à l'aide: VIRUS WIN 32 ADWARE VIRTUMONDE

pardon j'avais pas la suite de votre message sur le mail!!! je poursuis je reviens dans 2 minutes!

Bonsoir,

Merci d'avoir répondu si vite.

Voici le rapport Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:16:57, on 21/10/2008
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20661)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\WINDOWS\system32\mmm.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
C:\Program Files\Utilities\Volumouse\Volumouse.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Utilities\qmc.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\Utilities\TClock\tclock.exe
C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe
C:\Program Files\Styler\Styler.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [PowerTweak Menu] C:\WINDOWS\system32\mmm.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [$Volumouse$] "C:\Program Files\Utilities\Volumouse\Volumouse.exe" /nodlg
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [$Volumouse$] "C:\Program Files\Utilities\Volumouse\Volumouse.exe" /nodlg (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [SkinClock] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Styler.lnk = ?
O4 - Global Startup: QuickMonth Calendar.lnk = C:\Program Files\Utilities\qmc.exe
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O4 - Global Startup: TClock.lnk = C:\Program Files\Utilities\TClock\tclock.exe
O4 - Global Startup: Visual Task Tips.lnk = C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBAA2EA7-E24C-47A0-A9F5-14236FA26AFA}: NameServer = 212.27.53.252
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: NST ToolTipFixer (TTFixerService) - NeoSmart Technologies - C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe

...et le rapport Combofix :

ComboFix 08-10-19.04 - Fluffy 2008-10-20 20:30:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.618 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Fluffy\Desktop\ComboFix.exe
* Un nouveau point de restauration a été créé

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
[i] ADS - svchost.exe: deleted 25088 bytes in 1 streams. [/i]

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bkutbiqm.dll
C:\WINDOWS\system32\bkutbiqm32.dll
C:\WINDOWS\system32\blphc1l7j0et7c.scr
C:\WINDOWS\system32\drivers\Ekp17.sys
C:\WINDOWS\system32\lphc1l7j0et7c.exe
C:\WINDOWS\system32\phc1l7j0et7c.bmp

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EKP17
-------\Legacy_ICF
-------\Legacy_NPF
-------\Service_Ekp17
-------\Service_ICF


((((((((((((((((((((((((((((( Fichiers créés du 2008-09-20 au 2008-10-20 ))))))))))))))))))))))))))))))))))))
.

2008-10-20 20:17 . 2008-10-20 20:21 3,288 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-20 20:14 . 2008-10-20 20:14 101 --a------ C:\WINDOWS\wininit.ini
2008-10-16 22:14 . 2008-10-16 22:14 <DIR> d-------- C:\Documents and Settings\Fluffy\Application Data\JCreator
2008-10-16 22:14 . 2008-10-16 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\JCreator
2008-10-13 21:17 . 2008-10-20 19:54 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-13 21:08 . 2008-10-13 21:08 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-10-08 22:17 . 2001-06-18 09:41 282,624 --a------ C:\WINDOWS\system32\ActiveSkin.ocx
2008-10-08 22:17 . 2001-01-10 12:23 162,304 --a------ C:\UNWISE.EXE
2008-10-08 22:17 . 2001-06-18 09:41 112 --a------ C:\WINDOWS\ActiveSkin.INI
2008-10-05 23:21 . 2007-11-30 17:31 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-10-05 23:21 . 2007-11-30 17:31 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-10-05 12:06 . 2008-10-05 12:06 <DIR> d-------- C:\Documents and Settings\Fluffy\Application Data\Disney Interactive Studios
2008-10-05 11:43 . 2008-07-12 08:18 3,851,784 --a------ C:\WINDOWS\system32\D3DX9_39.dll
2008-10-05 11:43 . 2008-07-12 08:18 1,493,528 --a------ C:\WINDOWS\system32\D3DCompiler_39.dll
2008-10-05 11:43 . 2008-07-31 10:40 509,448 --a------ C:\WINDOWS\system32\XAudio2_2.dll
2008-10-05 11:43 . 2008-07-12 08:18 467,984 --a------ C:\WINDOWS\system32\d3dx10_39.dll
2008-10-05 11:43 . 2008-07-31 10:41 238,088 --a------ C:\WINDOWS\system32\xactengine3_2.dll
2008-10-05 11:43 . 2008-07-31 10:41 68,616 --a------ C:\WINDOWS\system32\XAPOFX1_1.dll
2008-10-05 11:37 . 2008-10-05 11:37 <DIR> d-------- C:\Documents and Settings\Fluffy\Application Data\InstallShield
2008-10-05 11:37 . 2008-10-05 12:05 1,003 --a------ C:\WINDOWS\disney.ini
2008-09-28 16:33 . 2008-09-28 16:33 126,976 --a------ C:\WINDOWS\War3Unin.exe
2008-09-28 16:33 . 2008-09-28 16:36 17,827 --a------ C:\WINDOWS\War3Unin.dat
2008-09-28 16:33 . 2008-09-28 16:33 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-09-28 01:38 . 2008-09-28 23:30 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-24 19:29 . 2008-09-24 19:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ALM

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-20 18:33 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\OpenOffice.org2
2008-10-20 09:35 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\FileZilla
2008-10-20 08:16 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\GrabIt
2008-10-18 17:55 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-10-05 09:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-02 21:11 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\Audacity
2008-10-02 19:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-09-27 23:35 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\Azureus
2008-09-17 18:29 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\dvdcss
2008-09-16 20:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-09-11 14:11 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\XRay Engine
2008-09-09 20:56 --------- d-----w C:\Program Files\Common Files\Control Panels
2008-09-07 16:44 2,915,944 ----a-w C:\WINDOWS\system32\drivers\appdrv01.sys
2008-09-01 11:24 --------- d-----w C:\Program Files\Sarkophage
2008-08-20 15:03 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-07-12 14:20 22,328 ----a-w C:\Documents and Settings\Fluffy\Application Data\PnkBstrK.sys
.

