Problèmes problèmes problèmes... infections?

Tu va suivre une procédure à la fois,c'est bien.
En tout cas j'ai voulu t'aider...mais il parait que t'es éblouie par les rapports...
a++

...

Tu peux chaîner sur le scan Nod32 ... mais laisse passer la nuit d' ord !

Bonne nuit.

Up, probleme de copier cole c'est l'ancien rapport genproc avant! dsl ^^

Merci beaucoup poru ton aide Rochdi mais je vais suivre une seule procedure à la foi sinon ca va être galère :

Kduc, voici le rapport laisser par Combofix dois je lancer l'analyse de Nod32 tout de suite?

ComboFix 09-09-08.02 - simon 09/09/2009 0:09.3.2 - FAT32x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.559 [GMT 2:00]
Lancé depuis: c:\documents and settings\simon\Bureau\Combo-Fix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((( Fichiers créés du 2009-08-08 au 2009-09-08 ))))))))))))))))))))))))))))))))))))
.

2009-09-08 21:43 . 2009-09-08 21:43 -------- d-----w- C:\GenProc
2009-09-08 21:29 . 2009-09-08 21:29 -------- d-----w- C:\ToolBar SD
2009-09-08 18:08 . 2009-09-08 18:08 -------- d-----w- C:\outil
2009-09-08 02:14 . 2009-09-08 02:14 -------- d-----w- c:\documents and settings\simon\Application Data\Malwarebytes
2009-09-08 02:14 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-08 02:14 . 2009-09-08 02:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-08 02:14 . 2009-09-08 02:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-08 02:14 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-07 20:02 . 2009-09-07 20:02 -------- d-----w- c:\program files\gPotato.eu
2009-09-07 16:12 . 2009-03-09 13:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll
2009-09-07 16:12 . 2009-03-09 13:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll
2009-09-07 16:12 . 2009-03-09 13:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll
2009-09-07 16:12 . 2009-03-16 12:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2009-09-07 16:12 . 2009-03-16 12:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll
2009-09-07 16:12 . 2009-03-16 12:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll
2009-09-07 16:12 . 2009-03-16 12:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll
2009-09-07 10:43 . 2009-09-07 10:43 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-09-07 00:29 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-07 00:29 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-07 00:29 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-07 00:29 . 2009-09-07 00:29 -------- d-----w- c:\program files\Avira
2009-09-07 00:02 . 2009-09-07 00:02 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-07 00:01 . 2009-09-07 00:01 -------- d-----w- c:\windows\ie8updates
2009-09-06 23:10 . 2007-12-24 15:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-09-06 22:52 . 2009-09-06 22:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-06 22:52 . 2009-09-06 22:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-06 19:09 . 2009-07-03 16:57 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-06 19:09 . 2009-07-03 16:57 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-09-06 19:09 . 2009-07-03 16:57 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-09-06 19:09 . 2009-07-03 16:57 1985536 ------w- c:\windows\system32\dllcache\iertutil.dll
2009-09-06 19:09 . 2009-07-03 16:57 594432 ------w- c:\windows\system32\dllcache\msfeeds.dll
2009-09-06 14:26 . 2004-08-10 03:00 7168 ----a-w- c:\windows\system32\dllcache\wamregps.dll
2009-09-06 14:26 . 2003-04-14 18:29 16384 ----a-w- c:\windows\system32\dllcache\tcptsat.dll
2009-09-06 14:26 . 2001-08-23 15:46 66048 ----a-w- c:\windows\system32\dllcache\s3legacy.dll
2009-09-06 14:26 . 2009-02-09 11:24 2191104 ----a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-09-06 14:26 . 2004-08-10 03:00 7680 ----a-w- c:\windows\system32\dllcache\inetmgr.exe
2009-09-06 14:26 . 2004-08-10 03:00 19968 ----a-w- c:\windows\system32\dllcache\inetsloc.dll
2009-09-06 14:26 . 2004-08-10 03:00 5632 ----a-w- c:\windows\system32\dllcache\iisrstap.dll
2009-09-06 14:26 . 2004-08-10 03:00 173056 ----a-w- c:\windows\system32\dllcache\iisui.dll
2009-09-06 14:26 . 2004-08-10 03:00 6144 ----a-w- c:\windows\system32\dllcache\ftpsapi2.dll
2009-09-06 14:26 . 2004-08-10 03:00 14848 ----a-w- c:\windows\system32\dllcache\iisreset.exe
2009-09-06 14:26 . 2003-04-14 18:29 217088 ----a-w- c:\windows\system32\dllcache\fpmmcsat.dll
2009-09-06 14:22 . 2009-09-06 14:22 -------- d-sh--w- c:\documents and settings\simon\IECompatCache
2009-09-06 14:21 . 2009-09-06 14:21 -------- d-sh--w- c:\documents and settings\simon\PrivacIE
2009-09-06 14:19 . 2009-09-06 14:19 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-09-06 14:17 . 2009-09-06 14:17 -------- d-sh--w- c:\documents and settings\simon\IETldCache
2009-09-06 14:13 . 2009-09-06 14:13 -------- d--h--w- c:\windows\ie8
2009-09-06 13:08 . 2009-09-06 13:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-09-06 02:09 . 2009-09-06 02:09 -------- d-----w- c:\documents and settings\simon\Application Data\Gmail
2009-09-05 01:01 . 2009-09-05 01:01 -------- d-----w- c:\documents and settings\simon\Application Data\BigFishGames
2009-09-05 01:00 . 2009-09-05 01:00 -------- d-----w- c:\program files\Genimo Interactive
2009-09-05 00:42 . 2009-09-05 00:42 -------- d-----w- c:\program files\UZC Trial
2009-09-05 00:18 . 2009-09-05 00:18 -------- d-----w- c:\program files\TuneUpMedia
2009-09-05 00:18 . 2009-09-05 00:18 -------- d-----w- c:\documents and settings\simon\Application Data\TuneUpMedia
2009-09-05 00:18 . 2009-09-05 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUpMedia
2009-09-05 00:16 . 2009-09-05 00:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Azureus
2009-09-05 00:16 . 2009-09-05 00:16 -------- d-----w- c:\documents and settings\simon\Application Data\Azureus
2009-09-05 00:15 . 2009-09-05 00:15 -------- d-----w- c:\program files\Vuze
2009-09-04 20:38 . 2009-09-04 20:38 -------- d-----w- c:\program files\Navilog1
2009-09-04 20:37 . 2009-09-04 20:37 -------- d-----w- C:\FindyKill
2009-09-04 20:25 . 2009-08-18 11:44 53248 ----a-w- c:\windows\system32\CSVer.dll
2009-09-04 20:24 . 2009-09-04 20:24 -------- d-----w- C:\Intel
2009-09-04 19:05 . 2009-09-04 19:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd
2009-09-04 19:05 . 2009-09-04 19:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech
2009-09-04 19:05 . 2009-09-04 19:05 -------- d-----w- c:\program files\Fichiers communs\LogiShrd
2009-09-04 19:03 . 2009-09-04 19:03 -------- d-----w- c:\program files\Logitech
2009-09-04 18:42 . 2009-09-04 18:42 -------- d-----w- c:\documents and settings\postgres\Application Data\Intel
2009-09-04 18:42 . 2009-09-04 18:42 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
2009-09-04 18:42 . 2009-09-04 18:42 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Intel
2009-09-04 18:42 . 2009-09-04 18:42 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel
2009-09-04 18:41 . 2009-05-28 20:23 4203392 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2009-09-04 18:41 . 2008-06-20 08:33 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2009-09-04 18:41 . 2008-06-20 08:32 663552 ----a-w- c:\windows\system32\NETw5c32.dll
2009-09-04 18:41 . 2009-09-04 18:41 -------- d-----w- c:\program files\Fichiers communs\Intel
2009-09-04 18:12 . 2009-09-04 18:12 -------- d-----w- c:\windows\system32\AGEIA
2009-09-04 18:12 . 2009-09-04 18:12 -------- d-----w- c:\program files\AGEIA Technologies
2009-09-04 18:11 . 2009-09-04 18:11 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2009-09-04 18:10 . 2009-09-04 18:10 -------- d-----w- C:\NVIDIA
2009-09-04 17:17 . 2009-09-04 17:17 -------- d-----w- c:\program files\ma-config.com
2009-09-04 17:17 . 2009-09-04 17:17 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-09-04 15:09 . 2009-09-04 15:09 -------- d-----w- c:\program files\backups
2009-09-04 13:49 . 2009-09-04 13:49 -------- d-----w- c:\windows\system32\fr-fr
2009-09-04 13:49 . 2009-09-04 13:49 -------- d-----w- c:\windows\l2schemas
2009-09-04 13:49 . 2009-09-04 13:49 -------- d-----w- c:\windows\system32\fr
2009-09-04 13:49 . 2009-09-04 13:49 -------- d-----w- c:\windows\system32\bits
2009-09-04 12:41 . 2009-09-04 23:58 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-09-04 12:41 . 2009-09-04 12:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-09-04 11:06 . 2009-09-04 11:05 401720 ----a-w- c:\program files\HiJackThis.exe
2009-09-04 11:05 . 2009-09-04 11:05 401720 ----a-w- C:\HiJackThis.exe
2009-09-04 10:55 . 2009-09-04 10:55 -------- d-----w- c:\documents and settings\simon\Application Data\HouseCall 6.6
