Trojan et malware

Télécharge VirtumundoBegone sur ton bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

!! Se déconnecter et fermer toutes ses applications le temps de la manipe !!

Double-cliquer sur VirtumundoBeGone.exe et suivre les instructions.
Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau .
(Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu).

Poste le rapport VBG accompagné d'un nouveau rapport Hijackthis pour analyse ...

bien .... on continue :

1- Télécharge : - CCleaner
https://www.pcastuces.com/logitheque/ccleaner.htm
Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corriger ton registre .
Lors de l'installation:
-choisis bien "francais" en langue .
-avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 premières.

Un tuto ( aide ):
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

---> Utilisation:
! déconnecte toi et ferme toutes applications en cours !
* va dans "nettoyeur" : fais -analyse- puis -nettoyage-
* va dans "registre" : fais -chercher les erreurs- et -réparer toutes les erreurs-
( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) .

( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

2- Télécharge MalwareByte's :
ici ftp://ftp.commentcamarche.com/download/mbam-setup.exe
ou ici : http://www.malwarebytes.org/mbam.php

* Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : https://www.malekal.com/tutorial-aboutbuster/ )

* Potasse le tuto pour te familiariser avec le prg :
https://forum.pcastuces.com/sujet.asp?f=31&s=3
( cela dis, il est très simple d'utilisation ).

! Déconnecte toi et ferme toutes applications en cours !

* Lance Malwarebyte's .

Fais un examen dit "Rapide" .

--> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
--> à la fin tu cliques sur "résultat" .
--> Vérifie que tous les objets infectés soient validés, puis clique sur " SUPPRESSION " .

Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date),
accompagné d'un nouveau rapport hijackthis pour analyse ...

très bien ...

1- supprimes tout ce qui se trouve dans la quarantaine de Malwarebytes .

2- refais un coup de CCleaner ( registre compris ).

3- fais exactement ce qui suit :

Télécharge ComboFix (par sUBs) sur ton Bureau (et pas ailleurs !):

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! Déconnecte toi,ferme tes applications en cours ( ainsi que ton navigateur ) et DESACTIVE TOUTES TES DEFENSES (anti-virus, guarde anti spy-ware, pare-feu) le temps de la manipe :
en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
--->Important : si tu rencontres des difficultés à ce niveau là, fais m'en part avant de poursuivre ...
Tuto ( aide ) ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Note : pour XP, bien installer la Console de Récupération de Windows comme il est indiqué dans le tuto ci-dessus ...
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :
double-clique sur l'icône "combofix.exe" pour lancer l'outil .

Appuie sur la touche Y (Yes) pour démarrer le scan .

Notes importantes :
-> n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi .
-> Il se peut que le PC redémarre de lui même ( pour finaliser le nettoyage ) , laisse le faire .
-> Si l'outil t'anonce ceci : "combofix a détecté la présence de rootkit et a besoin de faire redémarer votre machine", tu acceptes ...
-> si un message d'erreur windows apparait à un momment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! sinon pas de rapport ... )

Le rapport sera crée ici : C:\Combofix.txt

Réactive bien tes défenses .

Poste le rapport Combofix accompagné d'un nouveau rapport hijackthis pour analyse ...

Fais sans ...

Salut,

commence par faire ceci :

Télécharge et installe le logiciel HijackThis :

ici HijackThis
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
ou ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html

1- Clique sur le setup pour lancer l'installe : laisse toi guider et ne modifie pas les paramètres d'installation .
A la fin de l'installe , le prg se lance automatiquement : ferme le en cliquant sur la croix rouge .
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme :
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .
Supprime le raccourcis stp ...

Important :
Renommer le prg HijackThis (pour contrer l'infection Vundo):
Rends toi sur ton PC ici "C:\ program files\Trend Micro\HijackThis\HijackThis.exe"<---clique droit sur ce dernier et choisis "renommer" : tape monjack et valide .
Puis clique droit sur "monjack.exe" et choisis "envoyer vers" -> le bureau ( créer un raccourci ).

tuto pour utilisation
Regarde ici, c'est parfaitement expliqué en images (merci balltrap34) :
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm
( Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement )

2-!! Déconnecte toi et ferme toutes tes applications en cours !!

Clique sur le raccourci du bureau pour lancer le prg :
fais un scan "monjack" (ou HijackThis renommé) en cliquant sur : "Do a system scan and save a logfile"

---> Poste le rapport généré pour analyse ...

