Page internet explorer qui s'ouvre: trojan?

Bonjour,

Tu télécharges MalwareBytes.
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Tu l'installes. Choisis les options par défaut.
A la fin de l’installation, il te sera demandé de mettre à jour MalwareBytes et de l’éxecuter .
Accepte. Après la, mise à jour, le logiciel va s’ouvrir.

Dans l’onglet Recherche, sélectionne Exécuter un examen complet.
Clique sur recherche. Tu ne sélectionnes que les disques durs de l’ordinateur.
Clique sur lancer l’examen.

A la fin de la recherche, comme il est demandé, clique sur afficher les résultats.
Si des infections sont trouvées, clique sur Supprimer la sélection.
Tu postes le rapport dans ton prochain message.

Si tu ne retrouves pas le rapport, ouvre MalwareBytes et regarde dans l’onglet Rapport/logs. Il y est. Clique dessus et choisir ouvrir.

Le scan dure en moyenne 50 mn.

A+

Il y avait pas mal de trojan, voici le rapport :

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1412
Windows 5.1.2600 Service Pack 2

20/11/2008 12:51:47
mbam-log-2008-11-20 (12-51-47).txt

Type de recherche: Examen complet (C:\|D:\|F:\|G:\|H:\|)
Eléments examinés: 136474
Temps écoulé: 45 minute(s), 10 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 24
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 17

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\kfnxvcfv.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\zkxkgj.dll (Trojan.Vundo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a6ec315b-b021-4681-9d68-1ce0e0107b7f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a6ec315b-b021-4681-9d68-1ce0e0107b7f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c802855a-7ddf-45b2-86e7-08e512da1766} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcyolbs (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c802855a-7ddf-45b2-86e7-08e512da1766} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a6ec315b-b021-4681-9d68-1ce0e0107b7f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\acm.acmfactory (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\acm.acmfactory.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{43382522-a846-46f4-ac57-1f71ae6e1086} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{572fb162-c0ba-4edf-8cff-e3846153b9b0} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{72a836d1-bc00-43c0-a941-17960e4fb842} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a9aae1ab-9688-42c5-86f5-c12f6b9015ad} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{df901432-1b9f-4f5b-9e56-301c553f9095} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{127df9b4-d75d-44a6-af78-8c3a8ceb03db} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c802855a-7ddf-45b2-86e7-08e512da1766} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\ACM.DLL (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a0907492 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c802855a-7ddf-45b2-86e7-08e512da1766} (Trojan.Vundo) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Save (Adware.WhenUSave) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\zkxkgj.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ddcYoLBS.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kfnxvcfv.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\vfcvxnfk.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\frenchkiss\Local Settings\Temporary Internet Files\Content.IE5\7UN5XLFB\index[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\frenchkiss\Local Settings\Temporary Internet Files\Content.IE5\KPQ70DM7\kb600179[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{82918B45-0825-4F13-85F9-5002B441FAB9}\RP46\A0007838.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{82918B45-0825-4F13-85F9-5002B441FAB9}\RP47\A0007854.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{82918B45-0825-4F13-85F9-5002B441FAB9}\RP47\A0007855.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{82918B45-0825-4F13-85F9-5002B441FAB9}\RP47\A0007856.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{82918B45-0825-4F13-85F9-5002B441FAB9}\RP47\A0007857.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{82918B45-0825-4F13-85F9-5002B441FAB9}\RP47\A0007867.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\udqublic.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Save\ffext.mod (Adware.WhenUSave) -> Quarantined and deleted successfully.
C:\Program Files\Save\save.db (Adware.WhenUSave) -> Quarantined and deleted successfully.
C:\Program Files\Save\save.htm (Adware.WhenUSave) -> Quarantined and deleted successfully.
C:\Program Files\Save\store.db (Adware.WhenUSave) -> Quarantined and deleted successfully.

Oui, Malwarebytes a fait du bon boulot.
Garde ce logiciel sur ton PC et mets le à jour régulièrement pour vérifier ton PC.

1) Reposte moi un rapport Hijackthis.

2) Tu vas télécharger ComBoFix et enregistre le sur ton bureau ( important pour la suite )
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

déconnecte toi du net.
Désactive les protections résidentes de ton ordinateur ( antivirus, antispyware et parefeu )
Branche tes différents supports amovibles ( clés USB, disque dur externe ) sans les ouvrir.

