Normal

                                    Running processes:
                                    C:\WINDOWS\System32\smss.exe
                                    C:\WINDOWS\system32\winlogon.exe
                                    C:\WINDOWS\system32\services.exe
                                    C:\WINDOWS\system32\lsass.exe
                                    C:\WINDOWS\system32\Ati2evxx.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\WINDOWS\system32\Ati2evxx.exe
                                    C:\WINDOWS\Explorer.EXE
                                    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                                    C:\WINDOWS\system32\spoolsv.exe
                                    C:\WINDOWS\system32\acs.exe
                                    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                                    C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                                    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                    C:\WINDOWS\RTHDCPL.EXE
                                    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                                    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                    C:\Program Files\ltmoh\Ltmoh.exe
                                    C:\WINDOWS\AGRSMMSG.exe
                                    C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                                    C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
                                    C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
                                    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
                                    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
                                    C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
                                    C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
                                    C:\WINDOWS\system32\ctfmon.exe
                                    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                    C:\WINDOWS\system32\TPSBattM.exe
                                    C:\Program Files\LimeWire\LimeWire.exe
                                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                                    C:\Program Files\Mozilla Firefox\firefox.exe

                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.6play.fr/m6#/choisir-par-genre
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
                                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
                                    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                                    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
                                    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                    O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
                                    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                                    O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                                    O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
                                    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
                                    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
                                    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
                                    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
                                    O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
                                    O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
                                    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
                                    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
                                    O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
                                    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                                    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                                    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                                    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                                    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                                    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                                    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://maryline2108.spaces.live.com/PhotoUpload/MsnPUpld.cab
                                    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                                    O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
                                    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                                    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
                                    O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                                    O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                                    O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                                    0
                                    1. maryline2108
                                      qd j'allume mon PC une fenetre s'ouvre
                                      UdaterUl.exe - Composant introuvable car epoPGPSDK.dll est introuvable.
                                      .....Kesako ?
                                      0
                                      1. Destrio5 Modérateur
                                        C'est McAfee, tu devrais le virer et installer Antivir à la place.
                                        0
                                        • 1
                                        • 2

                                        Discussions similaires

                                        Impossible d'être entendu avec casque-micro Nintendo switch
                                        kardeyo

                                        3 réponses
                                        Comment obtenir le caractère µ sur le clavier Androïd
                                        marsupilami1947

                                        4 réponses
                                        Softonic,est-ce un virus ?
                                        techmel1

                                        6 réponses
                                        Chrome://newtab
                                        Nova

                                        14 réponses
                                        Freebox POP coupure en 2.5gb...
                                        onizuka1000

                                        49 réponses