Essaie de les supprimer grace à spybot :

http://www.spybotupdates.com/files/spybotsd160.exe
Sur le site si tu tapes tes virus dans recherche rapide, il l'a dans sont listing donc peut surement les enlever

merci de votre aide,bon je suis nul...comment je dois l'installer?tout est en anglais,il me demande de scanner mais je comprends pas ou je dois cliquer pour l'installer.

Pour l'install : http://www.spybot.info/fr/tutorial/index.html

Re,

spybot n'y fera que dale ... et d'ailleurs ,il va nous emerder ... ^^

si tu veux t'en sortir , fais ce que je t'ai demandé ici :

http://www.commentcamarche.net/forum/affich 9628672 trojan et malware?#1

j'ai deja Spybot sd avec toutes les MAJ,merci quand meme ; )

je parle de hijack comment l'installer?sur quoi cliquer en premiere merci

: ) je l'ai dis que j'étais nul...

voila le bloc note :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:47:28, on 27/11/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\System32\PnkBstrA.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\PnkBstrB.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {287C8A8A-519F-4348-8A56-D5150800D1BC} - C:\WINDOWS\System32\efcdCUkl.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\fccDuRij.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {821D6CB7-D112-4F28-8BC1-6EE9B809F668} - (no file)
O2 - BHO: {28189c72-8d6e-625a-2b44-66e51885deef} - {feed5881-5e66-44b2-a526-e6d827c98182} - C:\WINDOWS\System32\gqhldd.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\WINDOWS\System32\qoMfdaXn.dll,s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O20 - AppInit_DLLs: gqhldd.dll
O20 - Winlogon Notify: efcAPIBu - C:\WINDOWS\SYSTEM32\efcAPIBu.dll
O20 - Winlogon Notify: fccDuRij - C:\WINDOWS\SYSTEM32\fccDuRij.dll
O20 - Winlogon Notify: fccyaBuU - C:\WINDOWS\SYSTEM32\fccyaBuU.dll
O20 - Winlogon Notify: jkkIyApP - C:\WINDOWS\SYSTEM32\jkkIyApP.dll
O20 - Winlogon Notify: mlJBUNEw - C:\WINDOWS\SYSTEM32\mlJBUNEw.dll
O20 - Winlogon Notify: mlJCrQge - mlJCrQge.dll (file missing)
O20 - Winlogon Notify: pmnLdBQJ - pmnLdBQJ.dll (file missing)
O20 - Winlogon Notify: qoMfdaXn - qoMfdaXn.dll (file missing)
O20 - Winlogon Notify: urqQHaxU - C:\WINDOWS\SYSTEM32\urqQHaxU.dll
O20 - Winlogon Notify: vtUmLbyW - C:\WINDOWS\SYSTEM32\vtUmLbyW.dll
O20 - Winlogon Notify: vtUmmjIc - C:\WINDOWS\SYSTEM32\vtUmmjIc.dll
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe

Tu vois quand tu veux ^^

dans l'ordre :

1- Important :
Désactive le "tea timer" de Spybot S&D en t'aidant de ce tuto animé (merci Balltrap ;) ) :
http://perso.orange.fr/rginformatique/section%20virus/demo%20spybot.htm
( sur la 1er image , clique sur "tea timer" pour lancer l'animation ).

En effet , il risque de géner dans le bon déroulement des outils de désinfections ...

Tu le réactiveras une fois qu'on aura finis de désinfecter ( et pas avant ! ) .
Attention , à ce moment là, Spybot te demandera des modifs de registres :
tu les accepteras toutes ! ...

2- Ensuite , refais un scan hijackthis et postes moi le nouveau rapport obtenu pour contrôle et attends la suite ....

O2 - BHO: {28189c72-8d6e-625a-2b44-66e51885deef} - {feed5881-5e66-44b2-a526-e6d827c98182} - C:\WINDOWS\System32\gqhldd.dll

O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\WINDOWS\System32\qoMfdaXn.dll,s

