Virus Bagle

Ok je vais faire ça .
Encore merci our tout et BONNE ANNEE 2010

ok
VRAIMENT MECI POUT TOUT
Sinon je garde avast comme AV ou y a mieux ?

C'est fait

A y est !!
J'ais tout fait tout bien !!

Bien le Bonjour a toi,
Voila déja le rapport TCleaner
Je fait le reste des opés..

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\Qoobox: trouvé !
C:\UsbFix: trouvé !
C:\FindyKill: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\mickael.MICO-325BBB3914\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\mickael.MICO-325BBB3914\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\mickael.MICO-325BBB3914\Bureau\Rsit.exe: trouvé !
C:\Program Files\ZHPDiag: trouvé !
C:\Program Files\trend micro\HijackThis: trouvé !
C:\Program Files\trend micro\HijackThis\hijackthis.log: trouvé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\WINDOWS\mbr.exe: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\mickael.MICO-325BBB3914\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\mickael.MICO-325BBB3914\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Program Files\ZHPDiag\ZHPdiag.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\mickael.MICO-325BBB3914\Bureau\Rsit.exe: supprimé !
C:\Program Files\trend micro\HijackThis\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\WINDOWS\mbr.exe: supprimé !
C:\Qoobox: supprimé !
C:\UsbFix: supprimé !
C:\FindyKill: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\ZHPDiag: supprimé !
C:\Program Files\trend micro\HijackThis: supprimé !

Point de restauration crée !
Corbeille vidée!
Fichiers temporaires nettoyés !

ci joint rapport RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by mickael at 2009-12-29 23:36:35
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 77 GB (32%) free of 238 GB
Total RAM: 1023 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:36:43, on 29/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TRENDnet\TEW-424UB\TRENDnet.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\mickael.MICO-325BBB3914\Bureau\RSIT.exe
C:\Program Files\trend micro\HijackThis\mickael.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmail.aliceadsl.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\ereg.ini"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Lucky Emperor Casino - 5350BDE3-CED8-46D8-816C-BE4E2AC0AAD9 - C:\Microgaming\Casino\LuckyEmperor\Casinogame.exe (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_3_5_2_1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{52005BAF-2120-4B76-8739-0DABF23FB046}: NameServer = 192.168.1.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\TRENDnet\TEW-424UB\SiSWLSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

ok a plus

je les est déja virés ,ils ne sont plus a leurs places

Ci joint rapport combofix pas pus installer console resto ,demande acces internet alors que tout désactivé

ComboFix 09-12-28.06 - mickael 29/12/2009 17:47:59.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.1023.585 [GMT 1:00]
Lancé depuis: c:\documents and settings\mickael.MICO-325BBB3914\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 091229-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\LOG.TXT
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\system32\1348e038.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-11-28 au 2009-12-29 ))))))))))))))))))))))))))))))))))))
.

