Virus

"svchost "

merci

Quel est ce fichier ?

SI si j'ai antivir, l'ordinateur fonctionne bien, il y a juste un problème avec un fichier système qui me prend tout mon processeur (99%) donc du cou mon ordi ram beaucoup pour ouvrir une fenêtre

Tu n'as pas d'antivirus ?

--> Mets à jour Java.

--> Mets à jour Adobe Reader.

All processes killed
========== OTL ==========
C:\Documents and Settings\Lucas Orsini\Application Data\Mozilla\Extensions\{ae2cff10-0d52-4066-8be9-4abcf119fa79} folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB912-C5FA-486F-8334-57288578C627}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB912-C5FA-486F-8334-57288578C627}\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
C:\Documents and Settings\All Users\Application Data\reparateurdesysteme\Data folder moved successfully.
C:\Documents and Settings\All Users\Application Data\reparateurdesysteme folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Chloé ORSINI
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 157915 bytes
->FireFox cache emptied: 14612608 bytes
->Flash cache emptied: 4247 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Jean Pierre ORSINI

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Lucas Orsini
->Temp folder emptied: 455176 bytes
->Temporary Internet Files folder emptied: 43997 bytes
->Java cache emptied: 33428910 bytes
->FireFox cache emptied: 44232295 bytes
->Google Chrome cache emptied: 612860 bytes
->Flash cache emptied: 1968390 bytes

User: Margaux Orsini
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 157915 bytes
->Java cache emptied: 941233 bytes
->FireFox cache emptied: 100567305 bytes
->Flash cache emptied: 6819 bytes

User: NetworkService
->Temp folder emptied: 6824 bytes
->Temporary Internet Files folder emptied: 49286 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 71040606 bytes
%systemroot%\System32 .tmp files removed: 4340736 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 554543 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 224828 bytes
RecycleBin emptied: 143530 bytes

Total Files Cleaned = 261,00 mb

OTL by OldTimer - Version 3.1.37.3 log created on 03232010_182754

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Le PC va bien ?

--> Double-clique sur OTL pour le lancer.
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)
--> Sous l'onglet Custom Scans/Fixes en bas de la fenêtre, copie-colle le texte suivant (entre les deux espaces) :

:OTL
[2009/03/05 17:14:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Lucas Orsini\Application Data\Mozilla\Extensions\{ae2cff10-0d52-4066-8be9-4abcf119fa79}
O2 - BHO: (Shareaza Web Download Hook) - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} - No CLSID value found.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
[2007/12/05 12:50:19 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Application Data\reparateurdesysteme

:commands
[emptytemp]
[reboot]

--> Puis clique sur le bouton Run Fix en haut de la fenêtre.
--> Laisse le programme travailler, redémarre une fois le fix terminé.
--> Poste le rapport qui s'affichera après redémarrage.

http://www.cijoint.fr/cjlink.php?file=cj201003/cijvyLKimc.txt

--> Menu Démarrer > Exécuter > Tape ComboFix /uninstall et valide.

--> Refais un scan OTL et poste le rapport OTL.

ComboFix 10-03-20.06 - Lucas Orsini 21/03/2010 20:23:28.11.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.2047.1486 [GMT 1:00]
Lancé depuis: c:\documents and settings\Lucas Orsini\Mes documents\Téléchargements\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Lucas Orsini\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\documents and settings\LocalService\Application Data\rbuwzv.dat"
"c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat"
"c:\windows\system32\drivers\eqgfiisr.sys"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\Application Data\rbuwzv.dat
c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat
c:\windows\system32\drivers\eqgfiisr.sys

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_APPLICATION_UPDATER
-------\Service_Application Updater
-------\Legacy_eqgfiisr
-------\Service_eqgfiisr

((((((((((((((((((((((((((((( Fichiers créés du 2010-02-21 au 2010-03-21 ))))))))))))))))))))))))))))))))))))
.

