Résultat de google redirigés

Après plusieurs heures de beugs, j'arrive enfin à vous envoyer le rapport d'analyse "Log" fait par Combofix :
Que dois-je faire à présent ?



ComboFix 08-12-02.02 - Ahlaim & Hanen 2008-12-03 23:33:56.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.163 [GMT 1:00]
Lancé depuis: c:\documents and settings\Ahlaim & Hanen\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Ahlaim & Hanen\Bureau\WinXP_FR_PER_BF.EXE
* Un nouveau point de restauration a été créé
.
Error: Cfiles.dat
[i] ADS - svchost.exe: deleted 68 bytes in 1 streams. /i

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\docume~1\AHLAIM~1\LOCALS~1\Temp\NNBar_VCSetup_876923_LOG_IES_NoDMY_AFF.exe
c:\documents and settings\Ahlaim & Hanen\Application Data\installer_fr[1].exe
c:\documents and settings\Ahlaim & Hanen\Application Data\setup_fr[1].exe
c:\documents and settings\Ahlaim & Hanen\Application Data\WinAntiVirus Pro 2006
c:\documents and settings\Ahlaim & Hanen\Application Data\WinAntiVirus Pro 2006\PGE.dat
c:\documents and settings\Ahlaim & Hanen\Local Settings\Application Data\inetinfo.exe
c:\documents and settings\Ahlaim & Hanen\Local Settings\Application Data\lsass.exe
c:\documents and settings\Ahlaim & Hanen\Local Settings\Application Data\services.exe
c:\documents and settings\Ahlaim & Hanen\Local Settings\Application Data\winlogon.exe
c:\documents and settings\Ahlaim & Hanen\Local Settings\Temporary Internet Files\bestwiner.stt
c:\documents and settings\Ahlaim & Hanen\Menu Démarrer\Programmes\Démarrage\Deewoo.lnk
c:\documents and settings\Ahlaim & Hanen\Menu Démarrer\Programmes\Démarrage\TA_Start.lnk
c:\documents and settings\Ahlaim & Hanen\real.txt
c:\documents and settings\All Users\Application Data\WinAntiVirus Pro 2006
c:\documents and settings\All Users\Application Data\WinAntiVirus Pro 2006\AVScheduler.dat
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\OUERGHI Hanen\Application Data\Adssite Advanced Toolbar
c:\documents and settings\OUERGHI Hanen\Application Data\Adssite Advanced Toolbar\advertbuttons.xml
c:\documents and settings\OUERGHI Hanen\Application Data\Adssite Advanced Toolbar\selected.xml
c:\documents and settings\OUERGHI Hanen\Application Data\APPATC~1
c:\documents and settings\OUERGHI Hanen\Application Data\CROSOF~1.NET
c:\documents and settings\OUERGHI Hanen\Application Data\DOBE~1
c:\documents and settings\OUERGHI Hanen\Application Data\GetModule
c:\documents and settings\OUERGHI Hanen\Application Data\GetModule\dicik.gz
c:\documents and settings\OUERGHI Hanen\Application Data\GetModule\kwdik.gz
c:\documents and settings\OUERGHI Hanen\Application Data\GetModule\ofadik.gz
c:\documents and settings\OUERGHI Hanen\Application Data\ICROSO~1.NET
c:\documents and settings\OUERGHI Hanen\Application Data\MCROSO~1
c:\documents and settings\OUERGHI Hanen\Application Data\PPATCH~1
c:\documents and settings\OUERGHI Hanen\Application Data\RACLE~1
c:\documents and settings\OUERGHI Hanen\Application Data\RACLE~1\?ti2evxx.exe
c:\documents and settings\OUERGHI Hanen\Application Data\SEMBLY~1