2009-12-28 17:32 . 2007-07-19 00:40 264576 ----a-r- c:\windows\system32\drivers\RTL8187B.sys
2009-12-28 14:11 . 2009-12-28 14:11 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Malwarebytes
2009-12-28 14:11 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-28 14:11 . 2009-12-28 14:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-28 14:11 . 2009-12-28 14:11 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-12-28 14:11 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-28 14:00 . 2008-10-20 10:22 41216 ----a-w- c:\windows\system32\drivers\Capt905c.sys
2009-12-28 14:00 . 2008-10-20 10:22 26496 ----a-w- c:\windows\system32\drivers\Camd905c.sys
2009-12-28 14:00 . 2009-12-28 14:07 -------- d-----w- c:\program files\MyDSC2
2009-12-28 14:00 . 2009-12-28 14:00 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\InstallShield
2009-12-28 13:42 . 2009-12-28 13:42 -------- d-----w- c:\program files\PhoTags Express
2009-12-28 09:24 . 2008-06-14 17:59 272768 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-12-28 09:16 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-12-28 09:15 . 2009-08-04 17:05 2059776 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-12-28 09:15 . 2009-08-04 17:05 2138112 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-12-28 09:15 . 2009-08-04 17:05 2017792 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-12-27 23:41 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-12-27 23:41 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-12-27 23:41 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-12-27 23:41 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-12-27 23:41 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-12-27 23:41 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-12-27 23:41 . 2009-12-27 23:41 -------- d-----w- c:\program files\Alwil Software
2009-12-27 22:33 . 2009-12-27 23:20 -------- d-----w- C:\FindyKill
2009-12-27 16:34 . 2009-12-27 17:11 -------- d-----w- C:\UsbFix
2009-12-27 15:42 . 2009-12-27 15:42 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Yahoo!
2009-12-27 15:42 . 2009-12-27 15:42 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo! Companion
2009-12-27 15:42 . 2009-12-27 15:42 -------- d-----w- c:\program files\Yahoo!
2009-12-27 15:11 . 2009-12-28 10:54 -------- d-----w- c:\program files\trend micro
2009-12-27 15:11 . 2009-12-27 15:11 -------- d-----w- C:\rsit
2009-12-27 14:53 . 2009-12-27 14:59 -------- d-----w- c:\program files\ZHPDiag
2009-12-27 12:31 . 2009-12-27 16:21 -------- d-----w- c:\windows\BDOSCAN8
2009-12-27 10:37 . 2009-12-27 10:37 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2009-12-26 11:10 . 2004-08-05 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2009-12-26 11:10 . 2004-08-05 12:00 31360 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2009-12-26 11:10 . 2004-08-05 12:00 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2009-12-26 11:10 . 2004-08-05 12:00 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2009-12-26 11:08 . 2004-08-05 12:00 36864 -c--a-w- c:\windows\system32\dllcache\iprip.dll
2009-12-26 11:07 . 2003-03-24 14:52 20540 -c--a-w- c:\windows\system32\dllcache\admin.dll
2009-12-26 10:56 . 2004-08-05 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-12-26 10:56 . 2004-08-05 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2009-12-26 10:56 . 2004-08-05 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2009-12-26 10:56 . 2004-08-05 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2009-12-25 11:47 . 2009-08-04 17:05 2182400 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-12-25 08:43 . 2009-12-26 11:28 -------- d-----w- c:\program files\QuickTime
2009-12-25 08:40 . 2009-12-25 08:40 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\Apple
2009-12-25 08:39 . 2009-12-25 08:39 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\Apple Computer
2009-12-25 08:25 . 2009-12-25 08:25 1956072 ----a-w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-12-25 07:34 . 2004-08-05 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2009-12-24 09:47 . 2009-12-24 09:47 -------- d-----w- c:\windows\system32\wbem\Repository
2009-12-24 09:46 . 2009-12-24 09:46 -------- d-----w- c:\program files\Roulette Raper v2.5 Trial Version
2009-12-23 10:53 . 2009-12-24 09:45 -------- d-----w- c:\program files\StatistiquesRoulette
2009-12-23 08:55 . 2009-12-23 08:55 -------- d-----w- c:\program files\UX Software
2009-12-21 08:47 . 2009-12-21 08:47 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Azureus
2009-12-21 08:47 . 2009-12-24 09:46 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Azureus
2009-12-21 08:46 . 2009-12-24 09:46 -------- d-----w- c:\program files\Fichiers communs\i4j_jres(2)
2009-12-21 08:46 . 2009-12-24 09:46 -------- d-----w- c:\program files\Vuze(2)
2009-12-20 05:56 . 2009-12-20 05:56 -------- d-----w- C:\5f54b6d673a1dfe1c61fbed224cf4412
2009-12-20 05:55 . 2009-12-26 11:31 -------- d-----w- c:\windows\SxsCaPendDel
2009-12-20 05:49 . 2009-12-20 05:49 146 ----a-w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\fusioncache.dat
2009-12-20 05:49 . 2009-12-20 05:50 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\ApplicationHistory
2009-12-19 23:16 . 2009-12-21 16:08 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\Deployment
2009-12-19 23:12 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-19 23:12 . 2006-06-29 12:07 14048 ----a-w- c:\windows\system32\spmsg2.dll
2009-12-19 23:10 . 1997-01-16 00:00 71680 ----a-w- c:\windows\ST5UNST.EXE
2009-12-18 02:01 . 2009-12-18 02:01 -------- d-----w- c:\program files\MSXML 4.0
2009-12-17 08:28 . 2009-12-17 08:31 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Canon
2009-12-17 08:14 . 2009-12-17 08:14 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\ScanSoft
2009-12-17 08:14 . 2009-12-17 08:14 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SSScanWizard
2009-12-17 08:14 . 2009-12-17 08:14 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SSScanAppDataDir
2009-12-17 08:08 . 1995-08-01 03:44 212480 ----a-w- c:\windows\PCDLIB32.DLL
2009-12-17 08:07 . 1998-11-13 12:16 308224 ----a-w- c:\windows\IsUn040c.exe
2009-12-17 08:07 . 2009-12-17 08:07 -------- d-----w- c:\windows\StartHtmico
2009-12-17 08:06 . 2009-12-17 08:06 -------- d--h--w- c:\windows\system32\CanonMP Uninstaller Information
2009-12-17 08:04 . 2004-08-03 21:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-12-16 22:28 . 2009-12-16 22:28 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\Google
2009-12-16 22:23 . 2009-12-16 22:23 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT\Local Settings\Application Data\Google
2009-12-16 13:11 . 2009-12-23 11:12 -------- d-----w- c:\program files\RouletteSniper
2009-12-15 22:24 . 2009-12-15 22:24 -------- d-----r- c:\documents and settings\LocalService.AUTORITE NT\Favoris
2009-12-15 14:09 . 2004-08-03 22:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-12-15 13:57 . 2009-12-15 13:57 -------- d-----w- c:\program files\Fichiers communs\Nero
2009-12-15 13:54 . 2009-12-15 13:55 -------- d-----w- c:\windows\LastGood(2).Tmp
2009-12-11 08:01 . 2009-12-11 08:01 -------- d-----w- c:\program files\Crazy Hermit