Lance Combofix.exe et suis les invites.
Il est possible que ComBoFix redémarre l’ordinateur pour supprimer certains fichiers.

Une fois le scan fini, un rapport va apparaitre.
Copie/colle ce rapport dans ta prochaine réponse.
Si tu ne le trouves pas, il est à C:\ComboFix.txt.

A+

Voila de ce qui est pour le rapport combofix :
ComboFix 08-11-19.08 - frenchkiss 2008-11-20 13:40:35.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1565 [GMT 1:00]
Lancé depuis: c:\documents and settings\frenchkiss\Bureau\combofix\ComboFix.exe
* Un nouveau point de restauration a été créé

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ayjixpxl.ini
c:\windows\system32\gOUwDJlm.ini
c:\windows\system32\gOUwDJlm.ini2
c:\windows\system32\gtrqxekj.ini

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-20 au 2008-11-20 ))))))))))))))))))))))))))))))))))))
.

2008-11-20 13:43 . 2008-11-20 13:43 <REP> d--hs---- c:\windows\system32\dllcache
2008-11-20 12:03 . 2008-11-20 12:03 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-20 12:03 . 2008-11-20 12:03 <REP> d-------- c:\documents and settings\frenchkiss\Application Data\Malwarebytes
2008-11-20 12:03 . 2008-11-20 12:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-20 12:03 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-20 12:03 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-18 19:55 . 2008-11-20 12:09 <REP> d--h----- C:\$AVG8.VAULT$
2008-11-18 19:48 . 2008-11-19 22:08 <REP> d-------- c:\windows\system32\drivers\Avg
2008-11-18 19:48 . 2008-11-18 19:48 <REP> d-------- c:\program files\AVG
2008-11-18 19:48 . 2008-11-20 13:38 <REP> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-11-18 19:48 . 2008-11-18 19:48 98,440 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-18 19:48 . 2008-11-18 19:48 90,632 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-18 19:48 . 2008-11-18 19:48 12,936 --a------ c:\windows\system32\drivers\avgrkx86.sys
2008-11-18 19:48 . 2008-11-18 19:48 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-11-18 17:13 . 2007-05-30 13:10 10,872 --a------ c:\windows\system32\drivers\AvgAsCln.sys
2008-11-16 23:07 . 2008-11-16 23:12 <REP> d-------- c:\documents and settings\frenchkiss\Application Data\Red Alert 3
2008-11-16 22:24 . 2008-11-16 22:24 <REP> d-------- c:\windows\Logs
2008-11-16 22:24 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\system32\D3DX9_38.dll
2008-11-16 22:24 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\system32\D3DCompiler_38.dll
2008-11-16 22:24 . 2008-05-30 14:19 507,400 --a------ c:\windows\system32\XAudio2_1.dll
2008-11-16 22:24 . 2008-05-30 14:11 467,984 --a------ c:\windows\system32\d3dx10_38.dll
2008-11-16 22:24 . 2008-05-30 14:18 238,088 --a------ c:\windows\system32\xactengine3_1.dll
2008-11-16 22:24 . 2008-05-30 14:17 65,032 --a------ c:\windows\system32\XAPOFX1_0.dll
2008-11-16 22:24 . 2008-05-30 14:17 25,608 --a------ c:\windows\system32\X3DAudio1_4.dll
2008-11-07 15:20 . 2008-11-07 15:20 268 --ah----- C:\sqmdata01.sqm
2008-11-07 15:20 . 2008-11-07 15:20 244 --ah----- C:\sqmnoopt01.sqm
2008-11-03 16:06 . 2008-03-05 15:56 1,420,824 --a------ c:\windows\system32\D3DCompiler_37.dll
2008-11-03 16:06 . 2007-10-12 15:14 1,374,232 --a------ c:\windows\system32\D3DCompiler_36.dll
2008-11-03 16:06 . 2008-03-05 16:03 479,752 --a------ c:\windows\system32\XAudio2_0.dll
2008-11-03 16:06 . 2008-02-05 23:07 462,864 --a------ c:\windows\system32\d3dx10_37.dll
2008-11-03 16:06 . 2007-10-02 09:56 444,776 --a------ c:\windows\system32\d3dx10_36.dll
2008-11-03 16:06 . 2007-10-22 03:39 267,272 --a------ c:\windows\system32\xactengine2_10.dll
2008-11-03 16:06 . 2007-07-20 00:57 267,112 --a------ c:\windows\system32\xactengine2_9.dll
2008-11-03 16:06 . 2008-03-05 16:03 238,088 --a------ c:\windows\system32\xactengine3_0.dll
2008-11-03 16:06 . 2008-03-05 16:00 25,608 --a------ c:\windows\system32\X3DAudio1_3.dll
2008-11-03 15:49 . 2007-10-12 15:14 3,734,536 --a------ c:\windows\system32\d3dx9_36.dll
2008-11-03 15:48 . 2008-03-05 15:56 3,786,760 --a------ c:\windows\system32\d3dx9_37.dll
2008-11-02 21:08 . 2008-11-02 21:08 <REP> d-------- c:\documents and settings\frenchkiss\Application Data\dvdcss
2008-11-02 21:08 . 2008-11-02 21:08 0 --a------ c:\windows\iPlayer.INI
2008-11-02 21:07 . 2008-11-02 21:10 <REP> d-------- c:\program files\InterActual
2008-11-02 21:07 . 2008-11-02 21:09 116 --a------ c:\windows\NeroDigital.ini