2009-08-22 11:30 . 2009-08-22 11:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2009-08-22 10:54 . 2009-08-22 10:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment.temp
2009-08-22 10:35 . 2009-08-22 10:35 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-22 10:35 . 2009-08-22 10:35 -------- d-----w- c:\program files\MSBuild
2009-08-22 10:35 . 2009-08-22 10:35 -------- d-----w- c:\program files\Reference Assemblies
2009-08-22 10:33 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-22 10:33 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-22 10:33 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-22 10:33 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-22 10:33 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-22 10:33 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-22 10:33 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-22 10:33 . 2009-08-22 10:33 -------- d-----w- C:\f9033b2800b132f05d3b
2009-08-17 08:52 . 2009-08-17 08:52 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-08-14 11:44 . 2009-08-14 11:45 -------- d-----w- c:\program files\Fichiers communs\Blizzard Entertainment
2009-08-13 22:29 . 2009-08-13 22:29 1722 ----a-w- c:\windows\system32\SpoonUninstall-Objectif Tarot.dat
2009-08-13 22:29 . 2009-08-13 22:29 131584 ----a-w- c:\windows\system32\SpoonUninstall.exe
2009-08-13 22:29 . 2009-08-13 22:29 -------- d-----w- c:\program files\Objectif Tarot
2009-08-13 21:02 . 2009-08-13 21:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2009-08-13 19:30 . 2009-08-13 19:30 -------- d-----w- c:\program files\Dofus
2009-08-13 13:59 . 2009-08-13 13:59 -------- d-----w- c:\windows\ServicePackFiles
2009-08-13 10:45 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-08 21:41 . 2009-09-04 11:06 11346 ----a-w- c:\program files\hijackthis.log
2009-09-06 22:41 . 2006-09-28 14:43 85834 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-06 22:41 . 2006-09-28 14:43 512530 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-04 14:17 . 2006-11-28 22:58 55224 ----a-w- c:\documents and settings\simon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-04 14:16 . 2006-06-09 13:45 8224 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 09:00 . 2004-08-10 03:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-02 18:20 . 2009-08-02 18:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Babylon
2009-08-02 18:20 . 2009-08-02 18:20 -------- d-----w- c:\documents and settings\simon\Application Data\Babylon
2009-08-02 17:53 . 2009-08-02 17:53 -------- d-----w- c:\program files\Cyanide
2009-07-21 20:05 . 2009-07-21 20:05 -------- d-----w- c:\documents and settings\simon\Application Data\The Creative Assembly
2009-07-20 21:07 . 2009-07-20 21:07 -------- d-----w- c:\program files\Common Files
2009-07-20 20:38 . 2009-07-20 20:38 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-07-20 20:38 . 2009-07-20 20:38 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-07-20 20:34 . 2009-07-20 20:34 -------- d-----w- c:\program files\Microsoft IntelliPoint
2009-07-20 20:30 . 2009-07-20 20:30 -------- d-----w- c:\program files\MSXML 6.0
2009-07-20 18:40 . 2009-07-20 18:40 -------- d--h--r- c:\documents and settings\simon\Application Data\SecuROM
2009-07-17 19:03 . 2004-08-10 03:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-10 03:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2006-01-09 18:02 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-25 18:36 . 2004-08-10 03:00 95744 ----a-w- c:\windows\system32\mqsec.dll
2009-06-25 18:36 . 2004-08-10 03:00 661504 ----a-w- c:\windows\system32\mqqm.dll
2009-06-25 18:36 . 2004-08-10 03:00 527360 ----a-w- c:\windows\system32\mqutil.dll
2009-06-25 18:36 . 2004-08-10 03:00 517120 ----a-w- c:\windows\system32\mqsnap.dll
2009-06-25 18:36 . 2004-08-10 03:00 48640 ----a-w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:36 . 2004-08-10 03:00 47104 ----a-w- c:\windows\system32\mqdscli.dll
2009-06-25 18:36 . 2004-08-10 03:00 225280 ----a-w- c:\windows\system32\mqoa.dll
2009-06-25 18:36 . 2004-08-10 03:00 186880 ----a-w- c:\windows\system32\mqtrig.dll
2009-06-25 18:36 . 2004-08-10 03:00 177152 ----a-w- c:\windows\system32\mqrt.dll
2009-06-25 18:36 . 2004-08-10 03:00 16896 ----a-w- c:\windows\system32\mqise.dll
2009-06-25 18:36 . 2004-08-10 03:00 138240 ----a-w- c:\windows\system32\mqad.dll
2009-06-25 18:36 . 2004-08-10 03:00 123392 ----a-w- c:\windows\system32\mqrtdep.dll
2009-06-25 08:26 . 2004-08-10 03:00 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2004-08-10 03:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2004-08-10 03:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2004-08-10 03:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:26 . 2004-08-10 03:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2004-08-10 03:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2004-08-10 03:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-22 11:49 . 2004-08-10 03:00 19968 ----a-w- c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2004-08-10 03:00 117248 ----a-w- c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2004-08-10 03:00 4608 ----a-w- c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2004-08-10 03:00 91776 ----a-w- c:\windows\system32\drivers\mqac.sys
2009-06-16 14:40 . 2004-08-10 03:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2004-08-10 03:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 10:44 . 2004-08-10 03:00 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-15 10:44 . 2004-08-10 03:00 78848 ----a-w- c:\windows\system32\telnet.exe
2008-04-14 18:02 . 2008-04-14 18:02 6116304 ----a-w- c:\program files\Firefox Setup 2.0.0.13.exe
2007-03-20 19:07 . 2007-03-20 19:07 251 ----a-w- c:\program files\wt3d.ini
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-09-02 1682744]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"preload"="c:\windows\RUNXMLPL.exe" [2005-05-19 32768]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-30 13594624]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-03-30 421888]
"Boot"="c:\acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 579584]
"Acer ePresentation HPD"="c:\acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-03-31 204800]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-30 86016]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-05-21 1372160]
"IntelWireless"="c:\program files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" [2009-05-21 1202448]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-07 488984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-07 774168]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-30 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-11-28 45056]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BlueSoleil.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BlueSoleil.lnk
backup=c:\windows\pss\BlueSoleil.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^simon^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\simon\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\WINDOWS\\System32\\DPNSvr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Cyanide\\Blood Bowl\\BB.exe"=
"c:\\Program Files\\Cyanide\\Blood Bowl\\Autorun\\Exe\\Autorun.exe"=
"c:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"d:\\Azureus Downloads\\[PC] Alien Shooter - Vengeance [RIP] [dopeman]\\Alien Shooter - Vengeance\\AlienShooter.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"16379:TCP"= 16379:TCP:*:Disabled:NortonAV
"14838:TCP"= 14838:TCP:*:Disabled:NortonAV
"18272:TCP"= 18272:TCP:*:Disabled:NortonAV
"16573:TCP"= 16573:TCP:*:Disabled:NortonAV
"18924:TCP"= 18924:TCP:*:Disabled:NortonAV
"14492:TCP"= 14492:TCP:*:Disabled:NortonAV
"17894:TCP"= 17894:TCP:*:Disabled:NortonAV
"16628:TCP"= 16628:TCP:*:Disabled:NortonAV
"16571:TCP"= 16571:TCP:*:Disabled:NortonAV
"14836:TCP"= 14836:TCP:*:Disabled:NortonAV
"16680:TCP"= 16680:TCP:*:Disabled:NortonAV
"4662:TCP"= 4662:TCP:emule tcp
"4672:UDP"= 4672:UDP:*:Disabled:emule udp
"8085:TCP"= 8085:TCP:ddnsfilter
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [07/09/2009 02:29 108289]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [01/02/2008 04:02 65536]
R3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [11/10/2006 10:22 847392]
S1 Filter;Filter;\??\c:\windows\system32\drivers\Filter.sys --> c:\windows\system32\drivers\Filter.sys [?]
S1 mailKmd;mailKmd; [x]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [01/09/2009 08:07 234864]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
.
Contenu du dossier 'Tâches planifiées'