2009-12-08 21:51 . 2009-12-20 10:18 -------- d-----w- c:\program files\WinRouletteBot V4.0 DEMO
2009-12-08 06:51 . 2009-12-29 12:36 -------- d-----w- C:\Casino
2009-12-02 10:32 . 2009-12-02 10:32 -------- d-----w- c:\program files\Micro Application
2009-12-02 10:28 . 2009-12-15 13:53 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-12-02 10:27 . 2009-12-15 13:53 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\DAEMON Tools Lite
2009-12-02 10:27 . 2009-12-02 10:28 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-29 08:58 . 2009-09-21 11:16 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\vlc
2009-12-29 02:30 . 2004-08-05 12:00 649636 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-29 02:30 . 2004-08-05 12:00 134508 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-28 14:00 . 2009-09-20 08:13 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-27 22:23 . 2009-09-21 16:29 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
2009-12-27 09:48 . 2009-09-20 08:19 -------- d-----w- c:\program files\Alice
2009-12-26 11:19 . 2009-09-22 10:39 71152 ----a-w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-26 11:05 . 2009-09-21 10:41 23704 -c--a-w- c:\windows\system32\emptyregdb.dat
2009-12-24 09:46 . 2009-09-21 11:16 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\dvdcss
2009-12-17 08:14 . 2009-11-04 14:02 -------- d-----w- c:\program files\Fichiers communs\ScanSoft Shared
2009-12-17 08:07 . 2009-11-04 13:55 -------- d-----w- c:\program files\Canon
2009-12-16 22:23 . 2009-09-20 09:33 -------- d-----w- c:\program files\Google
2009-12-15 16:11 . 2009-11-03 09:50 -------- d-----w- c:\program files\aMSN
2009-12-15 16:11 . 2009-11-04 13:49 -------- d-----w- c:\program files\ImgBurn
2009-12-15 16:11 . 2009-09-20 11:22 -------- d-----w- c:\program files\ma-config.com
2009-12-15 13:57 . 2009-11-20 13:55 -------- d-----w- c:\program files\Pochette Express 2(2)
2009-12-15 13:57 . 2009-10-04 07:00 -------- d-----w- c:\program files\Ahead
2009-12-15 13:57 . 2009-10-04 07:00 -------- d-----w- c:\program files\Fichiers communs\Ahead
2009-12-15 13:57 . 2009-11-23 18:45 -------- d-----w- c:\program files\Fichiers communs\Nero(2)
2009-12-15 13:57 . 2009-11-23 18:45 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Nero
2009-12-15 13:55 . 2009-09-25 13:51 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-12-15 13:55 . 2009-11-23 22:58 -------- d-----w- c:\program files\Adobe(2)
2009-12-14 16:49 . 2009-09-22 10:13 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\ma-config.com
2009-12-11 08:24 . 2009-11-04 14:00 -------- d-----w- c:\program files\ArcSoft
2009-11-24 23:54 . 2009-09-21 11:17 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-09-21 11:17 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:47 . 2009-09-21 11:17 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-23 18:50 . 2009-11-23 18:50 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Nero
2009-11-23 18:45 . 2009-11-23 18:45 -------- d-----w- c:\program files\Nero
2009-11-22 12:03 . 2009-10-26 07:55 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\MGS
2009-11-18 10:13 . 2009-11-18 10:13 112651 ----a-w- c:\windows\hpoins07.dat
2009-11-18 10:13 . 2009-11-18 10:13 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\HP
2009-11-12 08:26 . 2009-11-12 08:26 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Sony
2009-11-12 08:26 . 2009-11-12 08:26 -------- d-----w- c:\program files\Sony
2009-11-12 08:25 . 2009-11-12 08:25 -------- d-----w- c:\program files\Sony Setup
2009-11-08 02:05 . 2009-09-21 19:00 -------- d-----w- c:\program files\MSBuild
2009-11-08 02:04 . 2009-11-08 02:04 -------- d-----w- c:\program files\Reference Assemblies
2009-11-08 02:01 . 2009-11-08 02:01 -------- d-----w- c:\program files\MSXML 6.0
2009-11-05 08:05 . 2009-11-05 08:05 -------- d-----w- c:\program files\denouvel
2009-11-04 14:02 . 2009-11-04 14:02 -------- d-----w- c:\program files\ScanSoft
2009-11-04 13:50 . 2009-11-04 13:50 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\ImgBurn
2009-11-04 13:45 . 2009-09-27 10:41 456 ----a-w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\wklnhst.dat
2009-11-04 13:39 . 2009-11-04 13:39 -------- d--h--w- c:\documents and settings\All Users.WINDOWS\Application Data\CanonBJ
2009-10-29 05:46 . 2004-09-29 18:49 666112 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 05:46 . 2004-09-29 18:49 666112 ----a-w- c:\windows\system32\wininet(2)(2)(2).dll
2009-10-29 05:46 . 2004-09-29 18:49 626688 ----a-w- c:\windows\system32\urlmon(2)(2)(2).dll
2009-10-29 05:46 . 2004-09-29 18:49 1506816 ----a-w- c:\windows\system32\shdocvw(2)(2)(2).dll
2009-10-13 16:53 . 2009-10-13 16:53 40960 ----a-r- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Microsoft\Installer\{86399190-A8D6-4158-86C8-24080024A1F3}\NewShortcut2_86399190A8D6415886C824080024A1F3.exe
2009-10-13 16:53 . 2009-10-13 16:53 40960 ----a-r- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Microsoft\Installer\{86399190-A8D6-4158-86C8-24080024A1F3}\NewShortcut1_86399190A8D6415886C824080024A1F3.exe
2009-10-13 16:53 . 2009-10-13 16:53 40960 ----a-r- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Microsoft\Installer\{86399190-A8D6-4158-86C8-24080024A1F3}\ARPPRODUCTICON.exe
2009-10-13 16:53 . 2009-10-13 16:53 2232 ----a-w- c:\windows\java\Packages\Data\R7RJL33B.DAT
2009-10-13 16:53 . 2009-10-13 16:53 155995 ----a-w- c:\windows\java\Packages\1JPN9ZB1.ZIP
2009-10-13 16:53 . 2009-10-13 16:53 2678 ----a-w- c:\windows\java\Packages\Data\QGBZDZVN.DAT
2009-10-13 16:53 . 2009-10-13 16:53 2678 ----a-w- c:\windows\java\Packages\Data\XJP3RXRJ.DAT
2009-10-13 16:53 . 2009-10-13 16:53 2678 ----a-w- c:\windows\java\Packages\Data\B73B3FT3.DAT
2009-10-13 16:53 . 2009-10-13 16:53 2678 ----a-w- c:\windows\java\Packages\Data\2NNTJVNF.DAT
2009-10-13 16:53 . 2009-10-13 16:53 2678 ----a-w- c:\windows\java\Packages\Data\313F1RNN.DAT
2009-10-13 10:52 . 2004-08-05 12:00 267776 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:52 . 2004-08-05 12:00 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:52 . 2004-08-05 12:00 69632 ----a-w- c:\windows\system32\raschap(2)(2)(2)(2)(2).dll
2009-10-12 13:52 . 2004-08-05 12:00 113152 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:52 . 2004-08-05 12:00 113152 ----a-w- c:\windows\system32\rastls(2)(2)(2)(2)(2).dll
2009-10-12 07:24 . 2009-10-12 07:24 826856 ----a-w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\MSNInstaller\msnauins.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"OPSE reminder"="c:\program files\ScanSoft\OmniPageSE2.0\EregFre\Ereg.exe" [2003-07-07 729088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\
IDETool.lnk - c:\program files\IDETOOL\IDETOOL.EXE [2009-9-21 352256]
Wireless Configuration Utility HW.32.lnk - c:\windows\Installer\{BDC88E5A-F47B-4314-AB38-994592E32C95}\NewShortcut1_BDC88E5AF47B4314AB38994592E32C95.exe [2009-12-26 40960]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\eMule\\emule.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"25:TCP"= 25:TCP:File and Printer Sharing
"9232:TCP"= 9232:TCP:omiw
"3842:TCP"= 3842:TCP:omiw
"6125:TCP"= 6125:TCP:omiw
"1886:TCP"= 1886:TCP:omiw
"8543:TCP"= 8543:TCP:omiw