2010-03-16 21:36 . 2010-03-16 21:36 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-03-16 21:29 . 2010-03-16 22:50 -------- d-----w- C:\b8ef2970b67a1baebe
2010-03-16 20:17 . 2010-03-21 14:34 -------- d-----w- C:\Ad-Remover
2010-03-13 13:39 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-13 13:39 . 2010-03-13 13:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-13 13:39 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-12 21:07 . 2010-03-12 21:07 -------- d-----w- c:\documents and settings\Margaux Orsini\Local Settings\Application Data\Adobe
2010-03-12 13:15 . 2008-04-13 19:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-03-12 13:15 . 2008-04-13 19:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-03-12 13:15 . 2008-04-13 19:41 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-03-12 13:15 . 2008-04-13 19:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-03-12 13:14 . 2008-04-13 19:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-03-12 13:14 . 2008-04-13 19:40 8192 ----a-w- c:\windows\system32\drivers\Changer.sys
2010-03-04 17:40 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-21 11:40 . 2007-12-15 12:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-03-14 22:56 . 2010-01-03 21:59 -------- d-----w- c:\program files\Picasa2
2010-03-08 18:08 . 2007-11-17 20:02 1229 ----a-w- c:\windows\eReg.dat
2010-02-28 10:37 . 2007-12-22 20:29 -------- d-----w- c:\program files\uTorrent
2010-02-28 10:09 . 2008-11-16 21:05 -------- d-----w- c:\documents and settings\Lucas Orsini\Application Data\LimeWire
2010-02-28 10:05 . 2007-12-22 20:29 -------- d-----w- c:\documents and settings\Lucas Orsini\Application Data\uTorrent
2010-02-24 09:16 . 2009-10-02 18:27 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-19 19:52 . 2007-11-24 17:41 -------- d-----w- c:\documents and settings\Lucas Orsini\Application Data\AdobeUM
2010-01-30 11:48 . 2007-11-17 14:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-29 21:44 . 2008-07-12 21:34 -------- d-----w- c:\documents and settings\Lucas Orsini\Application Data\dvdcss
2010-01-22 20:05 . 2007-11-28 16:48 53952 ----a-w- c:\documents and settings\Margaux Orsini\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-22 18:24 . 2010-01-22 18:24 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-01-22 18:19 . 2010-01-22 07:47 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-01-22 07:48 . 2010-01-22 07:48 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-01-05 09:56 . 2004-08-05 12:00 832512 ------w- c:\windows\system32\wininet.dll
2010-01-05 09:56 . 2004-08-05 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:56 . 2004-08-05 12:00 17408 ------w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-08-05 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2006-05-03 10:06 . 2009-03-05 16:22 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2009-03-05 16:22 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2009-03-05 16:22 216064 --sh--r- c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"SoundMan"="SOUNDMAN.EXE" [2004-08-30 69632]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 149280]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-02-20 741376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
"nwiz"="nwiz.exe" [2009-01-15 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-12-14 132624]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Margaux Orsini\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

c:\documents and settings\Lucas Orsini\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-7-16 626176]
D'marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\EA GAMES\\MOHDA\\moh_Breakthrough.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Fichiers communs\\InstallShield\\engine\\6\\Intel 32\\Ikernel.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Media Vault\\Utilities\\HPMVTray.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Media Vault\\Utilities\\NASSelector.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Media Vault\\Utilities\\NASDriveMapper.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Media Vault\\Utilities\\HPEZBkup.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Media Vault\\Utilities\\HPMVCheck.exe"=
"c:\\Program Files\\NewTech Infosystems\\NTI Shadow 3\\Shadow.exe"=
"c:\\Program Files\\NewTech Infosystems\\NTI DriveBackup! 4\\CDDIB32.exe"=
"c:\\Program Files\\NewTech Infosystems\\NTI DriveBackup! 4\\DIBExplor.exe"=
"c:\\Program Files\\EA GAMES\\MOHDA\\moh_spearhead.exe"=
"c:\\Program Files\\EA GAMES\\MOHDA\\fpupdate.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Documents and Settings\\Lucas Orsini\\Bureau\\Earned\\System\\EiB.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Lucas Orsini\\Bureau\\Pes 2010\\Crack\\pes2010.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21002:TCP"= 21002:TCP:*:Disabled:BitComet 21002 TCP
"21002:UDP"= 21002:UDP:*:Disabled:BitComet 21002 UDP

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]
R3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [16/11/2007 20:15 223232]
R3 PhTVTune;ProVideo WDM TVTuner;c:\windows\system32\drivers\PhTVTune.sys [17/11/2007 20:21 24288]
R3 RDID1046;EDIROL UA-25;c:\windows\system32\drivers\Rdwm1046.sys [19/01/2010 09:59 172561]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [12/07/2008 18:08 1527900]
S3 sea3bus;Sony Ericsson Device 0A3 driver (WDM);c:\windows\system32\drivers\sea3bus.sys [26/01/2007 19:05 61600]
S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasUSB.sys [16/01/2008 16:20 18432]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - project