2009-08-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 15:57]

2009-09-08 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 09:20]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.01net.com
mWindow Title =
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: mappy.com
Trusted Zone: orange.fr
Trusted Zone: voila.fr\rw.search.ke
Trusted Zone: weborama.fr\orange
TCP: {0B862223-4730-4F09-BE36-8A48CD2AB881} = 192.168.1.1
TCP: {0CB7D2EE-182B-4156-B9AE-F43A1027A0CC} = 192.168.1.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\simon\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-09 00:13
Windows 5.1.2600 Service Pack 3 FAT NTAPI

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-298767329-583229373-3557058146-1005\Software\SecuROM\License information*]
"datasecu"=hex:bd,f4,1d,bf,6d,7b,5c,ed,78,87,5c,ff,02,89,33,72,ec,0d,bd,45,cd,
53,9f,6e,f5,e4,16,83,18,5b,44,c2,88,0d,1e,06,e6,62,94,c4,d5,1a,b3,d9,6c,aa,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\netprovcredman.dll

- - - - - - - > 'lsass.exe'(812)
c:\windows\system32\netprovcredman.dll

- - - - - - - > 'explorer.exe'(3740)
c:\windows\system32\MSNCHATHOOK.DLL
c:\windows\system32\sysenv.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\MFC71U.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2009-09-08 0:14
ComboFix-quarantined-files.txt 2009-09-08 22:14
ComboFix2.txt 2009-09-06 17:02

Avant-CF: 9 150 300 160 octets libres
Après-CF: 9 098 952 704 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
343 --- E O F --- 2009-09-04 15:18

Merci pour ton aide Rochdi mais je vais suivre une procedure à la foi sinon ca va etre galere

Kduc, voici le rapport que m'a donner ComboFix dois je continuer sur l'analyse de Nod32?