c:\documents and settings\OUERGHI Hanen\Application Data\SEMBLY~1\?hkdsk.exe
c:\documents and settings\OUERGHI Hanen\Application Data\SKS~1
c:\documents and settings\OUERGHI Hanen\Application Data\SSEMBL~1
c:\documents and settings\OUERGHI Hanen\Application Data\STEM~1
c:\documents and settings\OUERGHI Hanen\Application Data\WinAntiVirus Pro 2006
c:\documents and settings\OUERGHI Hanen\Application Data\WinAntiVirus Pro 2006\PGE.dat
c:\documents and settings\OUERGHI Hanen\Application Data\WNSXS~1
c:\documents and settings\OUERGHI Hanen\Application Data\YMBOLS~1
c:\documents and settings\OUERGHI Hanen\Application Data\YSTEM~1
c:\documents and settings\OUERGHI Hanen\gside.exe
c:\documents and settings\OUERGHI Hanen\Local Settings\Temporary Internet Files\bestwiner.stt
c:\documents and settings\OUERGHI Hanen\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\OUERGHI Hanen\Menu Démarrer\Programmes\Démarrage\Deewoo.lnk
c:\documents and settings\OUERGHI Hanen\Menu Démarrer\Programmes\Démarrage\TA_Start.lnk
c:\documents and settings\OUERGHI Hanen\Menu Démarrer\Programmes\Outerinfo
c:\documents and settings\OUERGHI Hanen\Menu Démarrer\Programmes\Outerinfo\Terms.lnk
c:\documents and settings\OUERGHI Hanen\Menu Démarrer\Programmes\Outerinfo\Uninstall.lnk
c:\documents and settings\OUERGHI Hanen\real.txt
c:\program files\Adobe\profsyv.html
c:\program files\Adssite Advanced Toolbar
c:\program files\appatc~1
c:\program files\asks~1
c:\program files\BChanger
c:\program files\BChanger\bchanger.dll
c:\program files\CPV
c:\program files\CPV\CPV7.dll
c:\program files\CPV\CPV8.dll
c:\program files\CyberLink\hokenowah24418.dll
c:\program files\dobe~1
c:\program files\Dynamic Toolbar
c:\program files\Dynamic Toolbar\batch.bat
c:\program files\Dynamic Toolbar\Cache\go.bmp
c:\program files\Dynamic Toolbar\Cache\home.bmp
c:\program files\Dynamic Toolbar\Cache\logo_pb.bmp
c:\program files\Dynamic Toolbar\Cache\parent_off.bmp
c:\program files\Dynamic Toolbar\Cache\parent_on.bmp
c:\program files\Dynamic Toolbar\Cache\pbfrv2tb0200.cfg
c:\program files\Dynamic Toolbar\Cache\popup_off.bmp
c:\program files\Dynamic Toolbar\Cache\popup_on.bmp
c:\program files\Dynamic Toolbar\Cache\search.bmp
c:\program files\Dynamic Toolbar\Cache\services.bmp
c:\program files\Dynamic Toolbar\Cache\skin.bmp
c:\program files\Dynamic Toolbar\Cache\skin1.bmp
c:\program files\Dynamic Toolbar\Cache\skin2.bmp
c:\program files\Dynamic Toolbar\Cache\skin3.bmp
c:\program files\Dynamic Toolbar\Cache\skin4.bmp
c:\program files\Dynamic Toolbar\Cache\skin5.bmp
c:\program files\Dynamic Toolbar\Cache\store.bmp
c:\program files\Dynamic Toolbar\Cache\style.css
c:\program files\Dynamic Toolbar\Cache\support.bmp
c:\program files\Dynamic Toolbar\Cache\ticker.xml
c:\program files\Dynamic Toolbar\PBFRV2\Cache\_Ticker_ticker.txt
c:\program files\Dynamic Toolbar\PBFRV2\Cache\ErrorLog.txt
c:\program files\Dynamic Toolbar\PBFRV2\Cache\go.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\home.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\logo_pb.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\parent_off.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\parent_on.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\PBFRV2TB0200.cfg
