à l'aide: VIRUS WIN 32 ADWARE VIRTUMONDE

Bonjour,

J'ai lancé un scan Malwarebytes Anti Malware (ça fait déja 30 minutes... ^^)

comment je fais pour le rapport RSIT ?

euh... ba en fait je n'ai ni antivirus ni pare-feu...

J'ai installé l'antivirus et le pare feu

Voici el log.txt de RSIT :

Logfile of random's system information tool 1.04 (written by random/random)
Run by Fluffy at 2008-10-22 17:54:32
Microsoft Windows XP Professional Service Pack 3, v.3264
System drive C: has 20 GB (66%) free of 30 GB
Total RAM: 1022 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:54:34, on 22/10/2008
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20661)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\WINDOWS\system32\mmm.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
C:\Program Files\Utilities\Volumouse\Volumouse.exe
C:\Program Files\Utilities\qmc.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\Utilities\TClock\tclock.exe
C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\Program Files\Styler\Styler.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Fluffy\Local Settings\Temporary Internet Files\Content.IE5\5G35DYZB\RSIT[1].exe
C:\Program Files\Trend Micro\HijackThis\Fluffy.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [PowerTweak Menu] C:\WINDOWS\system32\mmm.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [lphc1l7j0et7c] C:\WINDOWS\system32\lphc1l7j0et7c.exe
O4 - HKLM\..\Run: [inrhc5l7j0et7c] C:\WINDOWS\temp\.ttB.tmp.exe /CR=BF41E8B2D96ED8F141145E40F597DD53F2DEBB632C05031E77FBF690E565C9B411A399635C1C2D071C7B141ECB458966D589878486379A3AFB2DEF441C2DF3DE963805540D7D16AC36B97FECE25A7C7E1FBD06A244805A
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [$Volumouse$] "C:\Program Files\Utilities\Volumouse\Volumouse.exe" /nodlg
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [$Volumouse$] "C:\Program Files\Utilities\Volumouse\Volumouse.exe" /nodlg (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [SkinClock] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Styler.lnk = ?
O4 - Global Startup: QuickMonth Calendar.lnk = C:\Program Files\Utilities\qmc.exe
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O4 - Global Startup: TClock.lnk = C:\Program Files\Utilities\TClock\tclock.exe
O4 - Global Startup: Visual Task Tips.lnk = C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBAA2EA7-E24C-47A0-A9F5-14236FA26AFA}: NameServer = 212.27.53.252
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: bkutbiqm - C:\WINDOWS\SYSTEM32\bkutbiqm.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: NST ToolTipFixer (TTFixerService) - NeoSmart Technologies - C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe

Voici le rapport de Smitfraudfix :

SmitFraudFix v2.366

Scan done at 18:18:00,95, 22/10/2008
Run from C:\Documents and Settings\Fluffy\Desktop\d‚virusage\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\WINDOWS\system32\mmm.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\lphc1l7j0et7c.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
C:\Program Files\Utilities\Volumouse\Volumouse.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Utilities\qmc.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\Utilities\TClock\tclock.exe
C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe
C:\Program Files\Styler\Styler.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Fluffy


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Fluffy\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Fluffy\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\\WINDOWS\\system32\\guard32.dll"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller - Packet Scheduler Miniport
DNS Server Search Order: 212.27.53.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{CBAA2EA7-E24C-47A0-A9F5-14236FA26AFA}: NameServer=212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{CBAA2EA7-E24C-47A0-A9F5-14236FA26AFA}: NameServer=212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{CBAA2EA7-E24C-47A0-A9F5-14236FA26AFA}: NameServer=212.27.53.252


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

rapport ComboFix :

ComboFix 08-10-21.05 - Fluffy 2008-10-22 19:27:24.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.550 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Fluffy\Desktop\ComboFix.exe
* Un nouveau point de restauration a été créé

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
[i] ADS - svchost.exe: deleted 25088 bytes in 1 streams. [/i]

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bkutbiqm.dll
C:\WINDOWS\system32\blphc1l7j0et7c.scr
C:\WINDOWS\system32\lphc1l7j0et7c.exe
C:\WINDOWS\system32\phc1l7j0et7c.bmp

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ICF
-------\Legacy_NPF
-------\Service_ICF


((((((((((((((((((((((((((((( Fichiers créés du 2008-09-22 au 2008-10-22 ))))))))))))))))))))))))))))))))))))
.

