Virus impossible a supprimer

salut dédé

non il n'y avait pas de ligne rouge j'en suis sur

salut me revoila j'ai fait tourner mon ordi pendant 5h47 etle scan n'était pas finit je pense voila ce qui en est sorti :

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-17 23:44:32
Windows 5.1.2600 Service Pack 3
Running: duls5cx8.exe; Driver: C:\DOCUME~1\Sofiane\LOCALS~1\Temp\axldqpog.sys

---- Devices - GMER 1.0.15 ----

Device \Driver\m5287 \Device\Scsi\m52871 8386C318
Device \Driver\m5287 \Device\Scsi\m52871Port2Path0Target0Lun0 8386C318
Device \FileSystem\Cdfs \Cdfs F6DD3400

cependant lors du dernier scan avec toutes les cases cochés il y avait beacoups plus de trouvailles...

salut

justement je l'ai fais en mode sans echec car en mode normal dés que j'ouvre gmer j'ai cet meme page bleu

salut desolé du retard voila le rapport

ComboFix 10-05-10.05 - Sofiane 12/05/2010 13:50:22.11.2 - x86 NETWORK
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.767.586 [GMT 2:00]
Lancé depuis: c:\documents and settings\Sofiane\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-04-12 au 2010-05-12 ))))))))))))))))))))))))))))))))))))
.