c:\program files\Dynamic Toolbar\PBFRV2\Cache\popup_off.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\popup_on.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\search.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\services.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\skin.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\skin1.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\skin2.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\skin3.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\skin4.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\skin5.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\store.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\style.css
c:\program files\Dynamic Toolbar\PBFRV2\Cache\support.bmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\T16734.tmp
c:\program files\Dynamic Toolbar\PBFRV2\Cache\ticker.xml
c:\program files\Dynamic Toolbar\unins000.dat
c:\program files\Dynamic Toolbar\unins000.exe
c:\program files\ecurit~1
c:\program files\Fichiers communs\winantivirus pro 2006
c:\program files\Fichiers communs\winantivirus pro 2006\WapCHK.dll
c:\program files\Fichiers communs\Yazzle1560OinAdmin.exe
c:\program files\Fichiers communs\Yazzle1560OinUninstaller.exe
c:\program files\fnts~1
c:\program files\GetModule
c:\program files\GetModule\dicik.gz
c:\program files\GetModule\GetModule23.exe
c:\program files\GetModule\GetModule24.exe
c:\program files\GetModule\GetModule25.exe
c:\program files\GetModule\GetModule26.exe
c:\program files\GetModule\GetModule27.exe
c:\program files\GetModule\kwdik.gz
c:\program files\GetModule\squaraksupdate.exe
c:\program files\GetPack
c:\program files\GetPack\dictame.gz
c:\program files\GetPack\gastroupd.exe
c:\program files\GetPack\GetPack20.exe
c:\program files\GetPack\GetPack21.exe
c:\program files\GetPack\GetPack22.exe
c:\program files\GetPack\GetPack23.exe
c:\program files\GetPack\GetPack24.exe
c:\program files\GetPack\trgtame.gz
c:\program files\iCheck
c:\program files\iCheck\Uninstall.exe
c:\program files\inetget2
c:\program files\inetget2\emg.exe
c:\program files\ISM
c:\program files\ISM\BndDrive7.dll
c:\program files\ISM2
c:\program files\ISM2\adhydraupd.exe
c:\program files\ISM2\dictionary.gz
c:\program files\ISM2\ISMPack7.exe
c:\program files\ISM2\targets.gz
c:\program files\mailskinner
c:\program files\mailskinner\autosmiley.xml
c:\program files\mailskinner\OESkinner.dll
c:\program files\MapEDC
c:\program files\mbols~1
c:\program files\mcroso~1.net
c:\program files\Mjcore
c:\program files\Mjcore\Mjcore.dll
c:\program files\NoDNS
c:\program files\outerinfo
c:\program files\outerinfo\FF\chrome.manifest
c:\program files\outerinfo\FF\components\FF.dll
c:\program files\outerinfo\FF\components\OuterinfoAds.xpt
c:\program files\outerinfo\FF\install.rdf
c:\program files\outerinfo\Terms.rtf
c:\program files\pppatc~1
c:\program files\pppatc~1\w?aclt.exe