2008-10-22 17:37 . 2008-10-22 17:37 <DIR> d-------- C:\Program Files\COMODO
2008-10-22 17:37 . 2008-10-22 17:37 <DIR> d-------- C:\Documents and Settings\Fluffy\Application Data\Comodo
2008-10-22 17:37 . 2008-10-22 17:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-10-22 17:37 . 2008-10-22 17:37 143,104 --a------ C:\WINDOWS\system32\guard32.dll
2008-10-22 17:37 . 2008-10-22 17:37 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys
2008-10-22 17:37 . 2008-10-22 17:37 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-10-22 17:28 . 2008-10-22 17:28 <DIR> d-------- C:\Program Files\Avira
2008-10-22 17:28 . 2008-10-22 17:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-10-22 12:57 . 2008-10-22 12:58 <DIR> d-------- C:\rsit
2008-10-22 12:14 . 2008-10-22 12:14 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-10-22 12:09 . 2008-07-11 17:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\VMware
2008-10-22 12:09 . 2008-07-11 17:15 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\uTorrent
2008-10-22 12:09 . 2008-07-11 17:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\URSoft
2008-10-22 12:09 . 2008-07-11 17:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\ImgBurn
2008-10-22 12:09 . 2008-07-11 17:24 <DIR> d-------- C:\Documents and Settings\Administrator\{0943789D-85D0-4B1D-ACFF-02423D463FAD}
2008-10-22 12:09 . 2008-10-22 12:13 <DIR> d-------- C:\Documents and Settings\Administrator
2008-10-22 11:58 . 2008-10-22 11:58 <DIR> d-------- C:\Program Files\CCleaner
2008-10-22 11:54 . 2008-10-22 11:54 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-22 11:54 . 2008-10-22 11:54 <DIR> d-------- C:\Documents and Settings\Fluffy\Application Data\Malwarebytes
2008-10-22 11:54 . 2008-10-22 11:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-22 11:54 . 2008-10-16 20:25 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-22 11:54 . 2008-10-16 20:25 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-21 21:16 . 2008-10-21 21:16 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-20 20:17 . 2008-10-22 19:15 3,620 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-20 20:14 . 2008-10-20 20:14 101 --a------ C:\WINDOWS\wininit.ini
2008-10-16 22:14 . 2008-10-16 22:14 <DIR> d-------- C:\Documents and Settings\Fluffy\Application Data\JCreator
2008-10-16 22:14 . 2008-10-16 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\JCreator
2008-10-13 21:17 . 2008-10-20 19:54 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-13 21:08 . 2008-10-13 21:08 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-10-08 22:17 . 2001-06-18 09:41 282,624 --a------ C:\WINDOWS\system32\ActiveSkin.ocx
2008-10-08 22:17 . 2001-01-10 12:23 162,304 --a------ C:\UNWISE.EXE
2008-10-08 22:17 . 2001-06-18 09:41 112 --a------ C:\WINDOWS\ActiveSkin.INI
2008-10-05 23:21 . 2007-11-30 17:31 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-10-05 23:21 . 2007-11-30 17:31 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-10-05 12:06 . 2008-10-05 12:06 <DIR> d-------- C:\Documents and Settings\Fluffy\Application Data\Disney Interactive Studios
2008-10-05 11:43 . 2008-07-12 08:18 3,851,784 --a------ C:\WINDOWS\system32\D3DX9_39.dll
2008-10-05 11:43 . 2008-07-12 08:18 1,493,528 --a------ C:\WINDOWS\system32\D3DCompiler_39.dll
2008-10-05 11:43 . 2008-07-31 10:40 509,448 --a------ C:\WINDOWS\system32\XAudio2_2.dll
2008-10-05 11:43 . 2008-07-12 08:18 467,984 --a------ C:\WINDOWS\system32\d3dx10_39.dll
2008-10-05 11:43 . 2008-07-31 10:41 238,088 --a------ C:\WINDOWS\system32\xactengine3_2.dll
2008-10-05 11:43 . 2008-07-31 10:41 68,616 --a------ C:\WINDOWS\system32\XAPOFX1_1.dll
2008-10-05 11:37 . 2008-10-05 11:37 <DIR> d-------- C:\Documents and Settings\Fluffy\Application Data\InstallShield
2008-10-05 11:37 . 2008-10-05 12:05 1,003 --a------ C:\WINDOWS\disney.ini
2008-09-28 16:33 . 2008-09-28 16:33 126,976 --a------ C:\WINDOWS\War3Unin.exe
2008-09-28 16:33 . 2008-09-28 16:36 17,827 --a------ C:\WINDOWS\War3Unin.dat
2008-09-28 16:33 . 2008-09-28 16:33 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-09-28 01:38 . 2008-09-28 23:30 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-24 19:29 . 2008-09-24 19:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ALM
2008-09-23 23:19 . 2005-02-24 12:10 2,084,864 --a------ C:\WINDOWS\system32\AudDesign.dll
2008-09-23 23:19 . 2005-03-11 17:37 1,986,560 --a------ C:\WINDOWS\system32\AudFile.dll
2008-09-23 23:19 . 2005-02-24 12:11 1,212,416 --a------ C:\WINDOWS\system32\AudioInfos.dll
2008-09-23 23:19 . 2005-02-24 12:11 479,232 --a------ C:\WINDOWS\system32\AudioVisu.dll
2008-09-23 23:19 . 2005-02-24 15:21 458,752 --a------ C:\WINDOWS\system32\AudPlayer.dll
2008-09-23 23:19 . 2005-03-10 16:00 454,656 --a------ C:\WINDOWS\system32\AudioRecord.dll
2008-09-23 23:19 . 2005-02-24 12:10 417,792 --a------ C:\WINDOWS\system32\AudDisplay.dll
2008-09-23 23:19 . 2005-02-24 11:51 348,160 --a------ C:\WINDOWS\system32\WMAFile.dll
2008-09-23 23:19 . 2003-08-07 15:01 237,568 --a------ C:\WINDOWS\system32\lame_enc.dll
2008-09-23 23:19 . 2005-01-10 12:54 116,296 --a------ C:\WINDOWS\system32\NCTWMAProfiles.prx
2008-09-23 23:19 . 1998-07-12 23:00 21,504 --a------ C:\WINDOWS\system32\TABCTFR.DLL