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [28/12/2009 00:41 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28/12/2009 00:41 20560]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16/12/2009 23:23 135664]
S2 smimsgif32;WMI SNMP MIB Compiler Fatal Error Messages;c:\windows\system32\rundll32.exe smimsgif32.dll,omiw --> c:\windows\system32\rundll32.exe smimsgif32.dll,omiw [?]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [11/12/2009 15:43 234864]
S3 RTL8187B;TRENDnet TEW-424UB 54M USB Dongle;c:\windows\system32\drivers\RTL8187B.sys [28/12/2009 18:32 264576]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [15/02/2006 18:25 215552]
S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;c:\windows\system32\drivers\usb8023.sys [05/08/2004 13:00 12672]
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://webmail.aliceadsl.fr/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html
TCP: {52005BAF-2120-4B76-8739-0DABF23FB046} = 192.168.1.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Mozilla\Firefox\Profiles\5d2tzabq.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.daemon-search.com/startpage
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-29 17:58
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(704)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-12-29 18:00:04
ComboFix-quarantined-files.txt 2009-12-29 17:00

Avant-CF: 79 873 728 512 octets libres
Après-CF: 80 419 401 728 octets libres

- - End Of File - - 93D6ABD974BC231AC230F58D2EA7FAF1

Ca y est par contre impossible de demarrer en mode sans echec
Quand redemarre ,F8 ,une fenetre bleu demande de choisir,je fais entrer et il se ralume normalement sur le bureau sans demander l'option sans echec