O20 - Winlogon Notify: efcAPIBu - C:\WINDOWS\SYSTEM32\efcAPIBu.dll
O20 - Winlogon Notify: fccDuRij - C:\WINDOWS\SYSTEM32\fccDuRij.dll
O20 - Winlogon Notify: fccyaBuU - C:\WINDOWS\SYSTEM32\fccyaBuU.dll
O20 - Winlogon Notify: jkkIyApP - C:\WINDOWS\SYSTEM32\jkkIyApP.dll
O20 - Winlogon Notify: mlJBUNEw - C:\WINDOWS\SYSTEM32\mlJBUNEw.dll
O20 - Winlogon Notify: mlJCrQge - mlJCrQge.dll (file missing)
O20 - Winlogon Notify: pmnLdBQJ - pmnLdBQJ.dll (file missing)
O20 - Winlogon Notify: qoMfdaXn - qoMfdaXn.dll (file missing)
O20 - Winlogon Notify: urqQHaxU - C:\WINDOWS\SYSTEM32\urqQHaxU.dll
O20 - Winlogon Notify: vtUmLbyW - C:\WINDOWS\SYSTEM32\vtUmLbyW.dll
O20 - Winlogon Notify: vtUmmjIc - C:\WINDOWS\SYSTEM32\vtUmmjIc.dll

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe

me parraissent bizarre pas vous ?

Passe un pti coup de smitfraudfix en plus

D'accords je m'abstiens mais bon voilà moi je passe un coup de smitfraudfix, ad-aware et spybot et un bon coup de Bitdefender et c'est reparti !

j'ai un onglet de firefox qui s'ouvre avec mes docs ??? bref qu'on en finisse...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:02:46, on 27/11/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\System32\PnkBstrA.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\PnkBstrB.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {287C8A8A-519F-4348-8A56-D5150800D1BC} - C:\WINDOWS\System32\efcdCUkl.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\fccDuRij.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {821D6CB7-D112-4F28-8BC1-6EE9B809F668} - (no file)
O2 - BHO: {28189c72-8d6e-625a-2b44-66e51885deef} - {feed5881-5e66-44b2-a526-e6d827c98182} - C:\WINDOWS\System32\gqhldd.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\WINDOWS\System32\qoMfdaXn.dll,s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O20 - AppInit_DLLs: gqhldd.dll
O20 - Winlogon Notify: efcAPIBu - C:\WINDOWS\SYSTEM32\efcAPIBu.dll
O20 - Winlogon Notify: fccDuRij - C:\WINDOWS\SYSTEM32\fccDuRij.dll
O20 - Winlogon Notify: fccyaBuU - C:\WINDOWS\SYSTEM32\fccyaBuU.dll
O20 - Winlogon Notify: jkkIyApP - C:\WINDOWS\SYSTEM32\jkkIyApP.dll
O20 - Winlogon Notify: mlJBUNEw - C:\WINDOWS\SYSTEM32\mlJBUNEw.dll
O20 - Winlogon Notify: mlJCrQge - mlJCrQge.dll (file missing)
O20 - Winlogon Notify: pmnLdBQJ - pmnLdBQJ.dll (file missing)
O20 - Winlogon Notify: qoMfdaXn - qoMfdaXn.dll (file missing)
O20 - Winlogon Notify: urqQHaxU - C:\WINDOWS\SYSTEM32\urqQHaxU.dll
O20 - Winlogon Notify: vtUmLbyW - C:\WINDOWS\SYSTEM32\vtUmLbyW.dll
O20 - Winlogon Notify: vtUmmjIc - C:\WINDOWS\SYSTEM32\vtUmmjIc.dll
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe

vbg:

[11/27/2008, 17:06:33] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\fenoman\Mes documents\Downloads\VirtumundoBeGone.exe" )
[11/27/2008, 17:07:25] - Detected System Information:
[11/27/2008, 17:07:25] - Windows Version: 5.1.2600, Service Pack 1
[11/27/2008, 17:07:25] - Current Username: fenoman (Admin)
[11/27/2008, 17:07:25] - Windows is in NORMAL mode.
[11/27/2008, 17:07:25] - Searching for Browser Helper Objects:
[11/27/2008, 17:07:25] - BHO 1: {287C8A8A-519F-4348-8A56-D5150800D1BC} ()
[11/27/2008, 17:07:25] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/27/2008, 17:07:25] - Checking for HKLM\...\Winlogon\Notify\efcdCUkl
[11/27/2008, 17:07:25] - Key not found: HKLM\...\Winlogon\Notify\efcdCUkl, continuing.
[11/27/2008, 17:07:25] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/27/2008, 17:07:25] - BHO 3: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} ()
[11/27/2008, 17:07:25] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/27/2008, 17:07:25] - Checking for HKLM\...\Winlogon\Notify\fccDuRij
[11/27/2008, 17:07:25] - Found: HKLM\...\Winlogon\Notify\fccDuRij - This is probably Virtumundo.
[11/27/2008, 17:07:25] - Assigning {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} MSEvents Object
[11/27/2008, 17:07:25] - BHO list has been changed! Starting over...
[11/27/2008, 17:07:25] - BHO 1: {287C8A8A-519F-4348-8A56-D5150800D1BC} ()
[11/27/2008, 17:07:25] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/27/2008, 17:07:25] - Checking for HKLM\...\Winlogon\Notify\efcdCUkl
[11/27/2008, 17:07:25] - Key not found: HKLM\...\Winlogon\Notify\efcdCUkl, continuing.
[11/27/2008, 17:07:25] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/27/2008, 17:07:25] - BHO 3: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} (MSEvents Object)
[11/27/2008, 17:07:25] - ALERT: Found MSEvents Object!
[11/27/2008, 17:07:25] - BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[11/27/2008, 17:07:25] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/27/2008, 17:07:25] - No filename found. Continuing.
[11/27/2008, 17:07:25] - BHO 5: {821D6CB7-D112-4F28-8BC1-6EE9B809F668} ()
[11/27/2008, 17:07:25] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/27/2008, 17:07:25] - No filename found. Continuing.
[11/27/2008, 17:07:25] - BHO 6: {feed5881-5e66-44b2-a526-e6d827c98182} ()
[11/27/2008, 17:07:25] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/27/2008, 17:07:25] - Checking for HKLM\...\Winlogon\Notify\gqhldd
[11/27/2008, 17:07:25] - Key not found: HKLM\...\Winlogon\Notify\gqhldd, continuing.
[11/27/2008, 17:07:25] - Finished Searching Browser Helper Objects
[11/27/2008, 17:07:25] - *** Detected MSEvents Object
[11/27/2008, 17:07:25] - Trying to remove MSEvents Object...
[11/27/2008, 17:07:26] - Terminating Process: IEXPLORE.EXE
[11/27/2008, 17:07:27] - Terminating Process: RUNDLL32.EXE
[11/27/2008, 17:07:27] - Disabling Automatic Shell Restart
[11/27/2008, 17:07:27] - Terminating Process: EXPLORER.EXE
[11/27/2008, 17:07:27] - Suspending the NT Session Manager System Service
[11/27/2008, 17:07:27] - Terminating Windows NT Logon/Logoff Manager
[11/27/2008, 17:07:28] - Re-enabling Automatic Shell Restart
[11/27/2008, 17:07:28] - File to disable: C:\WINDOWS\system32\fccDuRij.dll
[11/27/2008, 17:07:28] - Renaming C:\WINDOWS\system32\fccDuRij.dll -> C:\WINDOWS\system32\fccDuRij.dll.vir
[11/27/2008, 17:07:28] - File successfully renamed!
[11/27/2008, 17:07:28] - Removing HKLM\...\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[11/27/2008, 17:07:28] - Removing HKCR\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[11/27/2008, 17:07:28] - Adding Kill Bit for ActiveX for GUID: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[11/27/2008, 17:07:28] - Deleting ATLEvents/MSEvents Registry entries
[11/27/2008, 17:07:28] - Removing HKLM\...\Winlogon\Notify\fccDuRij
[11/27/2008, 17:07:28] - Searching for Browser Helper Objects:
[11/27/2008, 17:07:28] - BHO 1: {287C8A8A-519F-4348-8A56-D5150800D1BC} ()
[11/27/2008, 17:07:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/27/2008, 17:07:28] - Checking for HKLM\...\Winlogon\Notify\efcdCUkl
[11/27/2008, 17:07:28] - Key not found: HKLM\...\Winlogon\Notify\efcdCUkl, continuing.
[11/27/2008, 17:07:29] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/27/2008, 17:07:29] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[11/27/2008, 17:07:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/27/2008, 17:07:29] - No filename found. Continuing.
[11/27/2008, 17:07:29] - BHO 4: {821D6CB7-D112-4F28-8BC1-6EE9B809F668} ()
[11/27/2008, 17:07:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/27/2008, 17:07:29] - No filename found. Continuing.
[11/27/2008, 17:07:29] - BHO 5: {feed5881-5e66-44b2-a526-e6d827c98182} ()
[11/27/2008, 17:07:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/27/2008, 17:07:29] - Checking for HKLM\...\Winlogon\Notify\gqhldd
[11/27/2008, 17:07:29] - Key not found: HKLM\...\Winlogon\Notify\gqhldd, continuing.
[11/27/2008, 17:07:29] - Finished Searching Browser Helper Objects
[11/27/2008, 17:07:29] - Finishing up...
[11/27/2008, 17:07:29] - A restart is needed.
[11/27/2008, 17:07:33] - Attempting to Restart via STOP error (Blue Screen!)

hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:10:05, on 27/11/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\PnkBstrB.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6D36D2A3-B10C-4E8D-BADA-1E43FA035F2B} - C:\WINDOWS\System32\efcdCUkl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {821D6CB7-D112-4F28-8BC1-6EE9B809F668} - (no file)
O2 - BHO: {28189c72-8d6e-625a-2b44-66e51885deef} - {feed5881-5e66-44b2-a526-e6d827c98182} - C:\WINDOWS\System32\gqhldd.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\WINDOWS\System32\qoMfdaXn.dll,s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O20 - AppInit_DLLs: gqhldd.dll
O20 - Winlogon Notify: efcAPIBu - C:\WINDOWS\SYSTEM32\efcAPIBu.dll
O20 - Winlogon Notify: fccyaBuU - C:\WINDOWS\SYSTEM32\fccyaBuU.dll
O20 - Winlogon Notify: jkkIyApP - C:\WINDOWS\SYSTEM32\jkkIyApP.dll
O20 - Winlogon Notify: mlJBUNEw - C:\WINDOWS\SYSTEM32\mlJBUNEw.dll
O20 - Winlogon Notify: mlJCrQge - mlJCrQge.dll (file missing)
O20 - Winlogon Notify: pmnLdBQJ - pmnLdBQJ.dll (file missing)
O20 - Winlogon Notify: qoMfdaXn - qoMfdaXn.dll (file missing)
O20 - Winlogon Notify: urqQHaxU - C:\WINDOWS\SYSTEM32\urqQHaxU.dll
O20 - Winlogon Notify: vtUmLbyW - C:\WINDOWS\SYSTEM32\vtUmLbyW.dll
O20 - Winlogon Notify: vtUmmjIc - C:\WINDOWS\SYSTEM32\vtUmmjIc.dll
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe

oila dsl pour le temps,mais j'ai tout lu ; )

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:43:42, on 27/11/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\PnkBstrB.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {821D6CB7-D112-4F28-8BC1-6EE9B809F668} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O20 - AppInit_DLLs: gqhldd.dll
O20 - Winlogon Notify: mlJCrQge - mlJCrQge.dll (file missing)
O20 - Winlogon Notify: pmnLdBQJ - pmnLdBQJ.dll (file missing)
O20 - Winlogon Notify: qoMfdaXn - qoMfdaXn.dll (file missing)
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe

j'ai un problème pour installer la console de récupération, j'ai ni le cd et je ne trouve pas le fichier dans mon dd...

ComboFix 08-11-27.01 - fenoman 2008-11-27 18:22:51.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.696 [GMT 1:00]
Lancé depuis: c:\documents and settings\fenoman\Mes documents\Downloads\ComboFix.exe
* Un nouveau point de restauration a été créé

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\fccDuRij.dll.vir

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-27 au 2008-11-27 ))))))))))))))))))))))))))))))))))))
.