2010-05-10 14:38 . 2010-05-10 14:38 1956656 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-05-10 14:38 . 2010-05-10 16:07 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-05-09 14:35 . 2010-05-09 14:35 -------- d-----w- C:\rsit
2010-05-06 19:39 . 2010-05-06 19:39 -------- d-----w- c:\program files\ESET
2010-05-04 11:44 . 2010-05-04 12:01 -------- d-----w- C:\Cmb
2010-05-03 21:14 . 2010-05-03 21:15 -------- d-----w- C:\tdsskiller
2010-05-03 20:41 . 2010-05-06 18:06 -------- d-----w- C:\Ad-Remover
2010-05-03 18:29 . 2009-06-30 07:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys
2010-05-03 18:29 . 2010-05-03 18:29 -------- d-----w- c:\program files\Panda Security
2010-05-02 19:16 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 19:15 . 2010-05-02 19:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-02 19:15 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-02 18:29 . 2010-05-02 19:03 -------- d-----w- c:\program files\navilog1
2010-05-02 18:01 . 2010-05-02 18:49 -------- d-----w- C:\ToolBar SD
2010-05-02 15:56 . 2010-05-03 15:06 -------- d-----w- c:\documents and settings\HelpAssistant\Tracing
2010-05-02 15:56 . 2010-05-02 15:56 -------- d-----w- c:\documents and settings\HelpAssistant\UserData
2010-05-02 15:56 . 2010-05-02 15:56 -------- d-----w- c:\documents and settings\HelpAssistant\temp
2010-05-02 15:56 . 2010-05-02 15:56 -------- d-----w- c:\documents and settings\HelpAssistant\PrivacIE
2010-05-02 15:53 . 2010-05-02 16:10 -------- d-----w- c:\documents and settings\HelpAssistant\IETldCache
2010-05-02 15:53 . 2010-05-02 15:53 -------- d-----w- c:\documents and settings\HelpAssistant\IECompatCache
2010-05-02 15:53 . 2010-05-02 15:53 -------- d-----w- c:\documents and settings\HelpAssistant\Contacts
2010-05-02 15:51 . 2010-05-02 15:51 -------- d-----w- c:\documents and settings\HelpAssistant\.moovida
2010-05-02 15:51 . 2010-05-02 15:51 -------- d-----w- c:\documents and settings\HelpAssistant\.housecall6.6
2010-04-26 20:56 . 2010-04-26 20:56 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-04-17 21:58 . 2010-05-02 15:13 820440 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-04-17 20:25 . 2010-04-17 20:25 8854 ----a-r- c:\documents and settings\Sofiane\Application Data\Microsoft\Installer\{A37A26D5-8444-4862-933B-478371D0299D}\UNINST_Uninstall_C_A37A26D584444862933B478371D0299D.exe
2010-04-17 20:25 . 2010-04-17 20:25 53248 ----a-r- c:\documents and settings\Sofiane\Application Data\Microsoft\Installer\{A37A26D5-8444-4862-933B-478371D0299D}\NewShortcut1_A37A26D584444862933B478371D0299D.exe
2010-04-17 20:25 . 2010-04-17 20:25 53248 ----a-r- c:\documents and settings\Sofiane\Application Data\Microsoft\Installer\{A37A26D5-8444-4862-933B-478371D0299D}\NewShortcut11_A37A26D584444862933B478371D0299D.exe
2010-04-17 20:25 . 2010-04-17 20:25 10134 ----a-r- c:\documents and settings\Sofiane\Application Data\Microsoft\Installer\{A37A26D5-8444-4862-933B-478371D0299D}\ARPPRODUCTICON.exe
2010-04-17 20:10 . 2010-04-17 20:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Micro Application
2010-04-12 20:50 . 2001-08-23 15:47 99840 ----a-w- c:\windows\system32\srusd.dll
2010-04-12 20:50 . 2001-08-23 15:47 99840 ----a-w- c:\windows\system32\dllcache\srusd.dll
2010-04-12 20:50 . 2001-08-23 15:20 6912 ----a-w- c:\windows\system32\drivers\serscan.sys
2010-04-12 20:50 . 2001-08-23 15:20 6912 ----a-w- c:\windows\system32\dllcache\serscan.sys
2010-04-12 20:50 . 2001-08-23 15:47 72192 ----a-w- c:\windows\system32\fnfilter.dll
2010-04-12 20:50 . 2001-08-23 15:47 72192 ----a-w- c:\windows\system32\dllcache\fnfilter.dll
2010-04-12 20:39 . 2002-06-19 22:00 32256 ----a-w- c:\windows\system32\escwiad.dll
2010-04-12 20:39 . 2002-06-19 22:00 22528 ----a-w- c:\windows\system32\esccmd.dll
2010-04-12 20:39 . 2001-11-14 22:00 47104 ----a-w- c:\windows\system32\escimgd.dll
2010-04-12 20:39 . 2001-11-14 22:00 33280 ----a-w- c:\windows\system32\esccm.dll
2010-04-12 20:39 . 2001-11-14 22:00 32256 ----a-w- c:\windows\system32\escwiab.dll
2010-04-12 20:39 . 2001-11-14 22:00 27648 ----a-w- c:\windows\system32\escimg.dll
