Virus/trojan un peut d'aide svp

salut,

Télécharge HijackThis ici :

-> http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation)

-> http://pageperso.aol.fr/balltrap34/Hijenr.gif

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

Post le rapport généré ici stp...

j'ai un gros problème, je ne peux môme pas télécharger et firefox et internet exploror se ferme je vais voir je dois l'avoir sur men pc normalement.

ok :S

dessolé pour le retards j'au du créer une nouvelle session je ne peux plus rien faire sur l'autre.

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\system32\spoolsv.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\WINDOWS\system32\wltray.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\PROGRA~1\Belkin\BELKIN~1\Tool\WinXPDisableZeroConfigation.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\APPS\SMP\SmpSys.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Pando Networks\Pando\Pando.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\FG\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=6&key=SEARCH
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\system32\wltray.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [XpDis0Conf] C:\PROGRA~1\Belkin\BELKIN~1\Tool\WinXPDisableZeroConfigation.exe VEN_14E4&DEV_4320&SUBSYS_70011799 /d
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-590274603-308833199-2196014909-1007\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'gfjg')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: IMVU.lnk = D:\Documents and Settings\FG\Application Data\IMVUClient\IMVUClient.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: IMVU.lnk = D:\Documents and Settings\FG\Application Data\IMVUClient\IMVUClient.exe (User 'Default user')
O4 - Startup: IMVU.lnk = D:\Documents and Settings\FG\Application Data\IMVUClient\IMVUClient.exe
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - D:\Documents and Settings\FG\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_0_4_0.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

Re,

Je ne voies rien qui me sauterait aux yeux...

passe ceci :

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

@+

ok là je vais devoir partir, je fais ça demain. encore merci @+

ok
@+

voila mon rapport combofix

ComboFix 08-12-15.08 - gfjg 2008-12-16 20:03:29.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1919.1462 [GMT 1:00]
Lancé depuis: d:\documents and settings\gfjg\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-11-16 au 2008-12-16 ))))))))))))))))))))))))))))))))))))
.

2008-12-16 19:15 . 2008-12-16 19:15 <REP> d-------- d:\documents and settings\gfjg\Application Data\VadeRetro
2008-12-15 21:57 . 2004-08-17 01:55 <REP> d--h----- d:\documents and settings\gfjg\Voisinage réseau
2008-12-15 21:57 . 2004-08-17 01:55 <REP> d--h----- d:\documents and settings\gfjg\Voisinage d'impression
2008-12-15 21:57 . 2008-12-03 01:06 <REP> d--h----- d:\documents and settings\gfjg\Modèles
2008-12-15 21:57 . 2008-12-16 19:15 <REP> dr------- d:\documents and settings\gfjg\Mes documents
2008-12-15 21:57 . 2008-12-03 01:06 <REP> dr------- d:\documents and settings\gfjg\Menu Démarrer
2008-12-15 21:57 . 2008-12-15 21:57 <REP> dr------- d:\documents and settings\gfjg\Favoris
2008-12-15 21:57 . 2008-12-16 19:15 <REP> dr------- d:\documents and settings\gfjg\Bureau
2008-12-15 21:57 . 2008-12-02 15:25 <REP> d-------- d:\documents and settings\gfjg\Application Data\You've Got Pictures Screensaver
2008-12-15 21:57 . 2008-12-02 15:27 <REP> d-------- d:\documents and settings\gfjg\Application Data\Symantec
2008-12-15 21:57 . 2008-12-16 19:53 <REP> d-------- d:\documents and settings\gfjg\Application Data\Orbit
2008-12-15 21:57 . 2008-12-15 21:57 <REP> d-------- d:\documents and settings\gfjg\Application Data\Nero
2008-12-15 21:57 . 2008-12-15 21:57 <REP> d-------- d:\documents and settings\gfjg\Application Data\ESET
2008-12-15 21:57 . 2008-12-16 00:15 <REP> d-------- d:\documents and settings\gfjg
2008-12-15 21:54 . 2004-08-17 01:55 <REP> d--h----- d:\documents and settings\Administrateur\Voisinage réseau
2008-12-15 21:54 . 2004-08-17 01:55 <REP> d--h----- d:\documents and settings\Administrateur\Voisinage d'impression
2008-12-15 21:54 . 2008-12-03 01:06 <REP> d--h----- d:\documents and settings\Administrateur\Modèles
2008-12-15 21:54 . 2008-12-02 15:35 <REP> dr------- d:\documents and settings\Administrateur\Mes documents
2008-12-15 21:54 . 2008-12-03 01:06 <REP> dr------- d:\documents and settings\Administrateur\Menu Démarrer
2008-12-15 21:54 . 2008-12-02 15:25 <REP> dr------- d:\documents and settings\Administrateur\Favoris
2008-12-15 21:54 . 2008-12-02 15:35 <REP> dr------- d:\documents and settings\Administrateur\Bureau
2008-12-15 21:54 . 2008-12-02 15:25 <REP> d-------- d:\documents and settings\Administrateur\Application Data\You've Got Pictures Screensaver
2008-12-15 21:54 . 2008-12-02 15:27 <REP> d-------- d:\documents and settings\Administrateur\Application Data\Symantec
2008-12-15 21:54 . 2008-12-15 21:54 <REP> d-------- d:\documents and settings\Administrateur
2008-12-15 21:12 . 2008-12-15 21:12 47,891 --a------ d:\documents and settings\FG\Application Data\upd.exe
2008-12-14 20:12 . 2008-12-16 18:59 <REP> d-------- d:\documents and settings\FG\Application Data\FileZilla
2008-12-14 19:54 . 2008-12-14 19:54 <REP> d-------- c:\program files\FileZilla FTP Client
2008-12-14 16:17 . 2008-12-14 16:17 <REP> d-------- d:\documents and settings\FG\Application Data\Thinstall
2008-12-14 14:46 . 2008-12-14 14:46 <REP> d-------- c:\program files\Active Ports
2008-12-14 14:46 . 1999-12-17 10:13 49,664 --a------ c:\windows\unvise32.exe
2008-12-14 13:24 . 2008-10-07 13:33 201,157 --a------ c:\windows\system32\nvapps.nvb
2008-12-14 12:50 . 2008-12-14 13:23 <REP> d-------- C:\NVIDIA
2008-12-14 02:15 . 2008-12-14 02:15 <REP> d-------- c:\program files\Pando Networks
2008-12-14 00:02 . 2004-01-23 19:54 651,264 --a------ c:\windows\system32\libeay32.dll
2008-12-14 00:02 . 2004-01-23 19:54 147,456 --a------ c:\windows\system32\ssleay32.dll
2008-12-14 00:02 . 2008-12-14 00:02 15,648 --a------ c:\windows\system32\drivers\mdc8021x.sys
2008-12-13 23:14 . 2008-04-13 19:36 8,832 --a------ c:\windows\system32\drivers\wmiacpi.sys
2008-12-13 23:14 . 2008-04-13 19:36 8,832 --a------ c:\windows\system32\dllcache\wmiacpi.sys
2008-12-13 23:14 . 2008-12-13 23:14 552 --a------ c:\windows\system32\d3d8caps.dat
2008-12-13 20:02 . 2008-12-15 20:58 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-13 20:02 . 2008-12-13 20:02 1,409 --a------ c:\windows\QTFont.for
2008-12-13 18:22 . 2008-12-13 18:22 <REP> d-------- d:\documents and settings\FG\Application Data\Sony
2008-12-13 18:22 . 2008-12-13 18:22 <REP> d-------- d:\documents and settings\FG\Application Data\Publish Providers
2008-12-13 18:22 . 2008-12-13 18:22 <REP> d-------- d:\documents and settings\FG\Application Data\NetMedia Providers
2008-12-13 18:13 . 2008-12-13 18:13 <REP> d-------- c:\program files\Vstplugins
2008-12-13 18:12 . 2008-12-13 18:12 <REP> d-------- c:\program files\Sony
2008-12-13 18:01 . 2008-12-13 18:01 <REP> d-------- d:\documents and settings\FG\Application Data\Sony Setup
2008-12-13 18:01 . 2008-12-13 18:01 <REP> d-------- c:\program files\Sony Setup
2008-12-13 17:09 . 2008-12-14 14:26 <REP> d-------- c:\windows\nview
2008-12-13 17:08 . 2008-12-14 14:25 <REP> d-------- c:\program files\VIA
2008-12-13 17:08 . 2008-02-14 14:12 1,389,056 -ra------ c:\windows\system32\drivers\monfilt.sys
2008-12-13 17:08 . 2007-04-12 08:35 331,184 --------- c:\windows\system32\difxapi.dll
2008-12-13 17:08 . 2008-05-21 09:48 277,376 -ra------ c:\windows\system32\drivers\viahduaa.sys
2008-12-13 17:08 . 2007-07-27 17:30 8,704 -ra------ c:\windows\system32\viahdcpl.cpl
2008-12-13 17:07 . 2008-12-13 17:07 <REP> d-------- d:\documents and settings\FG\Application Data\InstallShield
2008-12-13 17:07 . 2008-12-13 19:09 31,617 --a------ c:\windows\Ascd_tmp.ini
2008-12-13 17:07 . 2007-12-29 08:22 10,296 --a------ c:\windows\system32\drivers\ASUSHWIO.SYS
2008-12-13 17:07 . 2004-08-13 11:56 5,810 -ra------ c:\windows\system32\drivers\ASACPI.sys
2008-12-12 22:56 . 2008-12-12 22:58 <REP> d-------- d:\documents and settings\FG\dwhelper
2008-12-12 22:22 . 2008-12-12 22:22 <REP> d-------- d:\documents and settings\FG\Application Data\Desktopicon
2008-12-12 22:22 . 2008-12-13 17:48 <REP> d-------- c:\program files\Unlocker
2008-12-12 20:27 . 2008-12-12 20:27 <REP> d-------- d:\documents and settings\FG\Application Data\AdobeUM
2008-12-12 11:41 . 2008-12-16 00:15 69 --a------ c:\windows\NeroDigital.ini
2008-12-11 19:41 . 2008-12-11 19:41 <REP> d-------- d:\documents and settings\FG\Application Data\Sonic
2008-12-11 19:41 . 2008-12-11 19:41 <REP> d-------- d:\documents and settings\FG\Application Data\Leadertech
2008-12-11 19:04 . 2008-12-11 19:04 <REP> d-------- d:\documents and settings\FG\Application Data\Nero
2008-12-11 19:01 . 2008-12-11 19:01 <REP> d-------- d:\documents and settings\All Users\Application Data\Nero
2008-12-11 19:01 . 2008-12-11 19:01 <REP> d-------- c:\program files\Nero
2008-12-11 19:01 . 2008-12-11 19:03 <REP> d-------- c:\program files\Fichiers communs\Nero
2008-12-11 03:26 . 2008-12-11 03:26 <REP> d--h----- c:\windows\PIF
2008-12-10 08:07 . 2008-10-03 11:03 247,326 --------- c:\windows\system32\dllcache\strmdll.dll
2008-12-08 14:49 . 2008-12-09 14:06 <REP> d-------- d:\documents and settings\FG\Application Data\dvdcss
2008-12-06 11:45 . 2008-12-06 11:45 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-06 11:45 . 2008-12-06 11:45 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-05 02:45 . 2008-12-14 14:48 <REP> d-------- c:\program files\eMule
2008-12-04 21:13 . 2008-12-04 21:13 59 --a------ c:\windows\pp.enc
2008-12-04 21:03 . 2008-12-07 20:29 <REP> d-------- d:\documents and settings\FG\Application Data\Microgaming
2008-12-04 21:03 . 2008-12-04 21:03 <REP> d-------- C:\Microgaming
2008-12-04 15:58 . 2008-12-04 16:22 <REP> d-------- c:\program files\MediaMonkey
2008-12-04 12:43 . 2008-12-04 12:44 <REP> d-------- c:\program files\Universal Extractor
2008-12-03 22:21 . 2008-12-03 22:21 <REP> d-------- d:\documents and settings\FG\Application Data\GrabPro
2008-12-03 20:36 . 2008-12-03 20:36 <REP> d-------- c:\program files\BetClic Poker
2008-12-03 17:08 . 2008-12-16 18:11 <REP> d-------- d:\documents and settings\FG\Application Data\Orbit
2008-12-03 17:08 . 2008-12-04 02:41 <REP> d-------- c:\program files\Orbitdownloader
2008-12-03 17:08 . 2008-12-14 14:45 <REP> d-------- C:\Downloads
2008-12-03 16:42 . 2008-01-07 14:29 352 --ah----- c:\windows\nod32fixtemdono.reg
2008-12-03 16:41 . 2008-12-03 16:41 <REP> d-------- d:\documents and settings\FG\Application Data\ESET
2008-12-03 16:40 . 2008-12-03 16:40 <REP> d-------- d:\documents and settings\All Users\Application Data\ESET
2008-12-03 16:40 . 2008-12-03 16:40 <REP> d-------- c:\program files\ESET
2008-12-03 14:28 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2008-12-03 14:28 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2008-12-03 14:27 . 2008-12-03 14:27 <REP> d-------- c:\windows\Sun
2008-12-03 01:06 . 2008-12-16 19:54 <REP> d--hs---- d:\documents and settings\NetworkService
2008-12-03 01:06 . 2008-12-16 19:54 <REP> d--hs---- d:\documents and settings\LocalService
2008-12-03 01:06 . 2004-08-17 01:55 <REP> d--h----- d:\documents and settings\Default User\Voisinage réseau
2008-12-03 01:06 . 2004-08-17 01:55 <REP> d--h----- d:\documents and settings\Default User\Voisinage d'impression
2008-12-03 01:06 . 2008-12-03 01:06 <REP> d--h----- d:\documents and settings\Default User\Modèles
2008-12-03 01:06 . 2008-12-02 15:35 <REP> dr------- d:\documents and settings\Default User\Mes documents
2008-12-03 01:06 . 2008-12-03 01:06 <REP> dr------- d:\documents and settings\Default User\Menu Démarrer
2008-12-03 01:06 . 2008-12-02 15:25 <REP> dr------- d:\documents and settings\Default User\Favoris
2008-12-03 01:06 . 2008-12-02 15:35 <REP> dr------- d:\documents and settings\Default User\Bureau
2008-12-03 01:06 . 2008-12-16 19:54 <REP> d--h----- d:\documents and settings\Default User
2008-12-03 01:06 . 2004-08-17 01:55 <REP> d--h----- d:\documents and settings\All Users\Modèles
2008-12-03 01:06 . 2008-12-02 20:44 <REP> dr------- d:\documents and settings\All Users\Menu Démarrer
2008-12-03 01:06 . 2004-08-17 01:55 <REP> d-------- d:\documents and settings\All Users\Favoris
2008-12-03 01:06 . 2008-12-04 12:41 <REP> d--hs---- d:\documents and settings\All Users\DRM
2008-12-03 01:06 . 2008-12-03 00:34 <REP> dr------- d:\documents and settings\All Users\Documents
2008-12-03 01:06 . 2008-12-14 19:54 <REP> dr------- d:\documents and settings\All Users\Bureau
2008-12-03 01:06 . 2008-12-03 01:06 <REP> d-------- d:\documents and settings\All Users\Application Data\SBSI
2008-12-03 01:06 . 2008-12-02 15:43 <REP> d-------- d:\documents and settings\All Users
2008-12-03 00:43 . 2008-12-03 00:50 <REP> d-------- d:\documents and settings\FG\Application Data\vlc
2008-12-03 00:41 . 2008-12-03 00:41 <REP> d-------- c:\program files\VideoLAN
2008-12-03 00:34 . 2008-12-03 00:34 <REP> d-------- d:\documents and settings\FG\Application Data\OD2
2008-12-02 23:53 . 2008-12-02 23:53 <REP> d-------- c:\program files\Windows Media Connect 2
2008-12-02 23:51 . 2008-12-02 23:51 <REP> d-------- c:\windows\system32\LogFiles
2008-12-02 23:51 . 2008-12-14 16:40 <REP> d-------- c:\windows\system32\drivers\UMDF
2008-12-02 22:19 . 2008-10-16 21:18 6,066,176 --------- c:\windows\system32\dllcache\ieframe.dll
2008-12-02 22:19 . 2007-04-17 10:32 2,455,488 --------- c:\windows\system32\dllcache\ieapfltr.dat
2008-12-02 22:19 . 2007-03-08 06:10 1,048,576 --------- c:\windows\system32\dllcache\ieframe.dll.mui
2008-12-02 22:19 . 2008-10-16 21:18 459,264 --------- c:\windows\system32\dllcache\msfeeds.dll
2008-12-02 22:19 . 2008-10-16 21:18 383,488 --------- c:\windows\system32\dllcache\ieapfltr.dll
2008-12-02 22:19 . 2008-10-16 21:18 267,776 --------- c:\windows\system32\dllcache\iertutil.dll
2008-12-02 22:19 . 2008-10-16 21:18 63,488 --------- c:\windows\system32\dllcache\icardie.dll
2008-12-02 22:19 . 2008-10-16 21:18 52,224 --------- c:\windows\system32\dllcache\msfeedsbs.dll
2008-12-02 22:19 . 2008-10-16 14:11 13,824 --------- c:\windows\system32\dllcache\ieudinit.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-02 14:24 8,552 ----a-w c:\windows\system32\drivers\asctrm.sys
2008-11-12 12:45 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2008-10-29 03:10 3,341,824 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2008-10-29 03:10 3,341,824 ----a-w c:\windows\system32\dllcache\ati2mtag.sys
2008-10-29 02:23 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll
2008-10-29 02:22 314,880 ----a-w c:\windows\system32\ati2dvag.dll
2008-10-29 02:11 43,520 ----a-w c:\windows\system32\ati2edxx.dll
2008-10-29 02:11 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe
2008-10-29 02:11 188,416 ----a-w c:\windows\system32\atipdlxx.dll
2008-10-29 02:11 147,456 ----a-w c:\windows\system32\Oemdspif.dll
2008-10-29 02:10 143,360 ----a-w c:\windows\system32\ati2evxx.dll
2008-10-29 02:10 10,973,184 ----a-w c:\windows\system32\atioglxx.dll
2008-10-29 02:09 585,728 ----a-w c:\windows\system32\ati2evxx.exe
2008-10-29 02:07 53,248 ----a-w c:\windows\system32\ATIDDC.DLL
2008-10-29 01:57 4,041,472 ----a-w c:\windows\system32\ati3duag.dll
2008-10-29 01:49 307,200 ----a-w c:\windows\system32\atiiiexx.dll
2008-10-29 01:41 2,472,832 ----a-w c:\windows\system32\ativvaxx.dll
2008-10-29 01:25 48,640 ----a-w c:\windows\system32\amdpcom32.dll
2008-10-29 01:21 389,120 ----a-w c:\windows\system32\atikvmag.dll
2008-10-29 01:19 44,032 ----a-w c:\windows\system32\atiadlxx.dll
2008-10-29 01:19 17,408 ----a-w c:\windows\system32\atitvo32.dll
2008-10-29 01:18 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2008-10-29 01:18 253,952 ----a-w c:\windows\system32\atiok3x2.dll
2008-10-29 01:12 577,536 ----a-w c:\windows\system32\ati2cqag.dll
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-21 17:51 118,784 ----a-w c:\windows\system32\atibrtmon.exe
2008-10-17 00:48 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-15 07:06 633,632 ------w c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-09-20 202024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"ATIPTA"="c:\ati technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-06 136600]
"Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]
"Ulead AutoDetector v2"="c:\program files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2005-05-11 127118]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
"wltray.exe"="c:\windows\system32\wltray.exe" [2005-06-08 778318]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]
"NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"XpDis0Conf"="c:\progra~1\Belkin\BELKIN~1\Tool\WinXPDisableZeroConfigation.exe" [2004-02-23 32768]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-06-17 29835264]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"SoundMan"="SOUNDMAN.EXE" [2005-10-24 c:\windows\soundman.exe]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

d:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2008-12-03 1690824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.ulmp3acm"= c:\progra~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm
"msacm.mpegacm "= c:\progra~1\FICHIE~1\ULEADS~1\MPEG\mpegacm.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Pando Networks\\Pando\\pando.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57692:TCP"= 57692:TCP:Pando P2P TCP Listening Port
"57692:UDP"= 57692:UDP:Pando P2P UDP Listening Port

R0 SI3112r;ATI-437A Serial ATA Controller;c:\windows\system32\DRIVERS\SI3112r.sys [1980-01-01 97920]
R2 ekrn;Eset Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" [2007-12-21 468224]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2008-05-03 38176]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2008-12-13 277376]
S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-11-17 195752]
.
Contenu du dossier 'Tâches planifiées'

2008-12-16 c:\windows\Tasks\Configurer mon PC.job
- c:\apps\SMP\PCSETUP.EXE [2005-11-17 10:03]

2008-12-16 c:\windows\Tasks\Extension de garantie.job
- c:\apps\SMP\PBCARNOT.EXE [2005-11-09 13:55]

2008-12-10 c:\windows\Tasks\HDReg.job
- c:\apps\HDReg\HDRegRem.exe [2003-07-15 10:14]
.
.
------- Examen supplémentaire -------
.
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - d:\documents and settings\FG\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe -
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - d:\documents and settings\FG\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk -

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://ma-config.com/activex/hardwaredetection_3_0_4_0.cab
c:\windows\Downloaded Program Files\hardwaredetection.inf
FF - ProfilePath - d:\documents and settings\gfjg\Application Data\Mozilla\Firefox\Profiles\fs1ajg9n.default\
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 20:04:19
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(860)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
Heure de fin: 2008-12-16 20:04:47
ComboFix-quarantined-files.txt 2008-12-16 19:04:37

Avant-CF: 13 759 238 144 octets libres
Après-CF: 13,747,855,360 octets libres

290 --- E O F --- 2008-12-12 02:01:52

bon je pense que c'est bon je n'ai pas eu de probleme en retournant sur ma session précédente. j'ai effectué une analyse et j'avais 2 menaces. merci.

ok fredo.

passe ceci pour voir :

Fais un scan avec cet antispyware :

Telecharge malwarebytes + tutoriel :

-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.

@+