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-20 12:43 546,336 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-20 12:43 43,043,872 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-20 12:42 585,596 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-20 12:42 57,392 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-20 12:01 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-11-19 16:43 202,648 ----a-w c:\windows\system32\PnkBstrB.exe
2008-11-19 16:43 138,408 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-18 16:20 --------- d-----w c:\program files\DAEMON Tools SearchBar
2008-11-18 16:20 --------- d-----w c:\program files\DAEMON Tools
2008-11-18 16:12 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-16 21:23 682,280 ----a-w c:\windows\system32\pbsvc.exe
2008-11-16 21:23 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-11-16 21:23 22,328 ----a-w c:\documents and settings\frenchkiss\Application Data\PnkBstrK.sys
2008-11-11 22:58 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-12 20:42 --------- d-----w c:\program files\Fichiers communs\Logishrd
2008-10-12 20:42 --------- d-----w c:\documents and settings\frenchkiss\Application Data\Leadertech
2008-10-12 20:41 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-10-12 20:41 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-10-12 20:41 --------- d-----w c:\program files\Logitech
2008-10-12 20:40 --------- d-----w c:\documents and settings\All Users\Application Data\LogiShrd
2008-10-09 13:14 --------- d-----w c:\documents and settings\All Users\Application Data\Age of Empires 3
2008-10-07 21:21 355,584 ----a-w c:\windows\system32\TuneUpDefragService.exe
2008-10-07 21:21 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-10-07 21:21 --------- d-----w c:\documents and settings\frenchkiss\Application Data\TuneUp Software
2008-10-07 21:20 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-10-07 21:20 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-10-07 08:12 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-10-06 08:59 --------- d-----w c:\program files\MSECache
2008-10-06 08:57 --------- d-----w c:\program files\Microsoft.NET
2008-10-02 12:26 --------- d-----w c:\program files\Fichiers communs\Logitech
2008-10-02 12:26 --------- d-----w c:\documents and settings\All Users\Application Data\Logitech
2008-09-29 10:04 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-09-29 09:57 --------- dc-h--w c:\documents and settings\All Users\Application Data\{0151C9FC-719D-4459-B1E2-4685CC6E62A8}
2008-09-29 09:35 --------- dc-h--w c:\documents and settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2008-09-29 09:15 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-09-29 09:15 --------- d-----w c:\program files\Electronic Arts
2008-09-28 21:56 --------- d--h--r c:\documents and settings\frenchkiss\Application Data\SecuROM
2008-09-28 21:17 --------- d-----w c:\program files\AGEIA Technologies
2008-09-28 20:47 --------- d-----w c:\program files\Fichiers communs\WhenU
2008-09-24 18:33 --------- d-----w c:\documents and settings\frenchkiss\Application Data\Apple Computer
2008-09-24 13:01 --------- d-----w c:\documents and settings\frenchkiss\Application Data\InstallShield Installation Information
2008-09-23 10:51 --------- d-----w c:\documents and settings\frenchkiss\Application Data\vlc
2008-09-23 10:29 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-09-23 10:29 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-09-23 10:29 112,144 ----a-w c:\windows\system32\drivers\kl1.sys
2008-09-23 10:22 --------- d-----w c:\program files\Kaspersky Lab
2008-09-23 10:20 --------- d-----w c:\documents and settings\All Users\Application Data\Grisoft
2008-09-23 10:16 --------- d-----w c:\program files\Fichiers communs\Ahead
2008-09-23 10:15 639,224 ----a-w c:\windows\system32\drivers\sptd.sys
2008-09-23 10:14 --------- d-----w c:\program files\QuickTime
2008-09-23 10:14 --------- d-----w c:\program files\iPod
2008-09-23 10:14 --------- d-----w c:\program files\Fichiers communs\Apple
2008-09-23 10:14 --------- d-----w c:\program files\Apple Software Update
2008-09-23 10:14 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-09-23 10:14 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-09-23 10:12 --------- d-----w c:\program files\MSN Messenger
2008-09-23 10:01 315,392 ----a-w c:\windows\HideWin.exe
2008-09-23 10:01 --------- d-----w c:\program files\Realtek
2008-09-23 10:00 --------- d-----w c:\documents and settings\frenchkiss\Application Data\InstallShield
2008-09-23 09:33 --------- d-----w c:\program files\Services en ligne
2008-09-16 19:27 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2008-09-04 07:31 288,024 ----a-w c:\windows\system32\PhysXCplUI.exe
2008-08-31 18:47 550,912 ----a-w c:\windows\system32\oleaut32.dll
2008-08-31 18:47 102,912 ----a-w c:\windows\system32\VB6STKIT.DLL
2008-08-29 06:57 70,936 ----a-w c:\windows\system32\PhysXLoader.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"LClock"="lclock.exe" [2004-12-08 c:\windows\LClock.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"Launch LCDMon"="c:\program files\Fichiers communs\Logitech\LCD Manager\lcdmon.exe" [2007-04-18 774168]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-18 1235736]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 c:\windows\RTHDCPL.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 c:\windows\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="c:\windows\LSD\end.cmd" [2005-07-14 2310]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetpointII.exe [2007-08-30 319488]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=zkxkgj.dll,avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2006-11-12 11:48 157592 c:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
--a------ 2008-07-22 11:34 2772992 c:\program files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-11-15 12:11 267048 f:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-11-14 22:43 286720 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-10-08 11:41 1410296 g:\program files\Steam\steam.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Launch LGDCore"="c:\program files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"f:\\Program Files\\iTunes\\iTunes.exe"=
"g:\\jeux\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"g:\\jeux\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"g:\\jeux\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Game.exe"=
"g:\\jeux\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Launcher.exe"=
"g:\\jeux\\Age of Empires III\\age3y.exe"=
"g:\\jeux\\Call of Duty - World at War\\CoDWaW.exe"=
"g:\\jeux\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys [2008-11-18 12936]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-18 98440]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-18 90632]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-18 874776]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-18 231704]
R2 UxTuneUp;TuneUp Extension de thème;c:\windows\System32\svchost.exe -k netsvcs [2004-08-19 14336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-04-04 24344]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;c:\windows\System32\TuneUpDefragService.exe [2008-10-07 355584]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2008-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