Rapport GenProc 2.623 [1] - 08/09/2009 à 23:43:02
@ Windows XP Service Pack 3 - Mode normal
@ Mozilla Firefox (3.5.2) [Navigateur par défaut]

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :

Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
C:\Program Files\EsetOnlineScanner\log.txt

~~~~ INFORMATION COMPLEMENTAIRE ~~~~

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:43:36, on 08/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\GenProc\outil\simon_GenProc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-298767329-583229373-3557058146-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'postgres')
O4 - HKUS\S-1-5-21-298767329-583229373-3557058146-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'postgres')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B862223-4730-4F09-BE36-8A48CD2AB881}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CB7D2EE-182B-4156-B9AE-F43A1027A0CC}: NameServer = 192.168.1.1
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: eLock Service (eLockService) - - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe

...

Avant de te lancer dans le scan Nod32 comme le préconise Genproc, quelques secondes d' attention et donc, de lecture ... à propos des :

" ...--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\simon\Mes documents\Zik\Zik\IAM\IAM\De la plan‚te mars - 1991 -\06 - crack.mp3
C:\DOCUME~1\simon\Mes documents\Zik\Zik\Cap'tain\Winter Session 2007\06- Nutcracka.mp3 ..."

https://forum.malekal.com/viewtopic.php?t=893&start=

---
Tjrs avant le scan, ...

Clique droit sur ce lien pour installer ComboFix (par sUBs) :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Choisis "Enregistrer sous" (dans IE c'est "Enregistrer la cible/le lien sous..")
et sauvegarde-le (Enregistrer dans) sur le Bureau.

Important : dans "Nom du fichier" enregistre (renomme) "combofix" en combo-fix.exe

Prends connaissance de ce tutoriel : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Ferme toutes les fenêtres et applications.
Déconnecte-toi du net et désactive tes protections résidentes :
https://forum.pcastuces.com/default.asp

Sur le bureau, double clique combo-fix.exe.
Tape sur la touche Y (Yes) pour démarrer le scan.
ComboFix redémarrera ton PC.
Lorsque le scan sera complété, un rapport apparaîtra.
Copie/colle ce rapport dans ta prochaine réponse et nouveau rapport hijackthis.

PS : Le rapport se trouve également ici : C:\Combofix.txt

Ne clique pas dans la fenêtre de Combofix durant l’analyse : cela pourrait provoquer le gel du programme !

Rapport Genproc :

Rapport GenProc 2.623 [1] - 08/09/2009 à 23:43:02
@ Windows XP Service Pack 3 - Mode normal
@ Mozilla Firefox (3.5.2) [Navigateur par défaut]

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :

Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
C:\Program Files\EsetOnlineScanner\log.txt

~~~~ INFORMATION COMPLEMENTAIRE ~~~~

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:43:36, on 08/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\GenProc\outil\simon_GenProc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-298767329-583229373-3557058146-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'postgres')
O4 - HKUS\S-1-5-21-298767329-583229373-3557058146-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'postgres')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B862223-4730-4F09-BE36-8A48CD2AB881}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CB7D2EE-182B-4156-B9AE-F43A1027A0CC}: NameServer = 192.168.1.1
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: eLock Service (eLockService) - - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe

Rapport hijack :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:41:56, on 08/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-298767329-583229373-3557058146-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'postgres')
O4 - HKUS\S-1-5-21-298767329-583229373-3557058146-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'postgres')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B862223-4730-4F09-BE36-8A48CD2AB881}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CB7D2EE-182B-4156-B9AE-F43A1027A0CC}: NameServer = 192.168.1.1
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: eLock Service (eLockService) - - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe

Voici le rapport TB.doc :

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz )
BIOS : Ver 1.00PARTTBL1
USER : simon ( Administrator )
BOOT : Fail-safe boot
Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
Firewall : Norton Internet Worm Protection 2006 (Not Activated)
C:\ (Local Disk) - FAT32 - Total:53 Go (Free:9 Go)
D:\ (Local Disk) - NTFS - Total:53 Go (Free:27 Go)
E:\ (CD or DVD)
H:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [2] ( 08/09/2009|23:29 )

-----------\\ SUPPRESSION

Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\obSearchHistory.dat
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\oberonconfig.xm_
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\partner.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\about.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\update.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sendafriend.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\feedback.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\help.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\uninstall.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\search.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\highlight.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\popup_on.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\popup_off.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\newGames.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\big_city_adventure_sydney16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\the_great_chocolate_chase16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\around_the_world_in_80_days16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\farm_frenzy_216x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\saqqarah16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\chocolatier216x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\jewel_match_216x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\download.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\MagiciansHandbook16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\death_nile16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\dream_day_first_home16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\ranch_rush16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\virtual_farm16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\MahjongChina16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\magic_farm16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\riseAtlantis16x16.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\puzzle.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\action.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\arcade.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mahjong.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\cards.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sports.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\jigsaw.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\kids.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\notFound.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mygames.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\buy.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\trial.gif
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\deals.gif
Supprime! - C:\Program Files\GamesBar\Localization-French.ini
Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1\GamesBar
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar
Supprime! - C:\Program Files\GamesBar

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ Extensions

(simon) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.01net.com/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\simon\Mes documents\Zik\Zik\IAM\IAM\De la plan‚te mars - 1991 -\06 - crack.mp3
C:\DOCUME~1\simon\Mes documents\Zik\Zik\Cap'tain\Winter Session 2007\06- Nutcracka.mp3

1 - "C:\ToolBar SD\TB_1.txt" - 08/09/2009|23:31 - Option : [2]

-----------\\ Fin du rapport a 23:31:53,98

...

ClémB,

Contente-toi de suivre les étapes de Genproc pour le moment !

...

Je m' en doutais : c' est la raison pour la quelle je dis " ... si tu le trouves".

Suis les étapes de Genproc et poste les rapports, stp.

PS : Qoobox n'est pas trouvable

Rapport de GenProc :

Rapport GenProc 2.623 [1] - 08/09/2009 à 20:23:25
@ Windows XP Service Pack 3 - Mode normal
@ Mozilla Firefox (3.5.2) [Navigateur par défaut]

Dans CCleaner, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures" ; par la suite, laisse-le avec ses réglages par défaut. C'est tout.

# Etape 1/ Télécharge :

- Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 (Team IDN) sur ton Bureau.

Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ ; Choisis ta session courante *** simon *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[1]" sur ton bureau).

# Etape 2/

Lance Toolbar-S&D situé sur le Bureau. Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/

Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 4/

Redémarre normalement et poste, dans la même réponse :

- Le contenu du rapport TB.txt situé dans C:\ ;
- Un nouveau rapport HijackThis http://ww1.genproc.com/GenProc-HijackThis ;
- Un nouveau rapport GenProc ;

Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~

# Détections [1] GenProc 2.623 08/09/2009 à 20:23:29
Toolbar:le 08/09/2009 à 20:23:49 "C:\Program Files\GamesBar"

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 20:24:08 ~~

Salut,

OK.

Maintenant, désinstalle ComboFix :

Menu Démarrer > Exécuter... puis entre (copie/colle) dans la fenêtre : combofix /u

Valide par OK.

Supprime aussi ce dossier, si tu le trouves : C:\QooBox <--

---
Ensuite, ...

Télécharge Genproc : http://www.genproc.com/GenProc.exe ;
puis, double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre.

Bonjour, merci encore pour ton aide : voici le rapport de malware :

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2754
Windows 5.1.2600 Service Pack 3

08/09/2009 13:56:08
mbam-log-2009-09-08 (13-56-08).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 228817
Temps écoulé: 32 minute(s), 25 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\oberontb.band (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band.1 (Adware.Gamesbar) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\0535251103110107106.yux (KoobFace.Trace) -> Quarantined and deleted successfully.

Salut,

OK.

Télécharge, installe et mets à jour Malwarebytes Anti-Malwares …
http://forum.telecharger.01net.com/microhebdo/6/tuto-securite/tuto-malwaresbytes-anti-malware-352008/messages-1.html puis, lance un scan COMPLET et poste le rapport.

PS : si MalwareByte's a détecté des infections, clique sur Afficher les résultats,
puis sur Supprimer la sélection.

Ouahouuu! Alors là il y a du neuf! ^^ je peux lancer firefox et l'antivirus en ligne ainsi que spybot! je lance des analyse sur spybot et secuser.com je ne sais pas si tous mes problèmes sont résolu mais en tout cas sa s'améliore! merci beaucoup

Alors, je n'ai pas trouvé enigma software group dans mes programmes, voici le rapport :

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
c:\program files\Enigma Software Group\SpyHunter\Rollback moved successfully.
c:\program files\Enigma Software Group\SpyHunter\Download moved successfully.
c:\program files\Enigma Software Group\SpyHunter moved successfully.
c:\program files\Enigma Software Group moved successfully.
c:\windows\msdownld.tmp moved successfully.
c:\windows\e323567.dat moved successfully.
c:\windows\ex23567.dat moved successfully.
c:\windows\nlmark2.dat moved successfully.
c:\windows\hpm2.dat moved successfully.
c:\windows\mmsmark2.dat moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\simon\LOCALS~1\Temp\Perflib_Perfdata_e24.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\simon\LOCALS~1\Temp\~DFA9C4.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_274.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_ff4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\XUL.mfl scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 09072009_004000

Files moved on Reboot...
File C:\DOCUME~1\simon\LOCALS~1\Temp\Perflib_Perfdata_e24.dat not found!
C:\DOCUME~1\simon\LOCALS~1\Temp\~DFA9C4.tmp moved successfully.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.
C:\WINDOWS\temp\Perflib_Perfdata_274.dat moved successfully.
C:\WINDOWS\temp\Perflib_Perfdata_ff4.dat moved successfully.
C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\XUL.mfl moved successfully.
C:\Documents and Settings\simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\urlclassifier3.sqlite moved successfully.

...

Va voir dans Ajout/suppres... de programme si tu trouves Enigma Software Group.
Si c' est le cas, supprime-le.

1. Désactive tes logiciels de protection.

2. Télécharge OTMoveIt3 (de OldTimer) : http://oldtimer.geekstogo.com/OTMoveIt3.exe

- Enregistre-le sur ton bureau ;
- Double-clique sur OTMoveIt3.exe pour le lancer (l'extension peut ne pas apparaître) ;
- Copie-colle ce qui est en gras, ci-dessous, dans la partie "Paste Instructions for Items to be Moved"
(en-dessous de la barre jaune) :

:Processes
explorer.exe

:Files
c:\program files\Enigma Software Group
c:\windows\msdownld.tmp
c:\windows\e323567.dat
c:\windows\ex23567.dat
c:\windows\nlmark2.dat
c:\windows\hpm2.dat
c:\windows\mmsmark2.dat

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

- Ferme tous tes programmes et clique sur le bouton rouge Moveit! pour lancer le nettoyage ;
- Copie-colle dans ta prochaine réponse tout ce qui se trouve dans la fenêtre Results (en vert à droite)

> Un rapport sera généré dans le dossier C:\ _OTMoveIt\MovedFiles avec la date et l'heure du
passage de l'outil (mmddyyyy_hhmmss.log)

- Ferme OTMoveIt3 (en cliquant sur Exit).

Note : Si un fichier ou un dossier ne sait être supprimé directement, l'outil peut demander un
redémarrage pour terminer le processus. Clique alors sur "Yes" pour accepter...

---

Ensuite, télécharge, installe et mets à jour Malwarebytes Anti-Malwares …
http://forum.telecharger.01net.com/microhebdo/6/tuto-securite/tuto-malwaresbytes-anti-malware-352008/messages-1.html puis, lance un scan COMPLET et poste le rapport.

PS : si MalwareByte's a détecté des infections, clique sur Afficher les résultats,
puis sur Supprimer la sélection.

Merci poyur ta reponse voici le rapport fourni par ComboFix :

ComboFix 09-09-06.01 - simon 06/09/2009 18:49.2.2 - FAT32x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.583 [GMT 2:00]
Running from: c:\documents and settings\simon\Bureau\outil.exe
Command switches used :: outil.exe
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\simon\RavMonLog
c:\program files\DDnsFilter\DDnsFilter.dll
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\windows\010112010146101105.te
c:\windows\0101120101464950.xe
c:\windows\0101120101465054.xe
c:\windows\0101120101465149.xe
c:\windows\0101120101465154.xe
c:\windows\0101120101465249.xe
c:\windows\0101120101465349.xe
c:\windows\0101120101465449.xe
c:\windows\b4657.dat
c:\windows\kb913800.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\rnaph.dll
c:\windows\system32\uninstall.exe
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
c:\windows\tgmark2.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF
-------\Service_SfX
-------\Legacy_ddnsfilter
-------\Service_ddnsfilter

((((((((((((((((((((((((( Files Created from 2009-08-06 to 2009-09-06 )))))))))))))))))))))))))))))))
.