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-22 17:31 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\OpenOffice.org2
2008-10-22 17:12 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2008-10-22 10:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-20 18:53 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-10-20 09:35 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\FileZilla
2008-10-20 08:16 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\GrabIt
2008-10-05 09:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-02 21:11 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\Audacity
2008-10-02 19:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-09-27 23:35 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\Azureus
2008-09-17 18:29 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\dvdcss
2008-09-16 20:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-09-11 14:11 --------- d-----w C:\Documents and Settings\Fluffy\Application Data\XRay Engine
2008-09-09 20:56 --------- d-----w C:\Program Files\Common Files\Control Panels
2008-09-07 16:44 304,528 ----a-w C:\WINDOWS\system32\appdrvrem01.exe
2008-09-07 16:44 2,915,944 ----a-w C:\WINDOWS\system32\drivers\appdrv01.sys
2008-09-01 11:24 --------- d-----w C:\Program Files\Sarkophage
2008-07-26 00:02 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-07-12 14:20 22,328 ----a-w C:\Documents and Settings\Fluffy\Application Data\PnkBstrK.sys
.

------- Sigcheck -------

2008-02-03 04:08 361344 20061ba39a9c02774575f493e6a9f1e7 C:\WINDOWS\system32\drivers\tcpip.sys

2008-02-03 04:27 2227072 7cd93f0f8149efe5aed4a8c0195004db C:\WINDOWS\system32\ntkrnlpa.exe

2008-02-03 04:05 2350208 17a60cd35fbe6dd5beaaf93bed6138b8 C:\WINDOWS\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2007-11-30 15360]
"TaskSwitchXP"="C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976]
"$Volumouse$"="C:\Program Files\Utilities\Volumouse\Volumouse.exe" [2007-11-23 30208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VistaDrive"="C:\WINDOWS\VistaDrive\VistaDrive.exe" [2006-10-05 280779]
"PowerTweak Menu"="C:\WINDOWS\system32\mmm.exe" [2005-07-05 828416]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 54832]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-10-07 131072]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-10-22 1655552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2007-11-30 15360]
"TaskSwitchXP"="C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976]
"$Volumouse$"="C:\Program Files\Utilities\Volumouse\Volumouse.exe" [2007-11-23 30208]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 21687592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-02-03 C:\WINDOWS\system32\advpack.dll]