c:\program files\racle~1
c:\program files\racle~2
c:\program files\Sakora
c:\program files\Sakora\Sakora.exe
c:\program files\smante~1
c:\program files\smbols~1
c:\program files\Spcron
c:\program files\Spcron\Spc.dll
c:\program files\Spcron\Spcron_old.dll
c:\program files\sstem~1
c:\program files\Svconr
c:\program files\Svconr\Svconr.exe
c:\program files\Svconr\Svconr.exe_old457
c:\program files\Svconr\Svconr.exe_old734
c:\program files\Temporary
c:\program files\tsks~1
c:\program files\winantivirus pro 2006
c:\program files\winantivirus pro 2006\history.db
c:\program files\Words
c:\program files\Words\list.txt
c:\program files\Words\script.txt
c:\program files\Words\UnInstall.exe
c:\windows\appatc~1
c:\windows\appatc~1\A?pPatch\
c:\windows\appatc~1\explorer.exe
c:\windows\asks~1
c:\windows\b111.exe
c:\windows\b111.exe.bin
c:\windows\b122.exe
c:\windows\b128.exe
c:\windows\b138.exe
c:\windows\b143.exe
c:\windows\b147.exe
c:\windows\b148.exe
c:\windows\b149.exe
c:\windows\b151.exe
c:\windows\b152.exe
c:\windows\b153.exe
c:\windows\b154.exe
c:\windows\b155.exe
c:\windows\b156.exe
c:\windows\b157.exe
c:\windows\b999.exe
c:\windows\crosof~1.net
c:\windows\Downloaded Program Files\UDC6V_0001_D19M0709NetInstaller.exe
c:\windows\Downloaded Program Files\UERSV_0001_N68M0602NetInstaller.exe
c:\windows\ecurit~1
c:\windows\mbols~1
c:\windows\mcroso~1
c:\windows\mcroso~1.net
c:\windows\mcroso~1.net\n?pdb.exe
c:\windows\mrofinu1148.exe
c:\windows\mrofinu1423.exe
c:\windows\mrofinu881.exe
c:\windows\msskinner
c:\windows\msskinner\msbackup.dat
c:\windows\ppatch~1
c:\windows\pppatc~1
c:\windows\racle~1
c:\windows\scurit~1
c:\windows\smante~1
c:\windows\smbols~1
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\appatc~1
c:\windows\system32\asks~1
c:\windows\system32\crosof~1.net
c:\windows\system32\dobe~1
c:\windows\system32\drivers\mlvysvnq.sys
c:\windows\system32\eqstche.dll
c:\windows\system32\fpebev.dll
c:\windows\system32\fsuyew.dll
c:\windows\system32\ggijcg.exe
c:\windows\system32\ggijcg_navup.dat
c:\windows\system32\hepiop.dll
c:\windows\system32\hhpnqx.dll
c:\windows\system32\huu.dll
c:\windows\system32\icroso~1.net
c:\windows\system32\ieewcqe.dat
c:\windows\system32\ieewcqe.exe
c:\windows\system32\ieewcqe_nav.dat
c:\windows\system32\ieewcqe_navps.dat
c:\windows\system32\kjtgglx.dll
c:\windows\system32\kjvyca.dll
c:\windows\system32\lkml.dll
c:\windows\system32\lqlpfchu.dll
c:\windows\system32\mantec~1
c:\windows\system32\mbols~1
c:\windows\system32\mcroso~1.net
c:\windows\system32\ppatch~1
c:\windows\system32\pppatc~1
c:\windows\system32\qbgo.dll
c:\windows\system32\racle~1
c:\windows\system32\rqohep.dll
c:\windows\system32\rze.dll
c:\windows\system32\sjpftficxe.dll
c:\windows\system32\smante~1
c:\windows\system32\smbols~1
c:\windows\system32\sstem3~1
c:\windows\system32\stem~1
c:\windows\system32\tlckoqt.dll
c:\windows\system32\UpMedia
c:\windows\system32\wcpicomsv32.exe
c:\windows\system32\WinNB58.dll
c:\windows\system32\wnsxs~1
c:\windows\system32\yfiuu.dll
c:\windows\tsitra1148.exe
c:\windows\ymbols~1