2009-09-06 14:26 . 2004-08-10 03:00 7168 ----a-w- c:\windows\system32\dllcache\wamregps.dll
2009-09-06 14:26 . 2003-04-14 18:29 16384 ----a-w- c:\windows\system32\dllcache\tcptsat.dll
2009-09-06 14:26 . 2001-08-23 15:46 66048 ----a-w- c:\windows\system32\dllcache\s3legacy.dll
2009-09-06 14:26 . 2009-02-09 11:24 2191104 ----a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-09-06 14:26 . 2004-08-10 03:00 7680 ----a-w- c:\windows\system32\dllcache\inetmgr.exe
2009-09-06 14:26 . 2004-08-10 03:00 19968 ----a-w- c:\windows\system32\dllcache\inetsloc.dll
2009-09-06 14:26 . 2004-08-10 03:00 5632 ----a-w- c:\windows\system32\dllcache\iisrstap.dll
2009-09-06 14:26 . 2004-08-10 03:00 173056 ----a-w- c:\windows\system32\dllcache\iisui.dll
2009-09-06 14:26 . 2004-08-10 03:00 6144 ----a-w- c:\windows\system32\dllcache\ftpsapi2.dll
2009-09-06 14:26 . 2004-08-10 03:00 14848 ----a-w- c:\windows\system32\dllcache\iisreset.exe
2009-09-06 14:26 . 2003-04-14 18:29 217088 ----a-w- c:\windows\system32\dllcache\fpmmcsat.dll
2009-09-06 14:22 . 2009-09-06 14:22 -------- d-sh--w- c:\documents and settings\simon\IECompatCache
2009-09-06 14:21 . 2009-09-06 14:21 -------- d-sh--w- c:\documents and settings\simon\PrivacIE
2009-09-06 14:19 . 2009-09-06 14:19 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-09-06 14:17 . 2009-09-06 14:17 -------- d-sh--w- c:\documents and settings\simon\IETldCache
2009-09-06 14:14 . 2009-09-06 14:14 -------- d--h--w- c:\windows\msdownld.tmp
2009-09-06 14:13 . 2009-09-06 14:13 -------- d--h--w- c:\windows\ie8
2009-09-06 13:57 . 2009-01-18 21:35 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-09-06 13:19 . 2009-01-18 21:30 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-09-06 13:08 . 2009-09-06 13:08 -------- d--h--w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-09-06 13:08 . 2009-09-06 13:08 -------- d-----w- c:\program files\Lavasoft
2009-09-06 13:08 . 2009-09-06 13:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-09-06 12:57 . 2009-09-06 12:57 -------- d-----w- c:\program files\Enigma Software Group
2009-09-06 02:24 . 2009-09-06 02:24 4958032 ----a-w- c:\documents and settings\simon\Application Data\pdinstall.exe
2009-09-06 02:21 . 2009-09-06 16:22 67584 ----a-w- c:\documents and settings\simon\Application Data\Gmail\Shell32.dll
2009-09-06 02:10 . 2009-09-06 02:10 422 ----a-w- c:\documents and settings\simon\Application Data\Macromedia\ven32.exe
2009-09-06 02:10 . 2009-09-06 02:10 16141 ----a-w- c:\documents and settings\simon\Application Data\Help\regs32.exe
2009-09-06 02:10 . 2009-09-06 02:10 145131 ----a-w- c:\documents and settings\simon\Application Data\CyberLink\kls.dll
2009-09-06 02:10 . 2009-09-06 02:10 13221 ----a-w- c:\documents and settings\simon\Application Data\Audacity\pup.exe
2009-09-06 02:10 . 2009-09-06 02:10 11232 ----a-w- c:\documents and settings\simon\Application Data\Identities\isdn.dll
2009-09-06 02:09 . 2009-09-06 02:09 130048 ----a-w- c:\documents and settings\simon\Application Data\Gmail\rygwz7313434.exe
2009-09-06 02:09 . 2009-09-06 02:09 -------- d-----w- c:\documents and settings\simon\Application Data\Gmail
2009-09-05 01:01 . 2009-09-05 01:01 -------- d-----w- c:\documents and settings\simon\Application Data\BigFishGames
2009-09-05 01:00 . 2009-09-05 01:00 -------- d-----w- c:\program files\Genimo Interactive
2009-09-05 00:42 . 2009-09-05 00:42 -------- d-----w- c:\program files\UZC Trial
2009-09-05 00:18 . 2009-09-05 00:18 -------- d-----w- c:\program files\TuneUpMedia
2009-09-05 00:18 . 2009-09-05 00:18 -------- d-----w- c:\documents and settings\simon\Application Data\TuneUpMedia
2009-09-05 00:18 . 2009-09-05 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUpMedia
2009-09-05 00:16 . 2009-09-05 00:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Azureus
2009-09-05 00:16 . 2009-09-05 00:16 -------- d-----w- c:\documents and settings\simon\Application Data\Azureus
2009-09-05 00:15 . 2009-09-05 00:15 -------- d-----w- c:\program files\Vuze
2009-09-04 20:38 . 2009-09-04 20:38 -------- d-----w- c:\program files\Navilog1
2009-09-04 20:37 . 2009-09-04 20:37 -------- d-----w- C:\FindyKill
2009-09-04 20:25 . 2009-07-08 14:34 53248 ----a-w- c:\windows\system32\CSVer.dll
2009-09-04 20:24 . 2009-09-04 20:24 -------- d-----w- C:\Intel
2009-09-04 19:07 . 2009-09-04 19:07 10134 ----a-r- c:\documents and settings\simon\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe
2009-09-04 19:07 . 2009-09-04 19:07 10134 ----a-r- c:\documents and settings\simon\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
2009-09-04 19:06 . 2009-09-04 19:06 10134 ----a-r- c:\documents and settings\simon\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe
2009-09-04 19:05 . 2009-09-04 19:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd
2009-09-04 19:05 . 2009-09-04 19:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech
2009-09-04 19:05 . 2009-09-04 19:05 -------- d-----w- c:\program files\Fichiers communs\LogiShrd
2009-09-04 19:03 . 2009-09-04 19:03 -------- d-----w- c:\program files\Logitech
2009-09-04 18:42 . 2009-09-04 18:42 -------- d-----w- c:\documents and settings\postgres\Application Data\Intel
2009-09-04 18:42 . 2009-09-04 18:42 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
2009-09-04 18:42 . 2009-09-04 18:42 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Intel
2009-09-04 18:42 . 2009-09-04 18:42 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel
2009-09-04 18:41 . 2009-05-28 20:23 4203392 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2009-09-04 18:41 . 2008-06-20 08:33 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2009-09-04 18:41 . 2008-06-20 08:32 663552 ----a-w- c:\windows\system32\NETw5c32.dll
2009-09-04 18:41 . 2009-09-04 18:41 -------- d-----w- c:\program files\Fichiers communs\Intel
2009-09-04 18:12 . 2009-09-04 18:12 -------- d-----w- c:\windows\system32\AGEIA
2009-09-04 18:12 . 2009-09-04 18:12 -------- d-----w- c:\program files\AGEIA Technologies
2009-09-04 18:11 . 2009-09-04 18:11 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2009-09-04 18:10 . 2009-09-04 18:10 -------- d-----w- C:\NVIDIA
2009-09-04 17:17 . 2009-09-04 17:17 -------- d-----w- c:\program files\ma-config.com
2009-09-04 17:17 . 2009-09-04 17:17 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-09-04 15:09 . 2009-09-04 15:09 -------- d-----w- c:\program files\backups
2009-09-04 13:49 . 2009-09-04 13:49 -------- d-----w- c:\windows\system32\fr-fr
2009-09-04 13:49 . 2009-09-04 13:49 -------- d-----w- c:\windows\l2schemas
2009-09-04 13:49 . 2009-09-04 13:49 -------- d-----w- c:\windows\system32\fr
2009-09-04 13:49 . 2009-09-04 13:49 -------- d-----w- c:\windows\system32\bits
2009-09-04 12:41 . 2009-09-04 23:58 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-09-04 12:41 . 2009-09-04 12:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-09-04 11:06 . 2009-09-04 11:05 401720 ----a-w- c:\program files\HiJackThis.exe
2009-09-04 11:05 . 2009-09-04 11:05 401720 ----a-w- C:\HiJackThis.exe
2009-09-04 10:56 . 2009-09-04 10:56 1 ---h--w- c:\windows\e323567.dat
2009-09-04 10:55 . 2009-09-04 10:55 -------- d-----w- c:\documents and settings\simon\Application Data\HouseCall 6.6
2009-09-04 10:55 . 2009-09-04 10:55 1 ---h--w- c:\windows\ex23567.dat
2009-09-04 10:55 . 2009-09-04 10:55 37760 ----a-w- c:\windows\system32\drivers\Filter.sys
2009-09-04 10:55 . 2009-09-04 10:55 1 ---h--w- c:\windows\nlmark2.dat
2009-09-04 10:55 . 2009-09-04 10:55 1 ---h--w- c:\windows\hpm2.dat
2009-09-04 10:55 . 2009-09-04 10:55 1 ---h--w- c:\windows\mmsmark2.dat
2009-08-22 11:30 . 2009-08-22 11:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2009-08-22 10:54 . 2009-08-22 10:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment.temp
2009-08-22 10:35 . 2009-08-22 10:35 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-22 10:35 . 2009-08-22 10:35 -------- d-----w- c:\program files\MSBuild
2009-08-22 10:35 . 2009-08-22 10:35 -------- d-----w- c:\program files\Reference Assemblies