2010-04-12 20:39 . 2002-01-30 22:00 126976 ----a-w- c:\windows\system32\Esint23.dll
2010-04-12 13:36 . 2010-04-12 13:36 -------- d-----w- c:\program files\iPod
2010-04-12 13:36 . 2010-04-12 13:37 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-12 13:21 . 2010-04-12 13:21 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-12 13:08 . 2010-04-12 13:08 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-11 15:51 . 2008-07-25 22:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-05-11 14:41 . 2010-03-27 12:37 439816 ----a-w- c:\documents and settings\Sofiane\Application Data\Real\Update\setup3.10\setup.exe
2010-05-09 14:37 . 2008-10-19 16:47 -------- d-----w- c:\program files\Trend Micro
2010-05-04 12:40 . 2008-05-11 10:42 -------- d-----w- c:\documents and settings\Sofiane\Application Data\uTorrent
2010-05-01 18:05 . 2008-05-11 10:42 -------- d-----w- c:\program files\uTorrent
2010-04-29 13:18 . 2009-12-10 18:43 -------- d-----w- c:\program files\Free Video Converter
2010-04-28 10:59 . 2010-04-28 10:59 789 ----a-w- c:\program files\Raccourci vers HiJackThis.lnk
2010-04-26 20:57 . 2009-06-22 13:35 -------- d-----w- c:\program files\Windows Live
2010-04-26 09:25 . 2010-01-01 16:20 -------- d-----w- c:\program files\ImgBurn
2010-04-17 20:10 . 2008-08-02 14:26 -------- d-----w- c:\program files\Micro Application
2010-04-17 14:21 . 2008-05-11 18:56 -------- d-----w- c:\program files\Google
2010-04-14 11:20 . 2008-05-14 20:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-12 20:39 . 2006-05-21 03:55 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-12 13:37 . 2009-11-30 23:01 -------- d-----w- c:\program files\iTunes
2010-04-12 13:36 . 2009-04-11 08:09 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-12 13:27 . 2009-04-11 08:11 -------- d-----w- c:\program files\Bonjour
2010-04-12 13:13 . 2009-11-30 22:42 -------- d-----w- c:\program files\Safari
2010-04-09 22:41 . 2010-01-24 20:35 -------- d-----w- c:\program files\Messenger Plus! Live
2010-04-03 13:00 . 2009-02-16 11:36 -------- d-----w- c:\program files\CCleaner
2010-03-30 15:18 . 2009-11-30 23:03 75792 ---ha-w- c:\windows\system32\mlfcache.dat
2010-03-28 11:21 . 2006-05-20 20:02 86622 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-28 11:21 . 2006-05-20 20:02 514962 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-14 20:53 . 2009-11-13 21:00 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-03-10 06:16 . 2004-08-05 05:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:17 . 2005-07-03 02:16 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 17:24 . 2009-08-26 18:19 98104 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-02-24 13:11 . 2005-01-19 04:26 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 19:06 . 2005-09-29 18:28 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:06 . 2005-09-29 18:28 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03 . 2010-03-21 21:41 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 09:46 . 2010-02-12 09:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 09:46 . 2010-02-12 09:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-02-12 04:34 . 2004-08-05 05:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-05 05:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-05-05_20.01.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-02 17:39 . 2010-05-10 14:38 84507 c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
+ 2010-01-27 00:58 . 2010-01-27 00:58 256280 c:\windows\system32\Macromed\Flash\FlashUtil10e.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"PopUpStopperFreeEdition"="c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 536576]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-04-02 102400]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-25 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"snpstd"="c:\windows\vsnpstd.exe" [2003-12-31 40960]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-27 61440]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-11-09 198160]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\program files\MpcStar\Codecs\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]