2008-11-27 17:19 . 2008-11-27 17:19 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-27 17:19 . 2008-11-27 17:19 <REP> d-------- c:\documents and settings\fenoman\Application Data\Malwarebytes
2008-11-27 17:19 . 2008-11-27 17:19 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-27 17:19 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-27 17:19 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-27 17:15 . 2008-11-27 17:35 <REP> d-------- c:\program files\CCleaner
2008-11-27 16:24 . 2008-11-27 16:24 <REP> d-------- c:\program files\Trend Micro
2008-11-26 21:56 . 2008-11-26 21:56 211 --a------ c:\windows\wininit.ini
2008-11-26 10:13 . 2008-11-26 10:13 <REP> d-------- c:\program files\Microsoft Games
2008-11-23 12:15 . 2002-12-12 00:14 13,312 --a------ c:\windows\system32\msdmo.dll
2008-11-23 12:15 . 2002-12-12 00:14 13,312 --a--c--- c:\windows\system32\dllcache\msdmo.dll
2008-11-23 10:35 . 2008-11-26 15:46 <REP> d-------- c:\program files\PeerGuardian2
2008-11-23 02:11 . 2008-11-23 02:11 <REP> d-------- c:\program files\SystemRequirementsLab
2008-11-23 02:11 . 2008-11-23 02:11 <REP> d-------- c:\documents and settings\fenoman\Application Data\SystemRequirementsLab
2008-11-22 13:48 . 2008-11-22 13:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Age of Empires 3
2008-11-20 21:44 . 2008-11-20 21:44 42,320 --a------ c:\windows\system32\xfcodec.dll
2008-11-20 13:23 . 2008-11-26 18:55 <REP> d-------- c:\windows\LastGood
2008-11-20 13:23 . 2004-07-09 04:27 381,952 --a------ c:\windows\system32\dsound.dll
2008-11-20 13:23 . 2004-07-09 04:27 381,952 --a--c--- c:\windows\system32\dllcache\dsound.dll
2008-11-20 00:19 . 2008-11-20 00:20 <REP> d-------- c:\program files\MagicDisc
2008-11-20 00:19 . 2007-09-05 01:46 92,544 --a------ c:\windows\system32\drivers\mcdbus.sys
2008-11-19 23:02 . 2008-11-19 23:02 <REP> d-------- c:\documents and settings\All Users\Application Data\ATI
2008-11-19 22:20 . 2008-11-20 00:19 <REP> d-------- c:\windows\LastGood.Tmp
2008-11-19 22:18 . 2008-11-19 22:18 <REP> d-------- C:\ATI
2008-11-19 22:08 . 2008-11-19 22:09 <REP> d-------- c:\program files\ma-config.com
2008-11-19 22:08 . 2008-11-19 22:08 <REP> d-------- c:\documents and settings\All Users\Application Data\ma-config.com
2008-11-19 18:30 . 2008-11-19 18:30 <REP> d-------- c:\program files\EA SPORTS
2008-11-17 17:03 . 2008-11-17 17:03 <REP> d-------- c:\documents and settings\fenoman\Application Data\Leadertech
2008-11-16 19:12 . 2002-12-12 00:14 1,798,144 --a------ c:\windows\system32\qedit.dll
2008-11-16 19:12 . 2002-12-12 00:14 1,798,144 --a--c--- c:\windows\system32\dllcache\qedit.dll
2008-11-16 19:12 . 2004-07-09 04:27 470,528 --a------ c:\windows\system32\qdvd.dll
2008-11-16 19:12 . 2004-07-09 04:27 470,528 --a--c--- c:\windows\system32\dllcache\qdvd.dll
2008-11-16 19:12 . 2003-05-30 09:00 132,608 --a--c--- c:\windows\system32\dllcache\devenum.dll
2008-11-16 19:12 . 2003-05-30 09:00 132,608 --a------ c:\windows\system32\devenum.dll
2008-11-16 18:17 . 2008-11-16 18:17 <REP> d--hs---- c:\windows\ftpcache
2008-11-16 11:14 . 2008-11-16 11:14 268 --ah----- C:\sqmdata09.sqm
2008-11-16 11:14 . 2008-11-16 11:14 244 --ah----- C:\sqmnoopt09.sqm
2008-11-16 09:11 . 2008-11-16 19:13 <REP> d-------- c:\windows\Logs
2008-11-16 09:09 . 2008-11-26 18:52 682,280 --a------ c:\windows\system32\pbsvc.exe
2008-11-16 09:00 . 2008-11-16 09:00 <REP> d-------- c:\program files\Ubisoft
2008-11-15 22:23 . 2008-11-15 22:23 170 --a------ c:\windows\system32\spupdsvc.inf
2008-11-15 21:42 . 2008-11-15 21:42 <REP> d--h----- c:\windows\system32\GroupPolicy
2008-11-15 20:41 . 2008-11-15 20:41 25,280 --a------ c:\windows\system32\drivers\hamachi.sys
2008-11-15 18:03 . 2008-11-15 20:41 <REP> d-------- c:\program files\Hamachi
2008-11-15 18:03 . 2008-11-26 19:07 <REP> d-------- c:\documents and settings\fenoman\Application Data\Hamachi
2008-11-13 20:02 . 2008-11-13 20:02 138,332 --a------ c:\windows\system32\3B8AB55F0.TAL
2008-11-13 17:03 . 2008-11-13 17:07 <REP> d-------- C:\TELL ME MORE NV
2008-11-06 14:37 . 2008-11-06 14:37 <REP> d-------- c:\documents and settings\fenoman\Application Data\SPORE
2008-11-06 14:35 . 2008-11-06 14:35 <REP> dr-h----- c:\documents and settings\fenoman\Application Data\SecuROM
2008-11-06 14:28 . 2008-11-06 14:28 <REP> d-------- c:\program files\Electronic Arts
2008-11-05 15:51 . 2008-11-05 15:53 <REP> d-------- c:\documents and settings\fenoman\.bitrock
2008-11-03 22:52 . 2008-11-03 22:52 <REP> d-------- c:\documents and settings\fenoman\Application Data\ubi.com
2008-11-03 22:51 . 2008-11-03 22:52 <REP> d-------- c:\program files\ubi.com
2008-11-03 22:51 . 2008-11-03 22:51 <REP> d-------- c:\program files\Fichiers communs\PocketSoft
2008-11-03 22:51 . 2001-04-12 18:00 182,272 --a------ c:\windows\patchw32.dll
2008-11-03 22:49 . 2008-11-03 22:50 <REP> d-------- C:\Capitalism II
2008-11-01 15:23 . 2008-11-01 15:23 268 --ah----- C:\sqmdata08.sqm