2009-08-22 10:33 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-22 10:33 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-22 10:33 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-22 10:33 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-22 10:33 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-22 10:33 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-22 10:33 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-22 10:33 . 2009-08-22 10:33 -------- d-----w- C:\f9033b2800b132f05d3b
2009-08-17 08:52 . 2009-08-17 08:52 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-08-14 11:44 . 2009-08-14 11:45 -------- d-----w- c:\program files\Fichiers communs\Blizzard Entertainment
2009-08-13 22:29 . 2009-08-13 22:29 1722 ----a-w- c:\windows\system32\SpoonUninstall-Objectif Tarot.dat
2009-08-13 22:29 . 2009-08-13 22:29 131584 ----a-w- c:\windows\system32\SpoonUninstall.exe
2009-08-13 22:29 . 2009-08-13 22:29 -------- d-----w- c:\program files\Objectif Tarot
2009-08-13 21:02 . 2009-08-13 21:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2009-08-13 19:30 . 2009-08-13 19:30 -------- d-----w- c:\program files\Dofus
2009-08-13 13:59 . 2009-08-13 13:59 -------- d-----w- c:\windows\ServicePackFiles
2009-08-13 10:45 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-06 13:46 . 2009-09-04 11:06 10493 ----a-w- c:\program files\hijackthis.log
2009-09-04 15:10 . 2006-09-28 14:43 85834 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-04 15:10 . 2006-09-28 14:43 512530 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-04 14:17 . 2006-11-28 22:58 55224 ----a-w- c:\documents and settings\simon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-04 14:16 . 2006-06-09 13:45 8224 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 09:00 . 2004-08-10 03:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-02 18:20 . 2009-08-02 18:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Babylon
2009-08-02 18:20 . 2009-08-02 18:20 -------- d-----w- c:\documents and settings\simon\Application Data\Babylon
2009-08-02 17:53 . 2009-08-02 17:53 -------- d-----w- c:\program files\Cyanide
2009-07-21 20:05 . 2009-07-21 20:05 -------- d-----w- c:\documents and settings\simon\Application Data\The Creative Assembly
2009-07-20 21:07 . 2009-07-20 21:07 -------- d-----w- c:\program files\Common Files
2009-07-20 20:38 . 2009-07-20 20:38 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-07-20 20:38 . 2009-07-20 20:38 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-07-20 20:34 . 2009-07-20 20:34 -------- d-----w- c:\program files\Microsoft IntelliPoint
2009-07-20 20:30 . 2009-07-20 20:30 -------- d-----w- c:\program files\MSXML 6.0
2009-07-20 18:40 . 2009-07-20 18:40 -------- d--h--r- c:\documents and settings\simon\Application Data\SecuROM
2009-07-17 19:03 . 2004-08-10 03:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-10 03:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-06-25 18:36 . 2004-08-10 03:00 95744 ----a-w- c:\windows\system32\mqsec.dll
2009-06-25 18:36 . 2004-08-10 03:00 661504 ----a-w- c:\windows\system32\mqqm.dll
2009-06-25 18:36 . 2004-08-10 03:00 527360 ----a-w- c:\windows\system32\mqutil.dll
2009-06-25 18:36 . 2004-08-10 03:00 517120 ----a-w- c:\windows\system32\mqsnap.dll
2009-06-25 18:36 . 2004-08-10 03:00 48640 ----a-w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:36 . 2004-08-10 03:00 47104 ----a-w- c:\windows\system32\mqdscli.dll
2009-06-25 18:36 . 2004-08-10 03:00 225280 ----a-w- c:\windows\system32\mqoa.dll
2009-06-25 18:36 . 2004-08-10 03:00 186880 ----a-w- c:\windows\system32\mqtrig.dll
2009-06-25 18:36 . 2004-08-10 03:00 177152 ----a-w- c:\windows\system32\mqrt.dll
2009-06-25 18:36 . 2004-08-10 03:00 16896 ----a-w- c:\windows\system32\mqise.dll
2009-06-25 18:36 . 2004-08-10 03:00 138240 ----a-w- c:\windows\system32\mqad.dll
2009-06-25 18:36 . 2004-08-10 03:00 123392 ----a-w- c:\windows\system32\mqrtdep.dll
2009-06-25 08:26 . 2004-08-10 03:00 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2004-08-10 03:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2004-08-10 03:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2004-08-10 03:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:26 . 2004-08-10 03:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2004-08-10 03:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2004-08-10 03:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-22 11:49 . 2004-08-10 03:00 19968 ----a-w- c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2004-08-10 03:00 117248 ----a-w- c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2004-08-10 03:00 4608 ----a-w- c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2004-08-10 03:00 91776 ----a-w- c:\windows\system32\drivers\mqac.sys
2009-06-16 14:40 . 2004-08-10 03:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2004-08-10 03:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 10:44 . 2004-08-10 03:00 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-15 10:44 . 2004-08-10 03:00 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:14 . 2004-08-10 03:00 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:15 . 2004-08-10 03:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
2008-04-14 18:02 . 2008-04-14 18:02 6116304 ----a-w- c:\program files\Firefox Setup 2.0.0.13.exe
2007-03-20 19:07 . 2007-03-20 19:07 251 ----a-w- c:\program files\wt3d.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-09-02 1682744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"preload"="c:\windows\RUNXMLPL.exe" [2005-05-19 32768]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-30 13594624]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-03-30 421888]
"Boot"="c:\acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 579584]
"Acer ePresentation HPD"="c:\acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-03-31 204800]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-30 86016]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-05-21 1372160]
"IntelWireless"="c:\program files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" [2009-05-21 1202448]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-07 488984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-07 774168]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-18 506712]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-30 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-11-28 45056]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BlueSoleil.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BlueSoleil.lnk
backup=c:\windows\pss\BlueSoleil.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^simon^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\simon\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\WINDOWS\\System32\\DPNSvr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Cyanide\\Blood Bowl\\BB.exe"=
"c:\\Program Files\\Cyanide\\Blood Bowl\\Autorun\\Exe\\Autorun.exe"=
"c:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe"=
"c:\\Documents and Settings\\simon\\Bureau\\spybotsd162.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"16379:TCP"= 16379:TCP:*:Disabled:NortonAV
"14838:TCP"= 14838:TCP:*:Disabled:NortonAV
"18272:TCP"= 18272:TCP:*:Disabled:NortonAV
"16573:TCP"= 16573:TCP:*:Disabled:NortonAV
"18924:TCP"= 18924:TCP:*:Disabled:NortonAV
"14492:TCP"= 14492:TCP:*:Disabled:NortonAV
"17894:TCP"= 17894:TCP:*:Disabled:NortonAV
"16628:TCP"= 16628:TCP:*:Disabled:NortonAV
"16571:TCP"= 16571:TCP:*:Disabled:NortonAV
"14836:TCP"= 14836:TCP:*:Disabled:NortonAV
"16680:TCP"= 16680:TCP:*:Disabled:NortonAV
"4662:TCP"= 4662:TCP:emule tcp
"4672:UDP"= 4672:UDP:*:Disabled:emule udp
"8085:TCP"= 8085:TCP:ddnsfilter
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [06/09/2009 15:19 64160]
R1 Filter;Filter;c:\windows\system32\drivers\Filter.sys [04/09/2009 12:55 37760]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 921936]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [01/02/2008 04:02 65536]
R3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [11/10/2006 10:22 847392]
S1 mailKmd;mailKmd; [x]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [01/09/2009 08:07 234864]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
ddnsfilter REG_MULTI_SZ ddnsfilter
.
Contents of the 'Scheduled Tasks' folder