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'

2010-03-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-15 19:39]

2010-03-21 c:\windows\Tasks\HPpromotions journeysoftware.job
- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 16:36]

2010-03-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mWindow Title =
uInternet Settings,ProxyOverride = *.local
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Download with &Shareaza - c:\program files\Crux P2P\Plugins\RazaWebHook.dll/3000
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?a64640a6788b444c8f55fa5cc263189d
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?a64640a6788b444c8f55fa5cc263189d
IE: Télécharger avec &BitSpirit - c:\program files\BitSpirit\bsurl.htm
FF - ProfilePath - c:\documents and settings\Lucas Orsini\Application Data\Mozilla\Firefox\Profiles\3qo41ilq.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-21 20:31
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(4040)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\Fichiers communs\Teleca Shared\Generic.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Heure de fin: 2010-03-21 20:43:56 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-03-21 19:43
ComboFix2.txt 2010-03-21 15:19
ComboFix3.txt 2008-10-16 06:35
ComboFix4.txt 2008-10-14 15:14

Avant-CF: 10 885 017 600 octets libres
Après-CF: 10 846 326 784 octets libres

- - End Of File - - 2C2779A543892ACA334F6417A2E7995E

/!\ Seul lucul78 peut suivre cette procédure. /!\

1/

---> Ouvre le Bloc-notes.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :

KillAll::

Driver::
Application Updater

File::
c:\documents and settings\LocalService\Application Data\rbuwzv.dat
c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat
c:\windows\system32\drivers\eqgfiisr.sys

Folder::
c:\program files\Application Updater

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\eqgfiisr]

--> Colle la sélection dans le Bloc-notes.

--> Enregistre ce fichier sur le Bureau (Impératif).

--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.

2/

--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

--> Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

--> Une fois le scan achevé, un rapport va s'afficher : poste-le.

--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt

ComboFix 10-03-20.05 - Lucas Orsini 21/03/2010 15:56:17.10.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.2047.1366 [GMT 1:00]
Lancé depuis: c:\documents and settings\Lucas Orsini\Mes documents\Téléchargements\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\dumphive.exe
c:\windows\system32\muzapp.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\tmp72.tmp
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

Une copie infectée de c:\windows\system32\qmgr.dll a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\ServicePackFiles\i386\qmgr.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-21 au 2010-03-21 ))))))))))))))))))))))))))))))))))))
.

2010-03-16 21:36 . 2010-03-16 21:36 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-03-16 21:29 . 2010-03-16 22:50 -------- d-----w- C:\b8ef2970b67a1baebe
2010-03-16 20:17 . 2010-03-21 14:34 -------- d-----w- C:\Ad-Remover
2010-03-13 13:39 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-13 13:39 . 2010-03-13 13:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-13 13:39 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-13 11:50 . 2010-03-21 15:09 0 ----a-w- c:\windows\system32\drivers\eqgfiisr.sys
2010-03-12 21:07 . 2010-03-12 21:07 -------- d-----w- c:\documents and settings\Margaux Orsini\Local Settings\Application Data\Adobe
2010-03-12 13:15 . 2008-04-13 19:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-03-12 13:15 . 2008-04-13 19:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-03-12 13:15 . 2008-04-13 19:41 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-03-12 13:15 . 2008-04-13 19:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-03-12 13:14 . 2008-04-13 19:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-03-12 13:14 . 2008-04-13 19:40 8192 ----a-w- c:\windows\system32\drivers\Changer.sys
2010-03-04 17:40 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-21 11:40 . 2007-12-15 12:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-03-14 22:56 . 2010-01-03 21:59 -------- d-----w- c:\program files\Picasa2
2010-03-13 11:06 . 2010-03-13 11:06 16 ----a-w- c:\documents and settings\LocalService\Application Data\rbuwzv.dat
2010-03-12 13:14 . 2010-03-12 13:14 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat
2010-03-08 18:08 . 2007-11-17 20:02 1229 ----a-w- c:\windows\eReg.dat
2010-02-28 10:37 . 2007-12-22 20:29 -------- d-----w- c:\program files\uTorrent
2010-02-28 10:09 . 2008-11-16 21:05 -------- d-----w- c:\documents and settings\Lucas Orsini\Application Data\LimeWire
2010-02-28 10:05 . 2007-12-22 20:29 -------- d-----w- c:\documents and settings\Lucas Orsini\Application Data\uTorrent
2010-02-24 09:16 . 2009-10-02 18:27 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-19 19:52 . 2007-11-24 17:41 -------- d-----w- c:\documents and settings\Lucas Orsini\Application Data\AdobeUM
2010-01-30 11:48 . 2007-11-17 14:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-29 21:44 . 2008-07-12 21:34 -------- d-----w- c:\documents and settings\Lucas Orsini\Application Data\dvdcss
2010-01-22 20:05 . 2007-11-28 16:48 53952 ----a-w- c:\documents and settings\Margaux Orsini\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-22 18:24 . 2010-01-22 18:24 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-01-22 18:19 . 2010-01-22 07:47 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-01-22 07:48 . 2010-01-22 07:48 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-01-05 09:56 . 2004-08-05 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 09:56 . 2004-08-05 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:56 . 2004-08-05 12:00 17408 ------w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-08-05 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2006-05-03 10:06 . 2009-03-05 16:22 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2009-03-05 16:22 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2009-03-05 16:22 216064 --sh--r- c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"SoundMan"="SOUNDMAN.EXE" [2004-08-30 69632]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 149280]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-02-20 741376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
"nwiz"="nwiz.exe" [2009-01-15 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-12-14 132624]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Margaux Orsini\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