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FOPN
-------\Legacy_MLVYSVNQ
-------\Legacy_VSPF
-------\Legacy_VSPF_HK
-------\Service_asc3550p
-------\Service_mlvysvnq
-------\Service_vspf
-------\Service_vspf_hk


((((((((((((((((((((((((((((( Fichiers créés du 2008-11-03 au 2008-12-03 ))))))))))))))))))))))))))))))))))))
.

2008-12-03 21:55 . 2008-12-03 21:55 <REP> d-------- c:\program files\Trend Micro
2008-12-03 18:46 . 2008-12-03 23:06 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-03 18:46 . 2008-12-03 18:46 1,409 --a------ c:\windows\QTFont.for
2008-12-02 17:42 . 2008-12-02 17:42 675,328 --a------ c:\windows\system32\nst2E.dll
2008-11-27 18:39 . 2008-12-03 12:39 53,942 --a------ c:\windows\system32\cont_adsoftinc-remove.exe
2008-11-24 12:51 . 2008-12-01 18:23 22,016 --a------ c:\windows\MDM.EXE
2008-11-23 18:42 . 2008-11-23 18:42 <REP> d--h----- c:\windows\PIF
2008-11-17 20:51 . 2008-11-17 20:51 86,016 --a------ c:\windows\system32\cousk.dll
2008-11-12 21:26 . 2008-09-04 17:45 1,106,944 --------- c:\windows\system32\SET7349.tmp
2008-11-12 21:26 . 2008-09-04 17:45 1,106,944 --------- c:\windows\system32\SET384.tmp
2008-11-12 21:26 . 2008-09-04 17:45 1,106,944 --------- c:\windows\system32\SET223.tmp
2008-11-12 21:26 . 2008-09-04 17:45 1,106,944 --------- c:\windows\system32\SET217.tmp
2008-11-12 21:26 . 2008-09-04 17:45 1,106,944 --------- c:\windows\system32\SET216.tmp
2008-11-12 21:26 . 2008-09-04 17:45 1,106,944 --------- c:\windows\system32\SET215.tmp
2008-11-12 21:26 . 2008-09-04 17:45 1,106,944 --------- c:\windows\system32\SET212.tmp
2008-11-12 21:26 . 2008-09-04 17:45 1,106,944 --a------ c:\windows\system32\SET20F.tmp
2008-11-09 21:27 . 2008-11-09 21:27 29 --a------ c:\windows\system32\wapssqrw.tmp
2008-11-04 01:52 . 2008-11-04 02:27 664 --a--c--- c:\windows\system32\d3d9caps.dat

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-03 22:42 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-12-03 22:37 --------- d-----w c:\program files\CyberLink
2008-12-03 22:12 --------- d-----w c:\program files\Morpheus
2008-12-03 20:35 --------- d-----w c:\program files\eMule
2008-11-11 12:14 90,112 ----a-w c:\windows\DUMP3ba1.tmp
2008-10-29 23:07 --------- d-----w c:\program files\Common Files
2008-10-26 23:30 --------- d-----w c:\program files\OINAnalytics
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-08-11 17:04 2,560 ----a-w c:\documents and settings\OUERGHI Hanen\xbqdcs.exe
2008-08-08 13:05 2,560 ----a-w c:\documents and settings\OUERGHI Hanen\amjfzo.exe
2008-03-27 20:08 827 -c--a-w c:\documents and settings\Ahlaim & Hanen\flcaiy.exe
2008-03-18 10:29 9,296 -c--a-w c:\documents and settings\Ahlaim & Hanen\krcsxr.exe
2008-02-28 01:54 217,088 -c--a-w c:\program files\TTC.dll
2007-11-08 18:46 559,616 -csh--r c:\windows\ccSvcHst.exe
2007-10-17 08:57 561,152 -csh--r c:\windows\LBTWiz.exe
2006-05-02 23:27 56 -csh--r c:\windows\system32\56631618F1.sys
2007-03-14 18:10 10,856 -csha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1101D72F-C0EA-4FB7-A955-8DA3E2FC6F24}]
2008-02-08 02:07 217088 --a------ c:\program files\NetMeeting\retyx777444.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2BFDF611-8267-46BF-B66A-0DF4E9411B54}]
2008-02-28 02:54 217088 --a------ c:\program files\MSN\retyx777444.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b7aa99d4-618b-eb69-2a05-0a3a10c80a05}]
2008-12-02 17:42 675328 --a------ c:\windows\system32\nst2E.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E4556025-2431-4113-A977-B490ED8F6148}]
2008-02-28 02:54 217088 --a------ c:\program files\Movie Maker\retyx777444.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F12E09CA-F38F-46A8-5AB9-325B720AC364}]
2008-04-28 17:40 70144 --a--c--- c:\program files\Adobe\lavuh357.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F619BAD4-1C36-4BB7-A4D3-9D7DD600290C}]
2008-11-12 20:14 116480 --a------ c:\windows\system32\deskad.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-26 171448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-03-05 5566464]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2006-01-06 59040]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2005-01-28 110740]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-07-12 180269]
"LXBUCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 69632]
"lxbumon.exe"="c:\program files\Lexmark 6200 Series\lxbumon.exe" [2005-01-18 196608]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2004-11-22 299008]
"EzPrint"="c:\program files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 61440]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2006-04-17 100056]
"horydyt"="c:\program files\Java\horydyt77798.exe" [2007-08-07 163840]
"{51-13-3B-B1-ZN}"="c:\windows\system32\kmdsrngo.exe" [2007-10-17 57368]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"OoPDFSettingsv6.exe"="c:\program files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe" [2003-11-20 460800]
"ExploreUpdSched"="c:\windows\system32\pwinnldm.exe" [2008-04-29 200774]
"nwiz"="nwiz.exe" [2005-03-05 c:\windows\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-05-17 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\OUERGHI Hanen\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE One6.5\program\quickstart.exe [2004-03-08 36864]