Excuse j'avais pas vu,
voila

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.43 2009.12.29 -
AhnLab-V3 5.0.0.2 2009.12.29 -
AntiVir 7.9.1.122 2009.12.29 -
Antiy-AVL 2.0.3.7 2009.12.29 -
Authentium 5.2.0.5 2009.12.29 -
Avast 4.8.1351.0 2009.12.29 -
AVG 8.5.0.430 2009.12.29 -
BitDefender 7.2 2009.12.29 -
CAT-QuickHeal 10.00 2009.12.29 -
ClamAV 0.94.1 2009.12.29 -
Comodo 3403 2009.12.29 -
DrWeb 5.0.1.12222 2009.12.29 -
eSafe 7.0.17.0 2009.12.28 -
eTrust-Vet None 2009.12.29 -
F-Prot 4.5.1.85 2009.12.28 -
F-Secure 9.0.15370.0 2009.12.29 -
Fortinet 4.0.14.0 2009.12.29 -
GData 19 2009.12.29 -
Ikarus T3.1.1.79.0 2009.12.29 -
Jiangmin 13.0.900 2009.12.29 -
K7AntiVirus 7.10.932 2009.12.28 -
Kaspersky 7.0.0.125 2009.12.29 -
McAfee 5845 2009.12.28 -
McAfee+Artemis 5845 2009.12.28 -
McAfee-GW-Edition 6.8.5 2009.12.29 -
Microsoft 1.5302 2009.12.29 -
NOD32 4725 2009.12.29 -
Norman 6.04.03 2009.12.29 -
nProtect 2009.1.8.0 2009.12.29 -
Panda 10.0.2.2 2009.12.15 -
PCTools 7.0.3.5 2009.12.29 -
Prevx 3.0 2009.12.29 -
Rising 22.28.01.03 2009.12.29 -
Sophos 4.49.0 2009.12.29 -
Sunbelt 3.2.1858.2 2009.12.29 -
Symantec 1.4.4.12 2009.12.29 -
TheHacker 6.5.0.3.117 2009.12.29 -
TrendMicro 9.120.0.1004 2009.12.29 -
VBA32 3.12.12.1 2009.12.28 -
ViRobot 2009.12.29.2114 2009.12.29 -
VirusBuster 5.0.21.0 2009.12.28 -
Information additionnelle
File size: 54784 bytes
MD5 : e55975fa0bc5934d5604b1a17eb81c4c
SHA1 : f96b14a39dafe2db63cd25359c4dd4ff9196716b
SHA256: 2c849b5b8dc4f36023f9fdb9d6b4017d4b5297203d15cddc7d7ee7589ce7b5d2
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4B1F
timedatestamp.....: 0x41109623 (Wed Aug 4 09:54:11 2004)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x999D 0x9A00 6.43 a0c0f2de40768cdb614f3c1ec462cb16
.data 0xB000 0x624 0x600 2.38 bbac1cf162c1ab256474a8ebf59ab438
.rsrc 0xC000 0x2910 0x2A00 3.83 98808e67c661872f1695260736686a98
.reloc 0xF000 0x648 0x800 4.63 353fa6eaa43e6620c96f74b0ff60d449

( 9 imports )

> advapi32.dll: RegQueryValueExA, RegSetValueExA, RegCloseKey, RegCreateKeyExA
> comctl32.dll: PropertySheetA, -, CreatePropertySheetPageA
> kernel32.dll: FreeLibrary, InterlockedDecrement, InterlockedIncrement, WideCharToMultiByte, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, CreateThread, SetThreadPriority, ResumeThread, ExitThread, WaitForMultipleObjectsEx, SetEvent, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, OutputDebugStringA, LoadLibraryA, GetProcAddress, GetModuleHandleA, VirtualAlloc, CreateEventA, GetLastError, VirtualFree, CloseHandle, GetOverlappedResult, CancelIo, WaitForSingleObject, DeviceIoControl
> ksuser.dll: KsCreatePin
> msvcrt.dll: strtol, __2@YAPAXI@Z, _purecall, __3@YAXPAX@Z, _except_handler3, wcscmp
> ole32.dll: CoUninitialize, CoInitialize, CoCreateInstance, CoTaskMemFree
> oleaut32.dll: -, -
> user32.dll: SetForegroundWindow, LoadCursorA, RegisterClassA, CreateWindowExA, GetWindowRect, GetClientRect, DefWindowProcA, PostQuitMessage, GetMessageA, DispatchMessageA, GetClassInfoA, UnregisterClassA, GetWindowLongA, WinHelpA, SetWindowLongA, GetParent, IsWindowEnabled, EnableWindow, wsprintfA, SetWindowTextA, ShowWindow, LoadStringA, MessageBoxA, FindWindowA, GetDlgItem, SendMessageA
> winmm.dll: timeGetTime, DefDriverProc, DriverCallback

( 1 exports )

> DllMain, DriverProc, VfwWdm
TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 1536:EdXnUid2Jk80sFwOpIy3Xja+8/HJpcSws:qnUbBwOdLippcSws
PEiD : -
RDS : NSRL Reference Data Set

( Microsoft )

MSDN Disc 2439.6: vfwwdm32.dllMSDN Disc 2439.7: vfwwdm32.dllMSDN Disc 2439.8: vfwwdm32.dll

ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Et rapport C:\WINDOWS\IsUn040c.exe :

a-squared 4.5.0.43 2009.12.29 -
AhnLab-V3 5.0.0.2 2009.12.29 -
AntiVir 7.9.1.122 2009.12.29 -
Antiy-AVL 2.0.3.7 2009.12.29 -
Authentium 5.2.0.5 2009.12.29 -
Avast 4.8.1351.0 2009.12.29 -
AVG 8.5.0.430 2009.12.29 -
BitDefender 7.2 2009.12.29 -
CAT-QuickHeal 10.00 2009.12.29 -
ClamAV 0.94.1 2009.12.29 -
Comodo 3404 2009.12.29 -
DrWeb 5.0.1.12222 2009.12.29 -
eSafe 7.0.17.0 2009.12.28 -
eTrust-Vet 35.1.7203 2009.12.29 -
F-Prot 4.5.1.85 2009.12.28 -
F-Secure 9.0.15370.0 2009.12.29 -
Fortinet 4.0.14.0 2009.12.29 -
GData 19 2009.12.29 -
Ikarus T3.1.1.79.0 2009.12.29 -
Jiangmin 13.0.900 2009.12.29 -
K7AntiVirus 7.10.932 2009.12.28 -
Kaspersky 7.0.0.125 2009.12.29 -
McAfee 5845 2009.12.28 -
McAfee+Artemis 5845 2009.12.28 -
McAfee-GW-Edition 6.8.5 2009.12.29 Heuristic.BehavesLike.Win32.Virus.I
Microsoft 1.5302 2009.12.29 -
NOD32 4725 2009.12.29 -
Norman 6.04.03 2009.12.29 -
nProtect 2009.1.8.0 2009.12.29 -
Panda 10.0.2.2 2009.12.15 -
PCTools 7.0.3.5 2009.12.29 -
Prevx 3.0 2009.12.29 -
Rising 22.28.01.03 2009.12.29 -
Sophos 4.49.0 2009.12.29 -
Sunbelt 3.2.1858.2 2009.12.29 -
Symantec 1.4.4.12 2009.12.29 -
TheHacker 6.5.0.3.117 2009.12.29 -
TrendMicro 9.120.0.1004 2009.12.29 -
VBA32 3.12.12.1 2009.12.28 -
ViRobot 2009.12.29.2114 2009.12.29 -
VirusBuster 5.0.21.0 2009.12.28 -
Information additionnelle
File size: 308224 bytes
MD5...: e40c1867d16dd880e7a6c8156d06d27e
SHA1..: 02682854f0124997099e785624f8b88af7ac4b21
SHA256: e0f833d101bb27cbc60ca56f3532fb75a79895942a5e56f277daa83cca7a4a17
ssdeep: 6144:QPDRrOpaOzOziasZ6wMaWJ5JEMItbsdVeFkCA:2DkZdFvMao5KrxsdE+CA

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1c330
timedatestamp.....: 0x3638e561 (Thu Oct 29 22:00:01 1998)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1f315 0x1f400 6.24 fd4f4cbddcd33f76b523739b629cc3b3
.rdata 0x21000 0x1c0c 0x1e00 5.39 01668df29e4d91578a2309cc44649fc8
.data 0x23000 0x4a7c 0x3800 2.51 8383ed0cfd9809552c7023805b5c9170
.rsrc 0x28000 0x27000 0x26600 6.04 208474b19d2ae8af3c23c54e43dea29e

( 7 imports )
> KERNEL32.dll: DosDateTimeToFileTime, GetPrivateProfileStringA, GetCurrentProcess, LocalFileTimeToFileTime, SetFileTime, MoveFileExA, SetFilePointer, WriteFile, MoveFileA, GetFileAttributesA, lstrcmpA, SetEndOfFile, lstrcpynA, GetLocalTime, SetCurrentDirectoryA, GetDriveTypeA, GetDiskFreeSpaceA, CreateDirectoryA, GetLastError, GetCurrentThread, GetCurrentDirectoryA, GlobalReAlloc, FileTimeToLocalFileTime, GetFileTime, FileTimeToDosDateTime, GetPrivateProfileSectionA, SetFileAttributesA, DeleteFileA, FindNextFileA, FindClose, WinExec, Sleep, GetModuleFileNameA, GetSystemDefaultLCID, MulDiv, GetWindowsDirectoryA, GetTickCount, lstrcatA, lstrcmpiA, lstrlenA, lstrcpyA, CreateFileA, GetFileSize, GlobalAlloc, CloseHandle, GlobalLock, ReadFile, GlobalUnlock, GetModuleHandleA, GetSystemInfo, FindResourceA, LoadResource, SizeofResource, FreeResource, LockResource, OpenFile, _hwrite, _lclose, GetVersion, IsDBCSLeadByte, GetSystemDirectoryA, WriteProfileSectionA, WritePrivateProfileSectionA, WritePrivateProfileStringA, GlobalCompact, WriteProfileStringA, GetFileType, LCMapStringA, GetProfileSectionA, GlobalHandle, SetErrorMode, GlobalFree, LoadLibraryA, GetProcAddress, FreeLibrary, FindFirstFileA, RemoveDirectoryA, RtlUnwind, GetStdHandle, SetHandleCount, GetOEMCP, GetACP, GetCPInfo, WideCharToMultiByte, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, MultiByteToWideChar, FreeEnvironmentStringsA, UnhandledExceptionFilter, TerminateProcess, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, GetSystemTime, GetTimeZoneInformation, ExitProcess, GetCommandLineA, GetStartupInfoA, HeapFree, HeapAlloc, LCMapStringW, GetStringTypeA, GetStringTypeW, CompareStringA, CompareStringW, SetEnvironmentVariableA, HeapReAlloc
> USER32.dll: SetDlgItemTextA, LoadStringA, MessageBoxA, EndDialog, DialogBoxParamA, wsprintfA, PeekMessageA, SendDlgItemMessageA, BeginPaint, EndPaint, DefWindowProcA, LoadCursorA, GetClassInfoA, OemToCharA, KillTimer, PostQuitMessage, RegisterClassA, GetSysColor, IsDialogMessageA, CharLowerA, CreateWindowExA, EnableWindow, GetWindow, GetClassNameA, CharUpperA, GetWindowTextA, GetDlgItem, SendMessageA, PostMessageA, SetWindowTextA, GetSystemMetrics, SetWindowPos, ShowWindow, UpdateWindow, SetFocus, IsWindow, RegisterWindowMessageA, GetDC, ReleaseDC, ScreenToClient, SetTimer, LoadIconA, DestroyWindow, LoadBitmapA, CreateDialogParamA, InvalidateRect, IsWindowVisible, CharNextA, InflateRect, CharPrevA, CharToOemA, DdeGetData, DdeFreeDataHandle, DdeConnect, DdeClientTransaction, DdeGetLastError, DdeDisconnect, DdeFreeStringHandle, DdeUninitialize, DdeInitializeA, DdeCreateStringHandleA, ExitWindowsEx, FindWindowA, GetClientRect, FillRect, SetRect, SetRectEmpty, GetWindowLongA, GetWindowRect, DispatchMessageA, TranslateMessage, MessageBeep
> GDI32.dll: CreateDIBitmap, SelectPalette, GetDeviceCaps, CreatePalette, GetSystemPaletteEntries, LineTo, MoveToEx, DeleteObject, CreatePen, CreateFontIndirectA, GetObjectA, DeleteDC, BitBlt, CreateCompatibleDC, RestoreDC, Rectangle, GetStockObject, CreateSolidBrush, IntersectClipRect, SaveDC, CreateCompatibleBitmap, SetBkColor, CreateBitmap, SetPixel, GetTextExtentPointA, SelectObject, RealizePalette
> comdlg32.dll: GetOpenFileNameA, GetSaveFileNameA
> ADVAPI32.dll: AllocateAndInitializeSid, RegCloseKey, RegConnectRegistryA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, CloseServiceHandle, OpenSCManagerA, FreeSid, RegCreateKeyExA, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, RegOpenKeyA, RegDeleteKeyA, RegEnumKeyA, RegSetValueExA, RegQueryValueExA, RegDeleteValueA, RegEnumValueA, EqualSid, GetTokenInformation, OpenThreadToken
> SHELL32.dll: SHGetSpecialFolderLocation, SHGetPathFromIDListA
> VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