c:\documents and settings\Lucas Orsini\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-7-16 626176]
D'marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\EA GAMES\\MOHDA\\moh_Breakthrough.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Fichiers communs\\InstallShield\\engine\\6\\Intel 32\\Ikernel.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Media Vault\\Utilities\\HPMVTray.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Media Vault\\Utilities\\NASSelector.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Media Vault\\Utilities\\NASDriveMapper.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Media Vault\\Utilities\\HPEZBkup.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Media Vault\\Utilities\\HPMVCheck.exe"=
"c:\\Program Files\\NewTech Infosystems\\NTI Shadow 3\\Shadow.exe"=
"c:\\Program Files\\NewTech Infosystems\\NTI DriveBackup! 4\\CDDIB32.exe"=
"c:\\Program Files\\NewTech Infosystems\\NTI DriveBackup! 4\\DIBExplor.exe"=
"c:\\Program Files\\EA GAMES\\MOHDA\\moh_spearhead.exe"=
"c:\\Program Files\\EA GAMES\\MOHDA\\fpupdate.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Documents and Settings\\Lucas Orsini\\Bureau\\Earned\\System\\EiB.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Lucas Orsini\\Bureau\\Pes 2010\\Crack\\pes2010.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21002:TCP"= 21002:TCP:*:Disabled:BitComet 21002 TCP
"21002:UDP"= 21002:UDP:*:Disabled:BitComet 21002 UDP

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]
R3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [16/11/2007 20:15 223232]
R3 PhTVTune;ProVideo WDM TVTuner;c:\windows\system32\drivers\PhTVTune.sys [17/11/2007 20:21 24288]
R3 RDID1046;EDIROL UA-25;c:\windows\system32\drivers\Rdwm1046.sys [19/01/2010 09:59 172561]
S2 Application Updater;Application Updater;"c:\program files\Application Updater\ApplicationUpdater.exe" --> c:\program files\Application Updater\ApplicationUpdater.exe [?]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [12/07/2008 18:08 1527900]
S3 sea3bus;Sony Ericsson Device 0A3 driver (WDM);c:\windows\system32\drivers\sea3bus.sys [26/01/2007 19:05 61600]
S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasUSB.sys [16/01/2008 16:20 18432]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - eqgfiisr
*Deregistered* - project

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{367cbdcf-9476-11dc-b7e4-806d6172696f}]
\Shell\AutoRun\command - I:\autorun.exe
.
Contenu du dossier 'Tâches planifiées'

2010-03-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-15 19:39]

2010-03-20 c:\windows\Tasks\HPpromotions journeysoftware.job
- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 16:36]