c:\documents and settings\Ahlaim & Hanen\Menu D‚marrer\Programmes\D‚marrage\
Deewoo.lnk - c:\windows\system32\pwinnldm.exe [2008-04-29 200774]
Empty.pif [2007-06-27 42662]
Morpheus.lnk - c:\program files\Morpheus\Morpheus.exe [2006-02-21 676864]
OFFICE One 6.5.lnk - c:\program files\OFFICE One6.5\program\quickstart.exe [2004-03-08 36864]
TA_Start.lnk - c:\windows\system32\kmdsrngo.exe [2007-10-17 57368]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-01-20 65588]
OFFICE One Clock v6.5.lnk - c:\program files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe [2005-08-27 257536]
OFFICE One Notes v6.5.lnk - c:\program files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe [2005-08-27 559104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\\WINDOWS\\system32\\userinit.exe,c:\\DOCUME~1\\AHLAIM~1\\LOCALS~1\\Temp\\services.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"vidc.DIV3"= DivXc32.dll
"vidc.MJPG"= m3jpeg32.dll
"msacm.DivXa32"= divxa32.acm
"vidc.div4"= DivXc32f.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.jpeg"= m3jpeg32.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.3ivx"= 3ivxVfWCodec.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"VIDC.i263"= i263_32.drv
"msacm.imc"= imc32.acm
"VIDC.VP31"= vp31vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\APPS\\Inventime\\my.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Morpheus\\Morpheus.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\DOCUME~1\\AHLAIM~1\\LOCALS~1\\Temp\\services.exe"=
"c:\\APPS\\skype\\phone\\Skype.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08ab2ec8-f473-11dc-89ae-0013d3242999}]
\Shell\AutoRun\command - K:\RavMon.exe
\Shell\explore\Command - K:\RavMon.exe -e
\Shell\open\Command - K:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0cd23162-4bfa-11dc-880c-0013d3242999}]
\Shell\AutoRun\command - E:\RavMon.exe
\Shell\explore\Command - E:\RavMon.exe -e
\Shell\open\Command - E:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11b1a7a0-e78e-11dc-8992-0013d3242999}]
\Shell\AutoRun\command - J:\RavMon.exe
\Shell\explore\Command - J:\RavMon.exe -e
\Shell\open\Command - J:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b241911-6c08-11db-8560-0013d3242999}]
\Shell\AutoRun\command - E:\RavMon.exe
\Shell\open\Command - E:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{828cbd32-9e43-11dc-88e7-0013d3242999}]
\Shell\AutoRun\command - J:\RavMon.exe
\Shell\explore\Command - J:\RavMon.exe -e
\Shell\open\Command - J:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a863ed66-92a8-11db-85e8-0013d3242999}]
\Shell\AutoRun\command - E:\RavMon.exe
\Shell\explore\Command - E:\RavMon.exe -e
\Shell\open\Command - E:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b171a702-95f6-11dc-88d8-0013d3242999}]
\Shell\AutoRun\command - J:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6f2add6-3528-11dc-87ca-0013d3242999}]
\Shell\AutoRun\command - RavMon.exe
\Shell\explore\Command - RavMon.exe -e
\Shell\open\Command - RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{caeda862-ccb5-11db-868c-0013d3242999}]
\Shell\AutoRun\command - E:\RavMon.exe
\Shell\explore\Command - E:\RavMon.exe -e
\Shell\open\Command - E:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e59aa42e-cb76-11dc-8949-0013d3242999}]
\Shell\AutoRun\command - K:\RavMon.exe
\Shell\explore\Command - K:\RavMon.exe -e
\Shell\open\Command - K:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f2ada5f9-7109-11dd-8ad0-0013d3242999}]
\Shell\AutoRun\command - E:\RavMon.exe
\Shell\explore\Command - E:\RavMon.exe -e
\Shell\open\Command - E:\RavMon.exe
.
Contenu du dossier 'Tâches planifiées'