c:\documents and settings\HelpAssistant\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\Sofiane\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\HelpAssistant\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\Sofiane\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
WiFi Station pour Livebox.lnk - c:\program files\Hercules\WiFi Station pour Livebox\WiFiStationLB.exe [2008-5-10 721408]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-10-8 394856]

c:\documents and settings\HelpAssistant\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Acer TV-FM\\PowerCinema.exe"=
"c:\\Program Files\\Acer TV-FM\\PCMService.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"c:\\Program Files\\Hercules\\Classic Link\\Station2.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2431:TCP"= 2431:TCP:Services
"3362:TCP"= 3362:TCP:Services
"3306:TCP"= 3306:TCP:Services
"5112:TCP"= 5112:TCP:Services
"7886:TCP"= 7886:TCP:Services
"7887:TCP"= 7887:TCP:Services
"3300:TCP"= 3300:TCP:Services
"5100:TCP"= 5100:TCP:Services
"5379:TCP"= 5379:TCP:Services
"9258:TCP"= 9258:TCP:Services
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"6868:TCP"= 6868:TCP:Services
"6869:TCP"= 6869:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"3744:TCP"= 3744:TCP:Services
"5988:TCP"= 5988:TCP:Services
"5287:TCP"= 5287:TCP:Services
"9074:TCP"= 9074:TCP:Services
"5148:TCP"= 5148:TCP:Services
"8796:TCP"= 8796:TCP:Services
"2868:TCP"= 2868:TCP:Services
"4236:TCP"= 4236:TCP:Services
"1884:TCP"= 1884:TCP:Services
"2268:TCP"= 2268:TCP:Services
"2759:TCP"= 2759:TCP:Services
"4018:TCP"= 4018:TCP:Services
"2369:TCP"= 2369:TCP:Services
"3238:TCP"= 3238:TCP:Services
"6390:TCP"= 6390:TCP:Services
"6391:TCP"= 6391:TCP:Services
"8197:TCP"= 8197:TCP:Services
"8196:TCP"= 8196:TCP:Services
"5238:TCP"= 5238:TCP:Services
"8976:TCP"= 8976:TCP:Services