2008-11-20 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 08:23]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{19942391-D59E-4613-AA0D-7FF00CDF9008} - c:\windows\system32\mlJDwUOg.dll
MSConfigStartUp-WhenUSearchWHSE - c:\program files\DAEMON Tools SearchBar\whse.exe

.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\frenchkiss\Application Data\Mozilla\Firefox\Profiles\x8c4b1vc.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-20 13:43:21
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\rundll32.exe
c:\program files\Fichiers communs\Logitech\LCD Manager\Applets\LCDClock.exe
c:\program files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\AVG\AVG8\avgdiag.exe
c:\windows\system32\wdfmgr.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Heure de fin: 2008-11-20 13:44:01 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-20 12:43:58

Avant-CF: 6 891 094 016 octets libres
Après-CF: 7,085,731,840 octets libres

258

ComboFix 08-11-19.08 - frenchkiss 2008-11-20 13:40:35.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1565 [GMT 1:00]
Lancé depuis: c:\documents and settings\frenchkiss\Bureau\combofix\ComboFix.exe
* Un nouveau point de restauration a été créé

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ayjixpxl.ini
c:\windows\system32\gOUwDJlm.ini
c:\windows\system32\gOUwDJlm.ini2
c:\windows\system32\gtrqxekj.ini

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-20 au 2008-11-20 ))))))))))))))))))))))))))))))))))))
.