------- Sigcheck -------

2008-02-03 04:08 361344 20061ba39a9c02774575f493e6a9f1e7 C:\WINDOWS\system32\drivers\tcpip.sys

2008-02-03 04:27 2227072 7cd93f0f8149efe5aed4a8c0195004db C:\WINDOWS\system32\ntkrnlpa.exe

2008-02-03 04:05 2350208 17a60cd35fbe6dd5beaaf93bed6138b8 C:\WINDOWS\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2007-11-30 15360]
"TaskSwitchXP"="C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976]
"$Volumouse$"="C:\Program Files\Utilities\Volumouse\Volumouse.exe" [2007-11-23 30208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VistaDrive"="C:\WINDOWS\VistaDrive\VistaDrive.exe" [2006-10-05 280779]
"PowerTweak Menu"="C:\WINDOWS\system32\mmm.exe" [2005-07-05 828416]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 54832]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-10-07 131072]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2007-11-30 15360]
"TaskSwitchXP"="C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976]
"$Volumouse$"="C:\Program Files\Utilities\Volumouse\Volumouse.exe" [2007-11-23 30208]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 21687592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-02-03 C:\WINDOWS\system32\advpack.dll]

C:\Documents and Settings\Fluffy\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [1/21/2008 3:41:28 PM 393216]
Styler.lnk - C:\Documents and Settings\Fluffy\Application Data\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [7/11/2008 5:35:27 PM 15086]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
QuickMonth Calendar.lnk - C:\Program Files\Utilities\qmc.exe [7/11/2008 5:15:22 PM 217546]
SnagIt 8.lnk - C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe [5/1/2007 12:11:48 PM 6395464]
TClock.lnk - C:\Program Files\Utilities\TClock\tclock.exe [7/11/2008 5:15:30 PM 44544]
Visual Task Tips.lnk - C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe [7/11/2008 5:15:32 PM 36352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"HideRunAsVerb"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2007-03-15 20:56 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"D:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"D:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"D:\\Program Files\\FEARCombat\\FEARMP.exe"=
"E:\\Program Files\\eChanblard\\emule.exe"=
"E:\\Program Files\\Azureus\\Azureus.exe"=
"D:\\Program Files\\Ñ.Ò.À.Ë.Ê.Å.Ð. - ×èñòîå Íåáî\\bin\\xrEngine.exe"=
"D:\\Program Files\\Ñ.Ò.À.Ë.Ê.Å.Ð. - ×èñòîå Íåáî\\bin\\dedicated\\xrEngine.exe"=
"D:\\Program Files\\FileZilla FTP Client\\filezilla.exe"=

R1 appdrv01;Application Driver (01);C:\WINDOWS\system32\Drivers\appdrv01.sys [2008-09-07 2915944]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 17:51 13560]
R2 TTFixerService;NST ToolTipFixer;C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe [2007-06-27 10240]
S2 appdrvrem01;Application Driver Auto Removal Service (01);C:\WINDOWS\System32\appdrvrem01.exe svc [ ]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-04-04 83208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\N]
\Shell\AutoRun\command - N:\Autoplay\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8abe4824-9ed1-11dd-8da5-000129d27adf}]
\shell\Setup\command - K:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ffa36ccf-4f5c-11dd-a970-806d6172696f}]
\Shell\AutoRun\command - F:\SETUP.EXE /UPDATE

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,Register
.
Contenu du dossier 'Tâches planifiées'

2008-10-19 C:\WINDOWS\Tasks\User_Feed_Synchronization-{E3DADA07-1412-4BE4-85E0-48F3A2C18D23}.job
- C:\WINDOWS\system32\msfeedssync.exe [2008-02-03 04:08]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-SkinClock - (no file)
HKLM-Run-lphc1l7j0et7c - C:\WINDOWS\system32\lphc1l7j0et7c.exe
HKU-Default-Run-SkinClock - (no file)


.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Fluffy\Application Data\Mozilla\Firefox\Profiles\4eeowyv7.default\
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.
.
------- Associations de fichier -------
.
inffile=C:\WINDOWS\system32\Notepad2.exe %1
inifile=C:\WINDOWS\system32\Notepad2.exe %1
txtfile=C:\WINDOWS\system32\Notepad2.exe %1
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-20 20:33:22
Windows 5.1.2600 Service Pack 3, v.3264 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl"
.
------------------------ Autres processus actifs ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\TechSmith\SnagIt 8\TscHelp.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.bin
.
**************************************************************************
.
Heure de fin: 2008-10-20 20:36:03 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-20 18:35:37

Avant-CF: 20 928 405 504 bytes free
Après-CF: 20,837,384,192 bytes free

213

Le fond d'écran m'indiquant qu'un virus a été détecté est revenu...
Est-ce que je dois refaire le Smitfraudfix et le Combofix ou est-ce que je passe quand même directment au post 20 ?