2008-11-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2007-03-15 c:\windows\Tasks\MP Scheduled Quick Scan.job
- c:\program files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe []

2005-08-26 c:\windows\Tasks\Rappel d'enregistrement 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-08-05 13:00]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{3AD79D63-02FE-0F78-8439-5CC0005F81C1} - c:\windows\system32\fsuyew.dll
BHO-{3ED2CE6B-04A8-0C23-8A39-5CC00058D794} - c:\windows\system32\huu.dll
BHO-{98478F2C-676F-AC12-1D29-D90C268EC67C} - c:\windows\system32\sjpftficxe.dll
BHO-{A2A9EF21-79F3-442F-9C9B-6EBC1DAF8C1A} - c:\program files\CyberLink\hokenowah24418.dll
WebBrowser-{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} - (no file)
HKCU-Run-Sakora - c:\program files\Sakora\Sakora.exe
HKLM-Run-Salestart(1) - c:\program files\Fichiers communs\NettoyeurDePC\stm.exe dm=http://nettoyeurdepc.com ad=http://nettoyeurdepc.com
HKLM-Run-asrbrbjj - c:\windows\asrbrbjj.exe
HKLM-Run-ieewcqe - c:\windows\system32\ieewcqe.exe
HKLM-Run-WMC_AutoUpdate - (no file)


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
IE: &Recherche AOL Toolbar - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJ
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Ahlaim & Hanen\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Ahlaim & Hanen\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk -
LSP: c:\windows\system32\cousk.dll

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-03 23:42:36
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

c:\docume~1\AHLAIM~1\LOCALS~1\Temp\services.exe [1944] 0xFB2B3320

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBUCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Recherche de fichiers cachés ...


**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MysqlInventime]
"ImagePath"="c:\apps\INVENT~1\mysql\bin\mysqld-nt --defaults-file=c:\apps\Inventime\mysql\my.ini MysqlInventime"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\uxbhfujr]
"ImagePath"="system32\drivers\szqbavre.dat"
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Fichiers communs\Symantec Shared\CCPROXY.EXE
c:\program files\Fichiers communs\Symantec Shared\CCSETMGR.EXE
c:\program files\Norton Internet Security\ISSVC.exe
c:\program files\Fichiers communs\Symantec Shared\CCEVTMGR.EXE
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe
c:\apps\Powercinema\Kernel\TV\CLSched.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\apps\HIDSERVICE\HidService.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\program files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\slserv.exe
c:\combofix\hidec.exe
c:\apps\ABOARD\AOSD.EXE
c:\program files\Fichiers communs\NettoyeurDePC\stm.exe
c:\windows\system32\lxbucoms.exe
c:\windows\system32\wscntfy.exe
c:\program files\OFFICE One6.5\program\soffice.exe
c:\windows\system32\msiexec.exe
c:\program files\Fichiers communs\Symantec Shared\SNDSrvc.exe
c:\program files\Messenger\msmsgs.exe
c:\combofix\Catchme.tmp
.
**************************************************************************
.
Heure de fin: 2008-12-03 23:56:56 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-03 22:55:32

Avant-CF: 61 233 975 296 octets libres
Après-CF: 63,576,031,232 octets libres

554 --- E O F --- 2008-12-01 15:21:20

re,

j'espère que tu ne vas pas faire comme l'autre fois ... ^^"

si tu en restes là , il va falloir tout recommencer dans peu de temps car tu es encore infecté .... Poste moi les rapports demandés stp que l'on puisse continuer ....