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [05/02/2005 09:00 85888]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [03/05/2010 20:29 28552]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [24/01/2010 15:16 108289]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [10/08/2009 22:11 233472]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [06/01/2010 23:29 135664]
S3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [20/09/2009 00:22 98432]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [10/08/2009 22:11 36608]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [29/05/2009 17:13 234864]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [10/08/2009 22:11 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [10/08/2009 22:11 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [10/08/2009 22:11 121856]
.
Contenu du dossier 'Tâches planifiées'

2010-04-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-05-12 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-31 08:47]

2010-05-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 21:29]

2010-05-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 21:29]

2010-05-12 c:\windows\Tasks\User_Feed_Synchronization-{EA792E68-90A3-42D3-8F03-B602173DF34B}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
mWindow Title =
uInternet Settings,ProxyOverride = local;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
TCP: {AE37FE06-5406-4CFF-B038-CAA9986D4684} = 80.10.246.2,80.10.146.129
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-12 14:00
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x83502128]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf76d3f28
\Driver\ACPI -> ACPI.sys @ 0xf7625cb8
\Driver\atapi -> atapi.sys @ 0xf75dd852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
SecurityProcedure -> ntoskrnl.exe @ 0x805df529
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
SecurityProcedure -> ntoskrnl.exe @ 0x805df529
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-2261729735-2498202468-3724448963-1006\Software\SecuROM\License information*]
"datasecu"=hex:d8,0e,22,f9,ab,7b,1b,60,74,d5,5b,ce,c8,df,5f,7b,d9,1f,20,bb,e9,
97,25,e3,ef,93,c6,f0,95,dd,51,bc,a5,98,50,ca,26,73,dd,60,75,25,a5,ea,0d,e2,\
"rkeysecu"=hex:ff,5e,ef,21,07,54,25,77,5e,85,2e,c5,79,63,46,a6
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(880)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-05-12 14:03:06
ComboFix-quarantined-files.txt 2010-05-12 12:03
ComboFix2.txt 2010-05-05 20:04

Avant-CF: 13 752 217 600 octets libres
Après-CF: 13 692 030 976 octets libres

- - End Of File - - 4B45CC46E255F3970C95C8CB70988AA6

salut salut

je viens relancer le sujet et c'était pour dire que mon pc quand il bug un bruit aigue vient de l'unité centrale et que sur google a chaque fois je suis redirigé, donc je dois utiliser un autre moteur de recherche