( 0 exports )

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....: InstallShield Software Corporation
copyright....: Copyright(c) 1990-1998 InstallShield Software Corporation Phone : (847) 240-9111
product......: InstallShield_ unInstaller
description..: InstallShield_ unInstaller
original name: n/a
internal name: n/a
file version.: 5, 51, 138, 0
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

.

Rapport C:\WINDOWS\system32\vfwwdm32.dll :

File size: 54784 bytes
MD5 : e55975fa0bc5934d5604b1a17eb81c4c
SHA1 : f96b14a39dafe2db63cd25359c4dd4ff9196716b
SHA256: 2c849b5b8dc4f36023f9fdb9d6b4017d4b5297203d15cddc7d7ee7589ce7b5d2
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4B1F
timedatestamp.....: 0x41109623 (Wed Aug 4 09:54:11 2004)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x999D 0x9A00 6.43 a0c0f2de40768cdb614f3c1ec462cb16
.data 0xB000 0x624 0x600 2.38 bbac1cf162c1ab256474a8ebf59ab438
.rsrc 0xC000 0x2910 0x2A00 3.83 98808e67c661872f1695260736686a98
.reloc 0xF000 0x648 0x800 4.63 353fa6eaa43e6620c96f74b0ff60d449

( 9 imports )

> advapi32.dll: RegQueryValueExA, RegSetValueExA, RegCloseKey, RegCreateKeyExA
> comctl32.dll: PropertySheetA, -, CreatePropertySheetPageA
> kernel32.dll: FreeLibrary, InterlockedDecrement, InterlockedIncrement, WideCharToMultiByte, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, CreateThread, SetThreadPriority, ResumeThread, ExitThread, WaitForMultipleObjectsEx, SetEvent, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, OutputDebugStringA, LoadLibraryA, GetProcAddress, GetModuleHandleA, VirtualAlloc, CreateEventA, GetLastError, VirtualFree, CloseHandle, GetOverlappedResult, CancelIo, WaitForSingleObject, DeviceIoControl
> ksuser.dll: KsCreatePin
> msvcrt.dll: strtol, __2@YAPAXI@Z, _purecall, __3@YAXPAX@Z, _except_handler3, wcscmp
> ole32.dll: CoUninitialize, CoInitialize, CoCreateInstance, CoTaskMemFree
> oleaut32.dll: -, -
> user32.dll: SetForegroundWindow, LoadCursorA, RegisterClassA, CreateWindowExA, GetWindowRect, GetClientRect, DefWindowProcA, PostQuitMessage, GetMessageA, DispatchMessageA, GetClassInfoA, UnregisterClassA, GetWindowLongA, WinHelpA, SetWindowLongA, GetParent, IsWindowEnabled, EnableWindow, wsprintfA, SetWindowTextA, ShowWindow, LoadStringA, MessageBoxA, FindWindowA, GetDlgItem, SendMessageA
> winmm.dll: timeGetTime, DefDriverProc, DriverCallback

( 1 exports )