2009-08-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 15:57]

2009-09-06 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 09:20]

2009-09-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 21:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.01net.com
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: mappy.com
Trusted Zone: orange.fr
Trusted Zone: voila.fr\rw.search.ke
Trusted Zone: weborama.fr\orange
TCP: {0B862223-4730-4F09-BE36-8A48CD2AB881} = 192.168.1.1
TCP: {0CB7D2EE-182B-4156-B9AE-F43A1027A0CC} = 192.168.1.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\simon\Application Data\Mozilla\Firefox\Profiles\ewy6twga.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-06 18:58
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-298767329-583229373-3557058146-1005\Software\SecuROM\License information*]
"datasecu"=hex:bd,f4,1d,bf,6d,7b,5c,ed,78,87,5c,ff,02,89,33,72,ec,0d,bd,45,cd,
53,9f,6e,f5,e4,16,83,18,5b,44,c2,88,0d,1e,06,e6,62,94,c4,d5,1a,b3,d9,6c,aa,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(764)
c:\windows\system32\netprovcredman.dll

- - - - - - - > 'lsass.exe'(820)
c:\windows\system32\netprovcredman.dll

- - - - - - - > 'explorer.exe'(1552)
c:\windows\system32\MSNCHATHOOK.DLL
c:\windows\system32\sysenv.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\MFC71U.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\WiFi\bin\S24EvMon.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\windows\system32\rundll32.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
c:\program files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dwwin.exe
.
**************************************************************************
.
Completion time: 2009-09-06 19:02 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-06 17:02

Pre-Run: 11 137 515 520 octets libres
Post-Run: 11 082 629 120 octets libres

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
401 --- E O F --- 2009-09-04 15:18