voila le rapport

ComboFix 10-05-13.02 - Sofiane 14/05/2010 0:11:58.12.2 - x86 MINIMAL
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.767.604 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Sofiane\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Sofiane\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\eMule\lang\ar_AE.dll
C:\Program Files\eMule\lang\ba_BA.dll
C:\Program Files\eMule\lang\bg_BG.dll
C:\Program Files\eMule\lang\ca_ES.dll
C:\Program Files\eMule\lang\cz_CZ.dll
C:\Program Files\eMule\lang\da_DK.dll
C:\Program Files\eMule\lang\de_DE.dll
C:\Program Files\eMule\lang\el_GR.dll
C:\Program Files\eMule\lang\es_AS.dll
C:\Program Files\eMule\lang\es_ES_T.dll
C:\Program Files\eMule\lang\et_EE.dll
C:\Program Files\eMule\lang\fa_IR.dll
C:\Program Files\eMule\lang\fi_FI.dll
C:\Program Files\eMule\lang\fr_BR.dll
C:\Program Files\eMule\lang\fr_FR.dll
C:\Program Files\eMule\lang\gl_ES.dll
C:\Program Files\eMule\lang\he_IL.dll
C:\Program Files\eMule\lang\hu_HU.dll
C:\Program Files\eMule\lang\it_IT.dll
C:\Program Files\eMule\lang\jp_JP.dll
C:\Program Files\eMule\lang\ko_KR.dll
C:\Program Files\eMule\lang\lt_LT.dll
C:\Program Files\eMule\lang\lv_LV.dll
C:\Program Files\eMule\lang\mt_MT.dll
C:\Program Files\eMule\lang\nb_NO.dll
C:\Program Files\eMule\lang\nl_NL.dll
C:\Program Files\eMule\lang\nn_NO.dll
C:\Program Files\eMule\lang\pl_PL.dll
C:\Program Files\eMule\lang\pt_BR.dll
C:\Program Files\eMule\lang\pt_PT.dll
C:\Program Files\eMule\lang\ro_RO.dll
C:\Program Files\eMule\lang\ru_RU.dll
C:\Program Files\eMule\lang\sl_SI.dll
C:\Program Files\eMule\lang\sq_AL.dll
C:\Program Files\eMule\lang\sv_SE.dll
C:\Program Files\eMule\lang\tr_TR.dll
C:\Program Files\eMule\lang\ua_UA.dll
C:\Program Files\eMule\lang\ug_CN.dll
C:\Program Files\eMule\lang\va_ES.dll
C:\Program Files\eMule\lang\va_ES_RACV.dll
C:\Program Files\eMule\lang\vi_VN.dll
C:\Program Files\eMule\lang\zh_CN.dll
C:\Program Files\eMule\lang\zh_TW.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-13 au 2010-05-13 ))))))))))))))))))))))))))))))))))))
.

2010-05-13 21:14:28 . 2010-05-13 21:14:28 -------- d-----w- C:\Documents and Settings\All Users\Application Data\eConsole
2010-05-13 20:53:12 . 2010-05-13 21:05:52 -------- d-----w- C:\Program Files\ZHPDiag
2010-05-09 14:35:44 . 2010-05-09 14:35:57 -------- d-----w- C:\rsit
2010-05-06 19:39:04 . 2010-05-06 19:39:04 -------- d-----w- C:\Program Files\ESET
2010-05-04 11:44:03 . 2010-05-04 12:01:56 -------- d-----w- C:\Cmb
2010-05-03 21:14:04 . 2010-05-03 21:15:28 -------- d-----w- C:\tdsskiller
2010-05-03 20:41:12 . 2010-05-06 18:06:47 -------- d-----w- C:\Ad-Remover
2010-05-03 18:29:45 . 2009-06-30 07:37:16 28552 ----a-w- C:\WINDOWS\system32\drivers\pavboot.sys
2010-05-03 18:29:39 . 2010-05-03 18:29:39 -------- d-----w- C:\Program Files\Panda Security
2010-05-02 19:16:02 . 2010-04-29 13:39:38 38224 ----a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-05-02 19:15:55 . 2010-05-02 19:16:08 -------- d-----w- C:\Program Files\Malwarebytes' Anti-Malware
2010-05-02 19:15:55 . 2010-04-29 13:39:26 20952 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2010-05-02 18:29:14 . 2010-05-02 19:03:21 -------- d-----w- C:\Program Files\navilog1
2010-05-02 18:01:50 . 2010-05-02 18:49:17 -------- d-----w- C:\ToolBar SD
2010-05-02 15:56:54 . 2010-05-03 15:06:55 -------- d-----w- C:\Documents and Settings\HelpAssistant\Tracing
2010-05-02 15:56:54 . 2010-05-02 15:56:54 -------- d-----w- C:\Documents and Settings\HelpAssistant\UserData
2010-05-02 15:56:53 . 2010-05-02 15:56:53 -------- d-----w- C:\Documents and Settings\HelpAssistant\temp
2010-05-02 15:56:53 . 2010-05-02 15:56:53 -------- d-----w- C:\Documents and Settings\HelpAssistant\PrivacIE
2010-05-02 15:53:41 . 2010-05-02 16:10:45 -------- d-----w- C:\Documents and Settings\HelpAssistant\IETldCache
2010-05-02 15:53:41 . 2010-05-02 15:53:41 -------- d-----w- C:\Documents and Settings\HelpAssistant\IECompatCache
2010-05-02 15:53:19 . 2010-05-02 15:53:26 -------- d-----w- C:\Documents and Settings\HelpAssistant\Contacts
2010-05-02 15:51:10 . 2010-05-02 15:51:11 -------- d-----w- C:\Documents and Settings\HelpAssistant\.moovida
2010-05-02 15:51:05 . 2010-05-02 15:51:09 -------- d-----w- C:\Documents and Settings\HelpAssistant\.housecall6.6
2010-04-26 20:56:41 . 2010-04-26 20:56:41 -------- d-----w- C:\Program Files\Microsoft SQL Server Compact Edition
2010-04-17 21:58:45 . 2010-05-02 15:13:28 820440 ----a-w- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-04-17 20:10:21 . 2010-04-17 20:10:21 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Micro Application