> DllMain, DriverProc, VfwWdm
TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 1536:EdXnUid2Jk80sFwOpIy3Xja+8/HJpcSws:qnUbBwOdLippcSws
PEiD : -
RDS : NSRL Reference Data Set

( Microsoft )

MSDN Disc 2439.6: vfwwdm32.dllMSDN Disc 2439.7: vfwwdm32.dllMSDN Disc 2439.8: vfwwdm32.dll

Bonjour,
CI dessous rapport RSTI

Logfile of random's system information tool 1.06 (written by random/random)
Run by mickael at 2009-12-29 04:43:24
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 76 GB (32%) free of 238 GB
Total RAM: 1023 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:43:31, on 29/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\TRENDnet\TEW-424UB\TRENDnet.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\TRENDnet\TEW-424UB\SiSWLSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\mickael.MICO-325BBB3914\Bureau\RSIT.exe
C:\Program Files\trend micro\HijackThis\mickael.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://webmail.aliceadsl.fr//
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\ereg.ini"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Lucky Emperor Casino - 5350BDE3-CED8-46D8-816C-BE4E2AC0AAD9 - C:\Microgaming\Casino\LuckyEmperor\Casinogame.exe (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - https://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_3_5_2_1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\TRENDnet\TEW-424UB\SiSWLSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Ok c'est fait.
Si c'est terminé je te remerci vraiment beaucoup de ton aide.
Bonne continuation.
MS

Salut
Et encore merci pour ton aide.
Oui mon AV foncionne(avast).Je l'ai désactivé pour faire l'analyse.
Ci dessous rapport ,par contre il n'a pas pus supprimer tout apparement..

Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3443
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

28/12/2009 18:27:56
mbam-log-2009-12-28 (18-27-56).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 247256
Temps écoulé: 3 hour(s), 12 minute(s), 30 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 6
Fichier(s) infecté(s): 127

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\smimsgif32.dll (Trojan.Agent) -> Delete on reboot.

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Gold VIP Club Casino (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\temp (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\_patch (Adware.Casino) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0003900.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0003824.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004045.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004050.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004088.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004102.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004820.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004943.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0005695.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smimsgif32.dll (Trojan.Agent) -> Delete on reboot.
C:\Program Files\Gold VIP Club Casino\menu.txt (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Blackjack - Common (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Blackjack - Standard (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Extgame (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Fonts - Latin (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Lobby (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\packages (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\SmartDownload (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\action_button.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\bj.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\blackjack32.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\card.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\cards32.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.bd1.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.chf.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.cny.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.eur.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.gbp.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.myr.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.pen.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.php.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.pln.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.rub.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.usd.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.zar.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino32.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino32.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.bd1.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.chf.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.cny.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.eur.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.gbp.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.myr.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.pen.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.php.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.pln.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.rub.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.usd.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.zar.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.chf.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.cny.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.eur.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.myr.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.pen.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.php.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.pln.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.rub.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.usd.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.zar.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\downloaddlg.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\exit.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\extgame.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\history.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\lobby.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\lobby.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\logos.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\options_new.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\rings.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\table.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\table.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\tables32.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\tbslot.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Blackjack.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Bust.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn000.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn001.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn002.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn003.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn004.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn005.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn007.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_00.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_01.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_02.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_03.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_04.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_05.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_06.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_07.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_08.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_09.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_10.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_11.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_12.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_13.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_14.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_15.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_16.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_17.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_18.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_19.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_20.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_21.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_22.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_23.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_24.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_25.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_26.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_27.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_28.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_29.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_30.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_31.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_32.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_33.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_34.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_35.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_36.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Insurance.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\PlayerWins.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Push.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\ShoeCardSound.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Win.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\temp\loading.html (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\_patch\package_list.ini.crc (Adware.Casino) -> Quarantined and deleted successfully.

Ton antivirus fonctionne-t-il ?

Télécharge malwarebytes' anti-malware
https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/
Enregistre le sur le bureau
Double-clique sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation
Si la pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
Il va se mettre à jour une fois faite
Va dans l'onglet recherche
Sélectionne exécuter un examen complet
Clique sur rechercher
Le scan démarre
A la fin de l'analyse, le message s'affiche: L'examen s'est terminé normalement.
Clique sur afficher les résultats pour afficher les objets trouvés
Clique sur OK pour pousuivre
Si des malwares ont été détectés, cliquer sur afficher les résultats
Sélectionne tout (ou laisser coché)
Clique sur supprimer la sélection
Malwarebytes va détruire les fichiers et les clés de registre et en mettre une
copie dans la quarantaine
Malewarebytes va ouvrir le bloc-note et y copier le rapport
Redémarre le PC
Une fois redémarré, double-clique sur Malewarebytes
Va dans l'onglet rapport/log
Clique dessus pour l'afficher une fois affiché, cliquer sur édition en haut du
bloc-note puis sur sélectionner tout
Revient sur édition, puis sur copier et revient sur le forum et dans ta réponse
Clic droit dans le cadre de la réponse et coller

ok
ci joint lien rapport rsit
http://www.cijoint.fr/cjlink.php?file=cj200912/cijfzXrRWm.txt

ok

attendre nathandre pour qu'elle te donne la suite pour réparer les fichiers corrompus par bagle.