2008-11-01 15:23 . 2008-11-01 15:23 244 --ah----- C:\sqmnoopt08.sqm
2008-10-29 04:10 . 2008-10-29 04:10 3,341,824 --a------ c:\windows\system32\drivers\ati2mtag.sys
2008-10-29 04:10 . 2008-10-29 04:10 3,341,824 --a--c--- c:\windows\system32\dllcache\ati2mtag.sys
2008-10-29 03:23 . 2008-10-29 03:23 425,984 --a------ c:\windows\system32\ATIDEMGX.dll
2008-10-29 03:22 . 2008-10-29 03:22 314,880 --a------ c:\windows\system32\ati2dvag.dll
2008-10-29 03:11 . 2008-10-29 03:11 188,416 --a------ c:\windows\system32\atipdlxx.dll
2008-10-29 03:11 . 2008-10-29 03:11 147,456 --a------ c:\windows\system32\Oemdspif.dll
2008-10-29 03:11 . 2008-10-29 03:11 43,520 --a------ c:\windows\system32\ati2edxx.dll
2008-10-29 03:11 . 2008-10-29 03:11 26,112 --a------ c:\windows\system32\Ati2mdxx.exe
2008-10-29 03:10 . 2008-10-29 03:10 10,973,184 --a------ c:\windows\system32\atioglxx.dll
2008-10-29 03:10 . 2008-10-29 03:10 143,360 --a------ c:\windows\system32\ati2evxx.dll
2008-10-29 03:09 . 2008-10-29 03:09 585,728 --a------ c:\windows\system32\ati2evxx.exe
2008-10-29 03:07 . 2008-10-29 03:07 53,248 --a------ c:\windows\system32\ATIDDC.DLL
2008-10-29 02:57 . 2008-10-29 02:57 4,041,472 --a------ c:\windows\system32\ati3duag.dll
2008-10-29 02:49 . 2008-10-29 02:49 307,200 --a------ c:\windows\system32\atiiiexx.dll
2008-10-29 02:41 . 2008-10-29 02:41 2,472,832 --a------ c:\windows\system32\ativvaxx.dll
2008-10-29 02:40 . 2008-10-29 02:40 60,452 --a------ c:\windows\system32\ativvaxx.cap
2008-10-29 02:25 . 2008-10-29 02:25 48,640 --a------ c:\windows\system32\amdpcom32.dll
2008-10-29 02:21 . 2008-10-29 02:21 389,120 --a------ c:\windows\system32\atikvmag.dll
2008-10-29 02:19 . 2008-10-29 02:19 44,032 --a------ c:\windows\system32\atiadlxx.dll
2008-10-29 02:19 . 2008-10-29 02:19 17,408 --a------ c:\windows\system32\atitvo32.dll
2008-10-29 02:18 . 2008-10-29 02:18 253,952 --a------ c:\windows\system32\atiok3x2.dll
2008-10-29 02:18 . 2008-10-29 02:18 53,248 --a------ c:\windows\system32\drivers\ati2erec.dll
2008-10-29 02:12 . 2008-10-29 02:12 577,536 --a------ c:\windows\system32\ati2cqag.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-26 19:43 --------- d-----w c:\program files\Activision
2008-11-26 18:59 --------- d-----w c:\documents and settings\fenoman\Application Data\Xfire
2008-11-26 18:41 --------- d-----w c:\documents and settings\fenoman\Application Data\uTorrent
2008-11-26 17:53 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-26 17:53 22,328 ----a-w c:\documents and settings\fenoman\Application Data\PnkBstrK.sys
2008-11-26 17:53 107,832 ----a-w c:\windows\system32\PnkBstrB.exe
2008-11-26 08:09 --------- d-----w c:\program files\Xfire
2008-11-25 20:24 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-11-22 12:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-19 21:25 --------- d-----w c:\program files\ATI Technologies
2008-11-14 08:52 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-13 18:50 --------- d-----w c:\program files\iWizz
2008-11-13 16:04 4,608 ----a-w c:\windows\system32\w95inf32.dll
2008-11-13 16:04 2,272 ----a-w c:\windows\system32\w95inf16.dll
2008-11-03 13:26 --------- d-----w c:\program files\rFactor
2008-10-28 20:05 593,920 ------w c:\windows\system32\ati2sgag.exe
2008-10-22 13:12 --------- d-----w c:\program files\Teamspeak2_RC2
2008-10-22 12:51 --------- d-----w c:\documents and settings\fenoman\Application Data\teamspeak2
2008-10-21 17:51 118,784 ----a-w c:\windows\system32\atibrtmon.exe
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-14 19:19 --------- d-----w c:\program files\Logitech
2008-10-14 18:53 81,920 ------r c:\windows\bwUnin-6.1.4.36-8876480L.exe
2008-10-14 18:52 --------- d-----w c:\program files\Fichiers communs\Logitech
2008-10-14 18:19 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-10-14 18:19 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-10-14 18:19 --------- d-----w c:\documents and settings\fenoman\Application Data\Logitech
2008-10-14 18:19 --------- d-----w c:\documents and settings\All Users\Application Data\LogiShrd
2008-10-14 18:18 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-10-14 18:18 --------- d-----w c:\program files\Fichiers communs\Logishrd
2008-10-14 18:16 --------- d-----w c:\documents and settings\fenoman\Application Data\InstallShield
2008-10-14 18:16 --------- d-----w c:\documents and settings\All Users\Application Data\Logitech
2008-10-11 15:50 --------- d-----w c:\program files\Hattrick Organizer
2008-09-30 18:19 --------- d-----w c:\documents and settings\fenoman\Application Data\Pro Cycling Manager 2008
2008-09-27 13:06 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\ctfmon.exe" [2002-08-29 13312]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-10-14 16384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2002-05-29 520192]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 c:\windows\soundman.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2002-08-29 13312]