2008-11-20 13:43 . 2008-11-20 13:43 <REP> d--hs---- c:\windows\system32\dllcache
2008-11-20 12:03 . 2008-11-20 12:03 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-20 12:03 . 2008-11-20 12:03 <REP> d-------- c:\documents and settings\frenchkiss\Application Data\Malwarebytes
2008-11-20 12:03 . 2008-11-20 12:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-20 12:03 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-20 12:03 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-18 19:55 . 2008-11-20 12:09 <REP> d--h----- C:\$AVG8.VAULT$
2008-11-18 19:48 . 2008-11-19 22:08 <REP> d-------- c:\windows\system32\drivers\Avg
2008-11-18 19:48 . 2008-11-18 19:48 <REP> d-------- c:\program files\AVG
2008-11-18 19:48 . 2008-11-20 13:38 <REP> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-11-18 19:48 . 2008-11-18 19:48 98,440 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-18 19:48 . 2008-11-18 19:48 90,632 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-18 19:48 . 2008-11-18 19:48 12,936 --a------ c:\windows\system32\drivers\avgrkx86.sys
2008-11-18 19:48 . 2008-11-18 19:48 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-11-18 17:13 . 2007-05-30 13:10 10,872 --a------ c:\windows\system32\drivers\AvgAsCln.sys
2008-11-16 23:07 . 2008-11-16 23:12 <REP> d-------- c:\documents and settings\frenchkiss\Application Data\Red Alert 3
2008-11-16 22:24 . 2008-11-16 22:24 <REP> d-------- c:\windows\Logs
2008-11-16 22:24 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\system32\D3DX9_38.dll
2008-11-16 22:24 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\system32\D3DCompiler_38.dll
2008-11-16 22:24 . 2008-05-30 14:19 507,400 --a------ c:\windows\system32\XAudio2_1.dll
2008-11-16 22:24 . 2008-05-30 14:11 467,984 --a------ c:\windows\system32\d3dx10_38.dll
2008-11-16 22:24 . 2008-05-30 14:18 238,088 --a------ c:\windows\system32\xactengine3_1.dll
2008-11-16 22:24 . 2008-05-30 14:17 65,032 --a------ c:\windows\system32\XAPOFX1_0.dll
2008-11-16 22:24 . 2008-05-30 14:17 25,608 --a------ c:\windows\system32\X3DAudio1_4.dll
2008-11-07 15:20 . 2008-11-07 15:20 268 --ah----- C:\sqmdata01.sqm
2008-11-07 15:20 . 2008-11-07 15:20 244 --ah----- C:\sqmnoopt01.sqm
2008-11-03 16:06 . 2008-03-05 15:56 1,420,824 --a------ c:\windows\system32\D3DCompiler_37.dll
2008-11-03 16:06 . 2007-10-12 15:14 1,374,232 --a------ c:\windows\system32\D3DCompiler_36.dll
2008-11-03 16:06 . 2008-03-05 16:03 479,752 --a------ c:\windows\system32\XAudio2_0.dll
2008-11-03 16:06 . 2008-02-05 23:07 462,864 --a------ c:\windows\system32\d3dx10_37.dll
2008-11-03 16:06 . 2007-10-02 09:56 444,776 --a------ c:\windows\system32\d3dx10_36.dll
2008-11-03 16:06 . 2007-10-22 03:39 267,272 --a------ c:\windows\system32\xactengine2_10.dll
2008-11-03 16:06 . 2007-07-20 00:57 267,112 --a------ c:\windows\system32\xactengine2_9.dll
2008-11-03 16:06 . 2008-03-05 16:03 238,088 --a------ c:\windows\system32\xactengine3_0.dll
2008-11-03 16:06 . 2008-03-05 16:00 25,608 --a------ c:\windows\system32\X3DAudio1_3.dll
2008-11-03 15:49 . 2007-10-12 15:14 3,734,536 --a------ c:\windows\system32\d3dx9_36.dll
2008-11-03 15:48 . 2008-03-05 15:56 3,786,760 --a------ c:\windows\system32\d3dx9_37.dll
2008-11-02 21:08 . 2008-11-02 21:08 <REP> d-------- c:\documents and settings\frenchkiss\Application Data\dvdcss
2008-11-02 21:08 . 2008-11-02 21:08 0 --a------ c:\windows\iPlayer.INI
2008-11-02 21:07 . 2008-11-02 21:10 <REP> d-------- c:\program files\InterActual
2008-11-02 21:07 . 2008-11-02 21:09 116 --a------ c:\windows\NeroDigital.ini