2010-03-21 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mWindow Title =
uInternet Settings,ProxyOverride = *.local
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Download with &Shareaza - c:\program files\Crux P2P\Plugins\RazaWebHook.dll/3000
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?a64640a6788b444c8f55fa5cc263189d
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?a64640a6788b444c8f55fa5cc263189d
IE: Télécharger avec &BitSpirit - c:\program files\BitSpirit\bsurl.htm
FF - ProfilePath - c:\documents and settings\Lucas Orsini\Application Data\Mozilla\Firefox\Profiles\3qo41ilq.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-ares - c:\program files\Ares\Ares.exe
HKCU-Run-AmlAssistDirect - c:\program files\Aml Pages\AmlAssistDirect.exe
AddRemove-BattlEye - c:\program files\Bohemia Interactive\ArmA\BattlEye\UnInstallBE.exe
AddRemove-XviD_is1 - c:\program files\XviD\unins000.exe
AddRemove-{651DF20A-B6D8-4C7A-BBD8-EBC5FC7CF1C1} - c:\program files\InstallShield Installation Information\{651DF20A-B6D8-4C7A-BBD8-EBC5FC7CF1C1}\setup.exe
AddRemove-{E9EB5689-4F76-4E3C-A675-5ED5F52AB890} - c:\program files\InstallShield Installation Information\{E9EB5689-4F76-4E3C-A675-5ED5F52AB890}\setup.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-21 16:05
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\eqgfiisr]

.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(1256)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\Fichiers communs\Teleca Shared\Generic.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Heure de fin: 2010-03-21 16:19:43 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-03-21 15:19
ComboFix2.txt 2008-10-16 06:35
ComboFix3.txt 2008-10-14 15:14

Avant-CF: 6 635 175 936 octets libres
Après-CF: 10 887 393 280 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 592254097BEC41974B139D3159AE5948

--> Relance Ad-Remover et choisis Désinstaller.

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

.
======= RAPPORT D'AD-REMOVER 2.0.0.0,B | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 19/03/10 à 18:30
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 15:18:25 le 21/03/2010 | Mode normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\ADR.exe
SE: Microsoft® Windows XP(TM) Service Pack 3 - X86
Nom du PC: MAISON-BIBLIO | Utilisateur actuel: Lucas Orsini (Administrateur)
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
C:\Documents and Settings\Lucas Orsini\Application Data\Search Settings
C:\Documents and Settings\Margaux Orsini\Application Data\Search Settings
C:\Program Files\Application Updater
C:\Program Files\Mozilla Firefox\extensions\searchsettings@spigot.com
C:\Program Files\Search Settings

(!) -- Fichiers temporaires supprimés.
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Search Settings
HKLM\Software\Application Updater
HKLM\Software\Classes\CLSID\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}
HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Classes\dc_ads.ads
HKLM\Software\Classes\dc_ads.ads.1
HKLM\Software\Classes\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}
HKLM\Software\Classes\Rotator.Gizmo3
HKLM\Software\Classes\Rotator.Gizmo3.1
HKLM\Software\Classes\SearchSettings.BHO
HKLM\Software\Classes\SearchSettings.BHO.1
HKLM\Software\Classes\sidepanel.logic
HKLM\Software\Classes\sidepanel.logic.1
HKLM\Software\Classes\sidepanel.panel
HKLM\Software\Classes\sidepanel.panel.1
HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
HKLM\Software\Freeze.com
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Search Settings
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{0579B4B6-0293-4D73-B02D-5EBB0BA0F0A2}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|SearchSettings
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Application Updater\ApplicationUpdater.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\FF\components\SearchSettingsFF.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\FF\install.rdf
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\SearchSettings.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\SearchSettings.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\SearchSettingsRes409.dll
.
============== SCAN ADDITIONNEL ==============
.
* Mozilla FireFox Version 3.5.8 (fr) *
.
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Lucas Orsini\\Bureau
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - browser.search.defaultenginename: Yahoo
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - browser.search.selectedEngine: Yahoo
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - browser.startup.homepage: hxxp://www.google.fr/
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.8
C:\Documents and Settings\Lucas Orsini\..\3qo41ilq.default\prefs.js - keyword.URL: hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
C:\Documents and Settings\Chloé ORSINI\..\67iqlga7.default\prefs.js - browser.search.defaultenginename: Google
C:\Documents and Settings\Chloé ORSINI\..\67iqlga7.default\prefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\Chloé ORSINI\..\67iqlga7.default\prefs.js - browser.search.selectedEngine: Google
C:\Documents and Settings\Chloé ORSINI\..\67iqlga7.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.0.10
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Margaux Orsini\\Mes documents\\Mes images
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - browser.search.defaultenginename: Yahoo
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - browser.search.selectedEngine: Yahoo
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.8
C:\Documents and Settings\Margaux Orsini\..\ku6hb77j.default\prefs.js - keyword.URL: hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
.
.
* Internet Explorer Version 7.0.5730.13 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
.
============== SUSPECT(S) ==============
.
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Age.Of.Mythology+The.Titan+Serial+NO-CD.FR.rar.1.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Age.Of.Mythology+The.Titan+Serial+NO-CD.FR.rar.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Armed Assault Crack + Czech or Ger to English Patch.rar.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Atomix.Virtual.DJ.Pro.v5c.Cracked.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Battlefield 2 + Crack and Keygen.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Evolution_Patch_2.0_for_PES2008.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Fruity Loops Studio 7 Full + Crack.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\GRAND_THEFT_AUTO_4_CLONEDVD_READNFO-ePEN15 + PROPER CRACK.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\GTA_IV_Crack_by_razor1911_-_100%_working.zip.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Medal of Honor Airborne - Patch FR.rar.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Medal of honor airborne crack.exe.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Medal of Honor AIRBORNE Crack.rar.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Medal of Honor Airborne-HATRED Crack+Keygen.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\MotoGP.08-RELOADED-CRACK-ONLY.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Patch + Voix en Fr Rugby 08.zip.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Patch Fr Rugby 08.zip.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\PES 2008 - ProEvoluti Superpatch 2.0.rar.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Pro Evolution Soccer 2009 Cracked DVD9 by Carlinhos_Lopes - MSJP.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Pro evolution soccer 2009 [PC-DVD][Multi5][Crack+Serial][matrixmersion].torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\Rfactor Crack v1.255 (Reloaded).zip.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\RUGBY.08.-.Patch.FRENCH.TXT.[spk2007].zip.torrent
C:\Documents and Settings\Lucas Orsini\Application Data\uTorrent\[NewTorrents.info] Battlefield.2.Keygen-ViTALiTY.torrent
C:\Documents and Settings\Lucas Orsini\Bureau\Pes 2010\Crack\pes2010.exe
C:\Documents and Settings\Lucas Orsini\Favoris\Serials & keys - unlocks the world.url
C:\Documents and Settings\Lucas Orsini\Mes documents\LimeWire\Incomplete\T-219986-crack moto gp 08 crack-serial-keygen.zip
.
========================================
.
C:\DOCUME~1\LUCASO~1\LOCALS~1\Temp: 4 Fichier(s), 128 Dossier(s)
C:\WINDOWS\temp: 2 Fichier(s), 38 Dossier(s)
Temporary Internet Files: 2 Fichier(s), 14 Dossier(s)
.
C:\Ad-Remover\Quarantine: 16 Fichier(s)
C:\Ad-Remover\Backup: 13 Fichier(s)
.
C:\Ad-Report-CLEAN[1].txt - 9671 Octet(s)
.
Fin à: 15:35:07, 21/03/2010
.
============== E.O.F - CLEAN[1] ==============

--> Retente la manip' avec Ad-Remover.

http://www.cijoint.fr/cjlink.php?file=cj201003/cijsUO2a8v.txt

Et le rapport OTL ?

http://www.cijoint.fr/cjlink.php?file=cj201003/cijPWp4enp.txt

merci

--> Télécharge OTL (de OldTimer) sur ton Bureau.
--> Double-clique sur OTL pour le lancer.
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)
--> Une fenêtre apparaît. Dans la section Output en haut de cette fenêtre, coche Minimal Output.
--> Coche également les cases à côté de LOP Check et Purity Check.
--> Enfin, clique sur le bouton Run Scan. Le scan ne prendra pas beaucoup de temps.
--> Une fois l'analyse terminée, deux fenêtres vont s'ouvrir dans le Bloc-notes : OTL.txt et Extras.txt. Ils se trouvent au même endroit que OTL (donc par défaut sur le Bureau).

Pour me transmettre les rapports :
--> Clique sur ce lien : http://www.cijoint.fr/
--> Clique sur Parcourir... et cherche le fichier du rapport que tu souhaites me transmettre.
--> Clique sur Ouvrir.
--> Clique sur Cliquez ici pour déposer le fichier.
--> Un lien de cette forme, hxxp://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt, est ajouté dans la page.
--> Copie-colle ce lien dans ta réponse.

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

19/03/2010 08:29:52
mbam-log-2010-03-19 (08-29-52).txt

Type de recherche: Examen rapide
Eléments examinés: 151780
Temps écoulé: 5 hour(s), 17 minute(s), 34 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\drivers\eqgfiisr.sys (Rootkit.Agent) -> Delete on reboot.

---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.