C:\Documents and Settings\Fluffy\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [1/21/2008 3:41:28 PM 393216]
Styler.lnk - C:\Documents and Settings\Fluffy\Application Data\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [7/11/2008 5:35:27 PM 15086]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
QuickMonth Calendar.lnk - C:\Program Files\Utilities\qmc.exe [7/11/2008 5:15:22 PM 217546]
SnagIt 8.lnk - C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe [5/1/2007 12:11:48 PM 6395464]
TClock.lnk - C:\Program Files\Utilities\TClock\tclock.exe [7/11/2008 5:15:30 PM 44544]
Visual Task Tips.lnk - C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe [7/11/2008 5:15:32 PM 36352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"HideRunAsVerb"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2007-03-15 20:56 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Agl74.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"D:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"D:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"D:\\Program Files\\FEARCombat\\FEARMP.exe"=
"E:\\Program Files\\eChanblard\\emule.exe"=
"E:\\Program Files\\Azureus\\Azureus.exe"=
"D:\\Program Files\\Ñ.Ò.À.Ë.Ê.Å.Ð. - ×èñòîå Íåáî\\bin\\xrEngine.exe"=
"D:\\Program Files\\Ñ.Ò.À.Ë.Ê.Å.Ð. - ×èñòîå Íåáî\\bin\\dedicated\\xrEngine.exe"=
"D:\\Program Files\\FileZilla FTP Client\\filezilla.exe"=

R1 appdrv01;Application Driver (01);C:\WINDOWS\system32\Drivers\appdrv01.sys [2008-09-07 2915944]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-10-22 87056]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-10-22 24208]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 17:51 13560]
R2 TTFixerService;NST ToolTipFixer;C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe [2007-06-27 10240]
S0 Agl74;Agl74;C:\WINDOWS\system32\Drivers\Agl74.sys [ ]
S2 appdrvrem01;Application Driver Auto Removal Service (01);C:\WINDOWS\System32\appdrvrem01.exe svc [ ]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-04-04 83208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\N]
\Shell\AutoRun\command - N:\Autoplay\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47ee0ddd-9322-11dd-8d82-000129d27adf}]
\shell\Setup\command - K:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8abe4824-9ed1-11dd-8da5-000129d27adf}]
\shell\Setup\command - K:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c94f92b4-9e09-11dd-8da1-000129d27adf}]
\shell\Setup\command - M:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ffa36ccf-4f5c-11dd-a970-806d6172696f}]
\Shell\AutoRun\command - F:\SETUP.EXE /UPDATE

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,Register
.
Contenu du dossier 'Tâches planifiées'

2008-10-21 C:\WINDOWS\Tasks\User_Feed_Synchronization-{E3DADA07-1412-4BE4-85E0-48F3A2C18D23}.job
- C:\WINDOWS\system32\msfeedssync.exe [2008-02-03 04:08]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-lphc1l7j0et7c - C:\WINDOWS\system32\lphc1l7j0et7c.exe


.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Fluffy\Application Data\Mozilla\Firefox\Profiles\4eeowyv7.default\
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.
.
------- Associations de fichier -------
.
inffile=C:\WINDOWS\system32\Notepad2.exe %1
inifile=C:\WINDOWS\system32\Notepad2.exe %1
txtfile=C:\WINDOWS\system32\Notepad2.exe %1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-22 19:30:13
Windows 5.1.2600 Service Pack 3, v.3264 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl"
.
------------------------ Autres processus actifs ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\TechSmith\SnagIt 8\TscHelp.exe
C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
C:\Program Files\Styler\Styler.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.bin
.
**************************************************************************
.
Heure de fin: 2008-10-22 19:34:59 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-22 17:34:37
ComboFix2.txt 2008-10-20 18:36:04

Avant-CF: 20 634 771 456 bytes free
Après-CF: 20,637,978,624 bytes free

263

Je te remercie beaucoup pour ton aide.

J'ai finalement réinstallé windows et installé Comodo Firewall et Avira AntiVir pour éviter de futures problèmes.

Bonne soirée