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-20 12:43 546,336 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-20 12:43 43,043,872 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-20 12:42 585,596 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-20 12:42 57,392 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-20 12:01 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-11-19 16:43 202,648 ----a-w c:\windows\system32\PnkBstrB.exe
2008-11-19 16:43 138,408 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-18 16:20 --------- d-----w c:\program files\DAEMON Tools SearchBar
2008-11-18 16:20 --------- d-----w c:\program files\DAEMON Tools
2008-11-18 16:12 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-16 21:23 682,280 ----a-w c:\windows\system32\pbsvc.exe
2008-11-16 21:23 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-11-16 21:23 22,328 ----a-w c:\documents and settings\frenchkiss\Application Data\PnkBstrK.sys
2008-11-11 22:58 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-12 20:42 --------- d-----w c:\program files\Fichiers communs\Logishrd
2008-10-12 20:42 --------- d-----w c:\documents and settings\frenchkiss\Application Data\Leadertech
2008-10-12 20:41 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-10-12 20:41 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-10-12 20:41 --------- d-----w c:\program files\Logitech
2008-10-12 20:40 --------- d-----w c:\documents and settings\All Users\Application Data\LogiShrd
2008-10-09 13:14 --------- d-----w c:\documents and settings\All Users\Application Data\Age of Empires 3
2008-10-07 21:21 355,584 ----a-w c:\windows\system32\TuneUpDefragService.exe
2008-10-07 21:21 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-10-07 21:21 --------- d-----w c:\documents and settings\frenchkiss\Application Data\TuneUp Software
2008-10-07 21:20 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-10-07 21:20 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-10-07 08:12 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-10-06 08:59 --------- d-----w c:\program files\MSECache
2008-10-06 08:57 --------- d-----w c:\program files\Microsoft.NET
2008-10-02 12:26 --------- d-----w c:\program files\Fichiers communs\Logitech
2008-10-02 12:26 --------- d-----w c:\documents and settings\All Users\Application Data\Logitech
2008-09-29 10:04 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-09-29 09:57 --------- dc-h--w c:\documents and settings\All Users\Application Data\{0151C9FC-719D-4459-B1E2-4685CC6E62A8}
2008-09-29 09:35 --------- dc-h--w c:\documents and settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2008-09-29 09:15 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-09-29 09:15 --------- d-----w c:\program files\Electronic Arts
2008-09-28 21:56 --------- d--h--r c:\documents and settings\frenchkiss\Application Data\SecuROM
2008-09-28 21:17 --------- d-----w c:\program files\AGEIA Technologies
2008-09-28 20:47 --------- d-----w c:\program files\Fichiers communs\WhenU
2008-09-24 18:33 --------- d-----w c:\documents and settings\frenchkiss\Application Data\Apple Computer
2008-09-24 13:01 --------- d-----w c:\documents and settings\frenchkiss\Application Data\InstallShield Installation Information
2008-09-23 10:51 --------- d-----w c:\documents and settings\frenchkiss\Application Data\vlc
2008-09-23 10:29 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-09-23 10:29 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-09-23 10:29 112,144 ----a-w c:\windows\system32\drivers\kl1.sys
2008-09-23 10:22 --------- d-----w c:\program files\Kaspersky Lab
2008-09-23 10:20 --------- d-----w c:\documents and settings\All Users\Application Data\Grisoft
2008-09-23 10:16 --------- d-----w c:\program files\Fichiers communs\Ahead
2008-09-23 10:15 639,224 ----a-w c:\windows\system32\drivers\sptd.sys
2008-09-23 10:14 --------- d-----w c:\program files\QuickTime
2008-09-23 10:14 --------- d-----w c:\program files\iPod
2008-09-23 10:14 --------- d-----w c:\program files\Fichiers communs\Apple
2008-09-23 10:14 --------- d-----w c:\program files\Apple Software Update
2008-09-23 10:14 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-09-23 10:14 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-09-23 10:12 --------- d-----w c:\program files\MSN Messenger
2008-09-23 10:01 315,392 ----a-w c:\windows\HideWin.exe
2008-09-23 10:01 --------- d-----w c:\program files\Realtek
2008-09-23 10:00 --------- d-----w c:\documents and settings\frenchkiss\Application Data\InstallShield
2008-09-23 09:33 --------- d-----w c:\program files\Services en ligne
2008-09-16 19:27 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2008-09-04 07:31 288,024 ----a-w c:\windows\system32\PhysXCplUI.exe
2008-08-31 18:47 550,912 ----a-w c:\windows\system32\oleaut32.dll
2008-08-31 18:47 102,912 ----a-w c:\windows\system32\VB6STKIT.DLL
2008-08-29 06:57 70,936 ----a-w c:\windows\system32\PhysXLoader.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"LClock"="lclock.exe" [2004-12-08 c:\windows\LClock.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"Launch LCDMon"="c:\program files\Fichiers communs\Logitech\LCD Manager\lcdmon.exe" [2007-04-18 774168]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-18 1235736]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 c:\windows\RTHDCPL.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-07-17 c:\windows\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="c:\windows\LSD\end.cmd" [2005-07-14 2310]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetpointII.exe [2007-08-30 319488]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=zkxkgj.dll,avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2006-11-12 11:48 157592 c:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
--a------ 2008-07-22 11:34 2772992 c:\program files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-11-15 12:11 267048 f:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-11-14 22:43 286720 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-10-08 11:41 1410296 g:\program files\Steam\steam.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Launch LGDCore"="c:\program files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"f:\\Program Files\\iTunes\\iTunes.exe"=
"g:\\jeux\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"g:\\jeux\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"g:\\jeux\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Game.exe"=
"g:\\jeux\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Launcher.exe"=
"g:\\jeux\\Age of Empires III\\age3y.exe"=
"g:\\jeux\\Call of Duty - World at War\\CoDWaW.exe"=
"g:\\jeux\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys [2008-11-18 12936]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-18 98440]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-18 90632]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-18 874776]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-18 231704]
R2 UxTuneUp;TuneUp Extension de thème;c:\windows\System32\svchost.exe -k netsvcs [2004-08-19 14336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-04-04 24344]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;c:\windows\System32\TuneUpDefragService.exe [2008-10-07 355584]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2008-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

2008-11-20 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 08:23]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{19942391-D59E-4613-AA0D-7FF00CDF9008} - c:\windows\system32\mlJDwUOg.dll
MSConfigStartUp-WhenUSearchWHSE - c:\program files\DAEMON Tools SearchBar\whse.exe

.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\frenchkiss\Application Data\Mozilla\Firefox\Profiles\x8c4b1vc.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-20 13:43:21
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\rundll32.exe
c:\program files\Fichiers communs\Logitech\LCD Manager\Applets\LCDClock.exe
c:\program files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\AVG\AVG8\avgdiag.exe
c:\windows\system32\wdfmgr.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Heure de fin: 2008-11-20 13:44:01 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-20 12:43:58

Avant-CF: 6 891 094 016 octets libres
Après-CF: 7,085,731,840 octets libres

258

Voila aussi le rapport hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:45:24, on 20/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Logitech\LCD Manager\lcdmon.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\lclock.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\Logitech\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\SetPoint II\SetpointII.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\AVG\AVG8\avgdiag.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\frenchkiss\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://melanthios-ana.com/zcvisitor/1624d318-3614-11eb-87b9-12a1ab6c324d/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=47f83760-f118-11ea-9bc8-0ac2bbf4ada7
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Fichiers communs\Logitech\LCD Manager\lcdmon.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Global Startup: SetPointII.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://G:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL
O16 - DPF: {6BF52A52-394A-11D3-B153-00C04F79FAA6} (Windows Media Player) - http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: zkxkgj.dll,avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

Utilises-tu ce logiciel , DAEMON Tools ?
Si non, regarde dans ajout/supp de programmes si tu peux le désinstaller.

Tu vas sur le site de Kaspersky:
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

Clique sur Demarrer Online-scanner ( en bas de page à droite ) pour commencer l'analyse.
Il te sera demandé d'installer un logiciel de Kaspersky, accepte.

A la fin de cette analyse, clique sur enregistrer le rapport.
Poste le contenu de ce rapport dans ton prochain message.

tuto : https://forum.pcastuces.com/default.asp

A+

Je pense que c'est réglé mais le scan en ligne sur Kaspersky trouvera peut être d'autres fichiers infectés.
C'est pour vérifier.

A+