c:\documents and settings\fenoman\Menu D‚marrer\Programmes\D‚marrage\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-11-20 557568]

c:\documents and settings\fenoman\Menu D‚marrer\Programmes\D‚marrage\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-11-20 557568]

c:\documents and settings\fenoman\Menu D‚marrer\Programmes\D‚marrage\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-11-20 557568]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-10-14 169472]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-14 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=gqhldd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

R1 appdrv01;Application Driver (01);c:\windows\System32\Drivers\appdrv01.sys [2008-07-30 2915944]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [2008-07-29 110160]
S2 appdrvrem01;Application Driver Auto Removal Service (01);c:\windows\System32\appdrvrem01.exe svc []
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2008-08-02 1527900]
S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-11-17 195752]

*Newly Created Service* - PROCEXP90
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{821D6CB7-D112-4F28-8BC1-6EE9B809F668} - (no file)
Notify-mlJCrQge - mlJCrQge.dll
Notify-pmnLdBQJ - pmnLdBQJ.dll
Notify-qoMfdaXn - qoMfdaXn.dll

.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\fenoman\Application Data\Mozilla\Firefox\Profiles\q8h2ii4g.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF -: plugin - c:\documents and settings\fenoman\Application Data\Mozilla\Firefox\Profiles\q8h2ii4g.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF -: plugin - c:\program files\ma-config.com\nphardwaredetection.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-27 18:23:39
Windows 5.1.2600 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(564)
c:\windows\system32\ODBC32.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(620)
c:\windows\System32\dssenh.dll
.
Heure de fin: 2008-11-27 18:24:22
ComboFix-quarantined-files.txt 2008-11-27 17:24:07

Avant-CF: 16 314 359 808 octets libres
Après-CF: 16,306,151,424 octets libres

212 --- E O F --- 2008-11-15 21:37:07

mon hijack...................................................................

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:26:03, on 27/11/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\PnkBstrB.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O20 - AppInit_DLLs: gqhldd.dll
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe