Problème rootkit

on va voir.

pour voir télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Bon ca a pris 2minutes pour le faire mon pc est neuf donc pas beaucoup de données dessus

bon ca va faire mal le fichier .txt est très long lol
ComboFix 08-12-17.01 - Dapzo 2008-12-18 17:42:17.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.2046.1585 [GMT 1:00]
Lancé depuis: c:\documents and settings\Dapzo\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\i
c:\windows\system32\wmsoft04581.exe
c:\windows\system32\wmsoft14871.exe
c:\windows\system32\wmsoft26205.exe
c:\windows\system32\wmsoft47806.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSWINDOWS
-------\Service_MSWindows

((((((((((((((((((((((((((((( Fichiers créés du 2008-11-18 au 2008-12-18 ))))))))))))))))))))))))))))))))))))
.

2008-12-18 17:14 . 2008-12-18 17:14 <REP> d-------- c:\program files\Teamspeak2_RC2
2008-12-17 16:31 . 2008-12-17 16:31 <REP> d-------- c:\windows\system32\fr-fr
2008-12-17 16:31 . 2008-12-17 16:31 <REP> d-------- c:\windows\system32\fr
2008-12-17 16:31 . 2008-12-17 16:31 <REP> d-------- c:\windows\l2schemas
2008-12-17 16:27 . 2008-12-17 16:27 <REP> d-------- c:\program files\Lavalys
2008-12-17 16:19 . 2008-12-17 16:22 <REP> d-------- C:\Fraps
2008-12-17 16:19 . 2008-12-17 16:31 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-17 14:31 . 2008-12-17 14:31 <REP> d-------- c:\documents and settings\All Users\Application Data\ATI
2008-12-17 14:21 . 2008-12-17 14:24 <REP> d-------- c:\program files\ATI Technologies
2008-12-17 14:21 . 2008-12-01 14:35 593,920 --------- c:\windows\system32\ati2sgag.exe
2008-12-17 14:20 . 2008-12-17 14:20 <REP> d-------- C:\ATI
2008-12-17 12:51 . 2008-12-17 14:11 10 --a------ c:\windows\WININIT.INI
2008-12-17 11:04 . 2008-12-17 11:04 <REP> d-------- c:\program files\MSXML 6.0
2008-12-17 11:03 . 2008-12-17 11:03 37 --a------ c:\windows\marscam.ini
2008-12-17 10:55 . 2008-12-17 10:55 <REP> d-------- c:\program files\DC505
2008-12-17 10:55 . 2002-06-05 19:25 352,256 --a------ c:\windows\system32\ijl15.dll
2008-12-17 10:55 . 2002-06-05 19:25 205,824 --a------ c:\windows\system32\Vic32.dll
2008-12-17 10:55 . 2002-06-21 18:34 135,168 --a------ c:\windows\system32\mr310ipv.dll
2008-12-17 10:55 . 2002-07-03 18:01 115,790 --a------ c:\windows\system32\drivers\MR97310v.sys
2008-12-17 10:55 . 2002-07-01 08:14 61,440 --a------ c:\windows\system32\mr310ifv.dll
2008-12-17 10:55 . 2002-06-09 11:51 49,152 --a------ c:\windows\system32\mr310exv.dll
2008-12-17 10:55 . 2002-06-09 11:57 28,672 --a------ c:\windows\system32\mr310exd.dll
2008-12-17 10:55 . 2002-06-05 19:25 15,164 --a------ c:\windows\Mr310twv.ini
2008-12-17 10:55 . 2002-06-05 19:25 12,106 --a------ c:\windows\Mr310twv.src
2008-12-17 09:19 . 2008-12-17 18:52 308 --a------ c:\windows\lexstat.ini
2008-12-17 09:18 . 2008-12-17 09:41 <REP> d-------- c:\program files\Lexmark X1100 Series
2008-12-17 09:17 . 2008-04-13 19:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2008-12-17 09:12 . 2008-12-17 09:12 <REP> d-------- c:\documents and settings\Dapzo\WINDOWS
2008-12-17 09:12 . 1997-04-18 11:49 298,496 --a------ c:\windows\unin040c.exe
2008-12-16 22:19 . 2008-12-16 22:19 <REP> d-------- c:\documents and settings\Dapzo\Application Data\dvdcss
2008-12-16 20:02 . 2008-12-16 20:02 <REP> d-------- c:\documents and settings\Dapzo\Application Data\DAEMON Tools Pro
2008-12-16 20:02 . 2008-12-16 20:02 <REP> d-------- c:\documents and settings\Dapzo\Application Data\DAEMON Tools
2008-12-16 20:01 . 2008-12-18 14:46 <REP> d-------- c:\program files\DAEMON Tools Toolbar
2008-12-16 20:01 . 2008-12-17 06:59 <REP> d-------- c:\program files\DAEMON Tools Lite
2008-12-16 20:01 . 2008-12-16 20:01 <REP> d-------- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2008-12-16 19:55 . 2008-12-16 19:55 <REP> d-------- c:\documents and settings\Dapzo\Application Data\DAEMON Tools Lite
2008-12-16 19:55 . 2008-12-16 19:55 717,296 --a------ c:\windows\system32\drivers\sptd.sys
2008-12-16 19:43 . 2008-12-16 19:43 107,888 --a------ c:\windows\system32\CmdLineExt.dll
2008-12-16 19:37 . 2008-12-16 19:37 <REP> d-------- c:\program files\Bethesda Softworks
2008-12-16 19:37 . 2008-12-16 19:37 <REP> d-------- c:\documents and settings\All Users\Application Data\Fallout3
2008-12-16 19:36 . 2008-12-16 19:36 <REP> d-------- c:\windows\Logs
2008-12-16 19:35 . 2008-12-16 19:35 <REP> d-------- c:\program files\MSBuild
2008-12-16 19:33 . 2008-12-16 19:33 <REP> d-------- c:\windows\system32\XPSViewer
2008-12-16 19:33 . 2008-12-16 19:33 <REP> d-------- c:\program files\Reference Assemblies
2008-12-16 19:33 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2008-12-16 19:32 . 2008-12-16 19:32 <REP> d-------- c:\windows\system32\xlive
2008-12-16 19:32 . 2007-03-12 16:42 3,495,784 --a------ c:\windows\system32\d3dx9_33.dll
2008-12-16 19:32 . 2007-03-12 16:42 1,123,696 --a------ c:\windows\system32\D3DCompiler_33.dll
2008-12-16 19:32 . 2007-03-15 16:57 443,752 --a------ c:\windows\system32\d3dx10_33.dll
2008-12-16 19:32 . 2007-04-04 18:53 81,768 --a------ c:\windows\system32\xinput1_3.dll
2008-12-16 18:32 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\kbdjpn.dll
2008-12-16 18:32 . 2001-08-23 17:47 8,704 --a--c--- c:\windows\system32\dllcache\kbdjpn.dll
2008-12-16 18:32 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\kbdkor.dll
2008-12-16 18:32 . 2001-08-23 17:47 8,192 --a--c--- c:\windows\system32\dllcache\kbdkor.dll
2008-12-16 18:32 . 2008-04-14 03:31 6,144 --a------ c:\windows\system32\kbd106.dll
2008-12-16 18:32 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101c.dll
2008-12-16 18:32 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101b.dll
2008-12-16 18:32 . 2001-08-17 22:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd101c.dll
2008-12-16 18:32 . 2001-08-17 22:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd101b.dll
2008-12-16 18:32 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\kbd103.dll
2008-12-16 18:32 . 2001-08-17 22:55 5,632 --a--c--- c:\windows\system32\dllcache\kbd103.dll
2008-12-16 18:22 . 2008-12-16 18:22 <REP> d-------- c:\program files\Ê¢´óÍøÂç
2008-12-16 03:07 . 2008-12-18 14:32 <REP> d-------- c:\windows\system32\LogFiles
2008-12-15 09:25 . 2007-01-18 13:00 3,968 --a------ c:\windows\system32\drivers\AvgArCln.sys
2008-12-15 09:00 . 2008-12-15 09:00 <REP> d-------- c:\documents and settings\Dapzo\Application Data\vlc
2008-12-15 08:58 . 2008-12-15 08:58 <REP> d-------- c:\program files\VideoLAN
2008-12-15 08:56 . 2008-12-15 08:56 <REP> d-------- c:\program files\Lavasoft
2008-12-15 08:56 . 2008-12-15 08:57 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-14 19:27 . 2008-12-14 19:27 1,081 --a------ c:\windows\bscorenew.dat
2008-12-14 16:17 . 2008-12-18 15:20 <REP> d-------- c:\documents and settings\All Users\Application Data\TrackMania
2008-12-14 16:14 . 2005-05-26 15:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll
2008-12-14 16:13 . 2008-12-14 16:14 <REP> d-------- c:\program files\TmNationsForever
2008-12-14 13:26 . 2008-12-14 13:26 <REP> d-------- c:\program files\ImgBurn
2008-12-14 12:16 . 2008-12-18 17:44 <REP> d-------- c:\program files\DNA
2008-12-14 12:16 . 2008-12-14 12:16 <REP> d-------- c:\program files\BitTorrent
2008-12-14 12:16 . 2008-12-18 17:44 <REP> d-------- c:\documents and settings\Dapzo\Application Data\DNA
2008-12-14 12:16 . 2008-12-16 18:57 <REP> d-------- c:\documents and settings\Dapzo\Application Data\BitTorrent
2008-12-14 11:53 . 2008-12-15 12:40 <REP> d-------- c:\program files\Microsoft IntelliPoint
2008-12-14 11:07 . 2008-12-14 11:07 <REP> d-------- c:\program files\EA GAMES
2008-12-14 11:07 . 2005-02-26 06:34 442,368 -ra------ c:\windows\system32\vp6vfw.dll
2008-12-14 10:42 . 2008-10-16 02:01 1,499,648 -----c--- c:\windows\system32\dllcache\shdocvw.dll
2008-12-14 10:42 . 2008-10-16 02:01 670,208 -----c--- c:\windows\system32\dllcache\wininet.dll
2008-12-14 10:42 . 2008-10-16 02:01 620,544 -----c--- c:\windows\system32\dllcache\urlmon.dll
2008-12-14 10:42 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-12-14 10:42 . 2008-06-14 18:33 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-12-14 10:42 . 2008-08-14 11:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys
2008-12-14 10:41 . 2008-12-12 18:02 3,088,896 -----c--- c:\windows\system32\dllcache\mshtml.dll
2008-12-14 10:41 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-14 10:41 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-14 10:41 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-14 10:41 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-14 10:41 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-12-14 10:41 . 2008-04-11 20:05 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2008-12-14 10:41 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-14 10:41 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-12-14 10:41 . 2008-05-01 15:36 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2008-12-14 10:41 . 2008-10-03 11:03 247,326 -----c--- c:\windows\system32\dllcache\strmdll.dll
2008-12-14 10:41 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2008-12-14 10:37 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2008-12-14 10:37 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
2008-12-14 10:37 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2008-12-14 02:23 . 2008-12-14 02:51 <REP> d-------- c:\windows\BDOSCAN8
2008-12-14 01:45 . 2008-12-14 01:45 <REP> d-------- c:\program files\Common Files
2008-12-14 01:45 . 2003-07-21 04:17 5,174 --a------ c:\windows\system32\nppt9x.vxd
2008-12-14 01:45 . 2005-01-04 19:43 4,682 --a------ c:\windows\system32\npptNT2.sys
2008-12-14 01:31 . 2008-12-14 01:31 <REP> d-------- c:\program files\Games-Masters.com
2008-12-13 21:20 . 2008-12-18 16:20 <REP> d-------- c:\program files\Metin2_France
2008-12-13 21:06 . 2008-12-13 21:06 <REP> d-------- c:\documents and settings\Dapzo\Application Data\TuneUp Software
2008-12-13 21:06 . 2008-12-13 21:06 <REP> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software
2008-12-13 21:06 . 2008-12-13 21:06 306,432 --a------ c:\windows\system32\TuneUpDefragService.exe
2008-12-13 21:06 . 2007-12-20 10:41 29,440 --a------ c:\windows\system32\uxtuneup.dll
2008-12-13 21:05 . 2008-12-13 21:06 <REP> d-------- c:\program files\TuneUp Utilities 2008
2008-12-13 21:05 . 2008-12-15 08:55 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
2008-12-13 20:29 . 2008-12-13 20:29 <REP> d-------- c:\documents and settings\Dapzo\Application Data\teamspeak2
2008-12-13 20:29 . 2008-12-13 20:29 34,064 --a------ c:\windows\system32\lhacm.acm
2008-12-13 20:03 . 2008-12-17 11:34 <REP> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-12-13 19:57 . 2008-12-13 19:57 <REP> d-------- c:\program files\Messenger Plus! Live
2008-12-13 19:49 . 2008-12-14 01:01 <REP> d-------- c:\program files\Windows Live
2008-12-13 19:48 . 2008-12-13 20:11 <REP> d-------- c:\windows\SxsCaPendDel
2008-12-13 19:43 . 2008-12-13 19:43 <REP> d-------- c:\documents and settings\Dapzo\Tracing
2008-12-13 19:41 . 2008-12-13 19:41 <REP> d-------- c:\program files\Microsoft
2008-12-13 19:38 . 2008-12-13 19:38 <REP> d-------- c:\program files\Fichiers communs\Windows Live
2008-12-13 19:34 . 2008-12-16 09:19 <REP> d-------- c:\documents and settings\Dapzo\Contacts
2008-12-13 19:32 . 2008-12-13 19:33 <REP> d--hsc--- c:\program files\Fichiers communs\WindowsLiveInstaller
2008-12-13 19:31 . 2008-12-13 19:49 <REP> d-------- c:\documents and settings\All Users\Application Data\WLInstaller

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-18 16:44 16,608 ----a-w c:\windows\gdrv.sys
2008-12-17 09:56 3,195,392 ----a-w c:\windows\Internet Logs\xDB5.tmp
2008-12-17 09:56 1,592,320 ----a-w c:\windows\Internet Logs\xDB6.tmp
2008-12-16 18:37 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-14 14:43 375,808 ----a-w c:\windows\Internet Logs\xDB3.tmp
2008-12-14 14:43 1,498,112 ----a-w c:\windows\Internet Logs\xDB4.tmp
2008-12-14 14:34 3,011,584 ----a-w c:\windows\Internet Logs\xDB1.tmp
2008-12-14 14:34 1,510,912 ----a-w c:\windows\Internet Logs\xDB2.tmp
2008-12-13 16:27 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-12-13 15:32 --------- d-----w c:\program files\Avira
2008-12-13 15:32 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-12-13 14:44 --------- d-----w c:\program files\Neuf
2008-12-13 14:32 --------- d-----w c:\program files\Realtek
2008-12-13 14:32 --------- d-----w c:\documents and settings\Dapzo\Application Data\InstallShield
2008-12-13 14:28 315,392 ----a-w c:\windows\HideWin.exe
2008-12-13 14:26 --------- d-----w c:\program files\Intel
2008-12-13 14:25 --------- d-----w c:\program files\GIGABYTE
2008-12-13 14:20 --------- d-----w c:\program files\microsoft frontpage
2008-12-13 14:19 558,142 ----a-w c:\windows\java\Packages\WHJPNHJV.ZIP
2008-12-13 14:19 155,995 ----a-w c:\windows\java\Packages\[u]0[/u]1ZBB31B.ZIP
2008-12-13 14:17 --------- d-----w c:\program files\Services en ligne
2008-12-01 22:13 3,452,928 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2008-12-01 19:51 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-14 342336]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="c:\program files\GIGABYTE\GEST\RUN.exe" [2007-12-14 236040]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\System32\xRaidSetup.exe" [2007-08-29 1966080]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2003-05-16 163840]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 c:\windows\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 c:\windows\Alcmtr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-12-10 10:02 216520 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
--------- 2003-08-19 15:48 57344 c:\program files\Lexmark X1100 Series\lxbkbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 03:34 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R0 avgntmgr;avgntmgr;c:\windows\system32\DRIVERS\avgntmgr.sys [2008-12-13 22336]
R1 avgntdd;avgntdd;c:\windows\system32\DRIVERS\avgntdd.sys [2008-12-13 45376]
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [2008-12-13 11776]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2008-12-13 93696]
R3 GEST Service;GEST Service for program management.;"c:\program files\GIGABYTE\GEST\GSvr.exe" [2008-12-13 47624]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2008-12-13 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 15:39]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearch Page = hxxp://recherche.neuf.fr/
uSearch Bar = hxxp://recherche.neuf.fr/ie/default.html
mDefault_Search_URL = hxxp://recherche.neuf.fr/
mSearchAssistant = hxxp://recherche.neuf.fr/ie/default.html

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

c:\windows\bdoscandellang.ini - c:\windows\bdoscandel.exe
c:\windows\Downloaded Program Files\live.ini
c:\windows\Downloaded Program Files\scanoptions.tsi
c:\windows\Downloaded Program Files\lang.ini
c:\windows\Downloaded Program Files\ipsupd.dll
c:\windows\Downloaded Program Files\bdupd.dll
c:\windows\Downloaded Program Files\libfn.dll
c:\windows\Downloaded Program Files\bdcore.dll
c:\windows\Downloaded Program Files\oscan8.ocx
O16 -: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
c:\windows\Downloaded Program Files\oscan8.inf
FF - ProfilePath - c:\documents and settings\Dapzo\Application Data\Mozilla\Firefox\Profiles\urettefo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\documents and settings\Dapzo\Application Data\Mozilla\Firefox\Profiles\urettefo.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
FF - component: c:\documents and settings\Dapzo\Application Data\Mozilla\Firefox\Profiles\urettefo.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-18 17:44:56
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ZoneLabs\vsmon.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Heure de fin: 2008-12-18 17:46:37 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-18 16:46:34

Avant-CF: 441 894 690 816 octets libres
Après-CF: 441,825,325,056 octets libres

292 --- E O F --- 2008-12-18 13:39:52

PS: je préfère préciser pour ce dossier=> Ê¢´óÍøÂç
ce dossier est un jeux en chinois c est pour ca qu il y a cette écriture bizarre.

D après ce que ca met 0 fichier caché, 0 rootkit si j ai bien compris
je viens de refaire un scan le nom de fichier est maintenant
a3l85w6o.sys toujours au meme endroit

désolé double post, c est bon j ai reussi a enlever le rootkit avec ad aware en mode sans echec par contre maintenant j ai un soucis, la commande msconfig ne se lance plus ...

comment ca se fait svp ? :s :s :s :s

bon j ai télécharger msconfig sur le net je pense que ca ira ...

si jretrouve des problèmes je reposterais

Problème résolu.

ad aware qui te trouve quelquechose je suis surpris.

on va regarder un peu mieux car pas mal de choses etrange.
telecharge cela:util pour voir ce que peut etre l infection et agir ensuite.

http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

installe le normallement comme tout autre programme dans c/programme/...............
clique sur do a scan and save a logfile, tu obtiens un rapport que tu colles.

ok voilà

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:22:23, on 19/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\GIGABYTE\GEST\gest.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\GIGABYTE\GEST\GSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\RUN.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\System32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MSConfig] "C:\Documents and Settings\Dapzo\Bureau\msconfig.exe" /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

on va regarder avec cela.pas sur d un resultat.

Télécharge ToolBar-S&D ( Merci à Eric_71, Angeldark, Sham_Rock et XmichouX )
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

* Double-clique sur ToolBar-SD afin de lancer l'installation, un raccourci sera ajouté sur le Bureau.
* Double-clique dessus pour démarrer l'outil; choisis la langue.
* Sous Vista, faire un clic droit et "Exécuter en tant qu'administrateur" (Elévation des privilèges), puis -> Continuer.
* Tape 2 puis sur la touche [Entrée] afin de lancer la suppression.
* Patiente jusqu'à la fin de la recherche.
* À la fin du scan, le rapport s'ouvrira dans le Bloc-notes.
* Poste ce rapport, par copier/coller, dans ta prochaine réponse.
* Le rapport se trouve également sous : C:\TB.txt

comment se comporte ton pc?

voilà le rapport

-----------\\ ToolBar S&D 1.2.6 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Processeur Intel Pentium III Xeon )
BIOS : Award Modular BIOS v6.00PG
USER : Dapzo ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition Classic 8.0.1.30 (Activated)
Firewall : ZoneAlarm Firewall 7.0.483.000 (Activated)
C:\ (Local Disk) - NTFS - Total:465 Go (Free:411 Go)
D:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
Option : [2] ( 19/12/2008|21:43 )

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
Supprime! - C:\Program Files\DAEMON Tools Toolbar

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ Extensions

(Dapzo) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Search Page"="https://actus.sfr.fr"
"Search Bar"="https://actus.sfr.fr"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="https://actus.sfr.fr"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr/"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\ALLUSE~1\Application Data\TrackMania\Cache\F58F4F3763DED2C5CB7FF8BFB43C94D8_Skins%5cVehicles%5cStadiumCar%5cCrackOne.zip

1 - "C:\ToolBar SD\TB_1.txt" - 19/12/2008|21:44 - Option : [2]

-----------\\ Fin du rapport a 21:44:12,35

Mon pc se comporte très bien

juste que j ai vu la fenetre dos s arréter sur DEAMON tools pendant une vingtaine de secondes puis finir l analyse.

1)et cela c est pas tres bien.

C:\DOCUME~1\ALLUSE~1\Application Data\TrackMania\Cache\F58F4F3763DED2C5CB7FF8BFB43C94D8_Skins%5cVehicles%5cStadiumCar%5cCrackOne.zip

degage le.

2)passe cet antimalware, lui garde le car performant pour l instant.

passe cet antimalware, fait comme indique
Telecharges malwaresbytes antimalwares(MBAM) : egalement tres util sur pb de pub mais pas tous malheureusement

Malwarebytes Anti-Malware: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Tutoriel Malwarebytes Anti-Malware: https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm
fais comme indique,mise a jour , scan complet en mode sans echec et les rapports.
COLLE LE RAPPORT APRES SUPPRESSION MERCI.

garde le et lance un scan tout les mois comme indique.

si tu as ad aware tu peux desinstalle car il ne reconnait plus grand chose.

3)colle un rapport hijack.

et voilà pour le scan:
long le scan =)

Malwarebytes' Anti-Malware 1.31
Database version: 1522
Windows 5.1.2600 Service Pack 3

20/12/2008 00:15:06
mbam-log-2008-12-20 (00-15-06).txt

Scan type: Full Scan (C:\|)
Objects scanned: 116119
Time elapsed: 1 hour(s), 10 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:21:36, on 20/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\GIGABYTE\GEST\gest.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\GIGABYTE\GEST\GSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\RUN.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\System32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

c est bon . ad aware inutil garde a la place malwarebyte bien plus performant.