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-13 21:09:27 . 2008-11-13 17:16:38 -------- d-----w- C:\Program Files\ATI Technologies
2010-05-13 17:53:13 . 2008-07-25 22:07:22 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Google Updater
2010-05-12 17:05:20 . 2008-05-14 20:42:52 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-05-11 14:41:18 . 2010-03-27 12:37:37 439816 ----a-w- C:\Documents and Settings\Sofiane\Application Data\Real\Update\setup3.10\setup.exe
2010-05-09 14:37:20 . 2008-10-19 16:47:02 -------- d-----w- C:\Program Files\Trend Micro
2010-05-04 12:40:57 . 2008-05-11 10:42:24 -------- d-----w- C:\Documents and Settings\Sofiane\Application Data\uTorrent
2010-05-01 18:05:57 . 2008-05-11 10:42:31 -------- d-----w- C:\Program Files\uTorrent
2010-04-29 13:18:54 . 2009-12-10 18:43:11 -------- d-----w- C:\Program Files\Free Video Converter
2010-04-28 10:59:55 . 2010-04-28 10:59:55 789 ----a-w- C:\Program Files\Raccourci vers HiJackThis.lnk
2010-04-26 20:57:02 . 2009-06-22 13:35:03 -------- d-----w- C:\Program Files\Windows Live
2010-04-26 09:25:38 . 2010-01-01 16:20:25 -------- d-----w- C:\Program Files\ImgBurn
2010-04-17 20:25:46 . 2010-04-17 20:25:46 8854 ----a-r- C:\Documents and Settings\Sofiane\Application Data\Microsoft\Installer\{A37A26D5-8444-4862-933B-478371D0299D}\UNINST_Uninstall_C_A37A26D584444862933B478371D0299D.exe
2010-04-17 20:25:46 . 2010-04-17 20:25:46 53248 ----a-r- C:\Documents and Settings\Sofiane\Application Data\Microsoft\Installer\{A37A26D5-8444-4862-933B-478371D0299D}\NewShortcut1_A37A26D584444862933B478371D0299D.exe
2010-04-17 20:25:45 . 2010-04-17 20:25:45 53248 ----a-r- C:\Documents and Settings\Sofiane\Application Data\Microsoft\Installer\{A37A26D5-8444-4862-933B-478371D0299D}\NewShortcut11_A37A26D584444862933B478371D0299D.exe
2010-04-17 20:25:45 . 2010-04-17 20:25:45 10134 ----a-r- C:\Documents and Settings\Sofiane\Application Data\Microsoft\Installer\{A37A26D5-8444-4862-933B-478371D0299D}\ARPPRODUCTICON.exe
2010-04-17 20:10:21 . 2008-08-02 14:26:35 -------- d-----w- C:\Program Files\Micro Application
2010-04-17 14:21:21 . 2008-05-11 18:56:23 -------- d-----w- C:\Program Files\Google
2010-04-12 20:39:38 . 2006-05-21 03:55:20 -------- d--h--w- C:\Program Files\InstallShield Installation Information
2010-04-12 13:37:22 . 2010-04-12 13:36:02 -------- d-----w- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-12 13:37:22 . 2009-11-30 23:01:45 -------- d-----w- C:\Program Files\iTunes
2010-04-12 13:36:29 . 2010-04-12 13:36:29 -------- d-----w- C:\Program Files\iPod
2010-04-12 13:36:24 . 2009-04-11 08:09:18 -------- d-----w- C:\Program Files\Fichiers communs\Apple
2010-04-12 13:27:50 . 2009-04-11 08:11:16 -------- d-----w- C:\Program Files\Bonjour
2010-04-12 13:21:07 . 2010-04-12 13:21:07 73000 ----a-w- C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-12 13:13:26 . 2009-11-30 22:42:25 -------- d-----w- C:\Program Files\Safari
2010-04-12 13:08:29 . 2010-04-12 13:08:29 79144 ----a-w- C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-04-09 22:41:08 . 2010-01-24 20:35:25 -------- d-----w- C:\Program Files\Messenger Plus! Live
2010-04-03 13:00:46 . 2009-02-16 11:36:07 -------- d-----w- C:\Program Files\CCleaner
2010-03-30 15:18:48 . 2009-11-30 23:03:32 75792 ---ha-w- C:\WINDOWS\system32\mlfcache.dat
2010-03-28 11:21:53 . 2006-05-20 20:02:34 86622 ----a-w- C:\WINDOWS\system32\perfc00C.dat
2010-03-28 11:21:53 . 2006-05-20 20:02:34 514962 ----a-w- C:\WINDOWS\system32\perfh00C.dat
2010-03-14 20:53:14 . 2009-11-13 21:00:16 664 ----a-w- C:\WINDOWS\system32\d3d9caps.dat
2010-03-10 06:16:48 . 2004-08-05 05:00:00 420352 ----a-w- C:\WINDOWS\system32\vbscript.dll
2010-02-25 06:17:37 . 2005-07-03 02:16:42 916480 ----a-w- C:\WINDOWS\system32\wininet.dll
2010-02-24 17:24:45 . 2009-08-26 18:19:12 98104 ----a-w- C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2010-02-24 13:11:07 . 2005-01-19 04:26:52 455680 ----a-w- C:\WINDOWS\system32\drivers\mrxsmb.sys
2010-02-16 19:06:59 . 2005-09-29 18:28:36 2148352 ----a-w- C:\WINDOWS\system32\ntoskrnl.exe
2010-02-16 19:06:56 . 2005-09-29 18:28:58 2026496 ----a-w- C:\WINDOWS\system32\ntkrnlpa.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\Cmb ----

2010-05-04 11:59:54 . 2010-05-04 11:59:56 674 ----a-w- C:\Cmb\mbr.txt
2010-05-04 11:44:03 . 2010-05-04 11:43:52 401408 ----a-r- C:\Cmb\CF22669.cfxxe
2010-05-04 11:43:40 . 2009-10-25 04:11:34 77312 ----a-r- C:\Cmb\mbr.cfxxe

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 14:45:08 313472]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 09:10:32 536576]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 14:44:52 3883856]
"AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-04-02 16:05:22 102400]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-25 22:07:25 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 02:33:59 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [2003-12-31 14:39:04 40960]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 16:07:16 61952]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-07-25 03:23:12 149280]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-11-09 22:16:44 198160]
"AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 19:58:34 47392]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 10:44:34 31072]
"avgnt"="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 11:08:11 209153]
"QuickTime Task"="C:\Program Files\MpcStar\Codecs\QuickTime\QTTask.exe" [2010-03-17 19:53:36 421888]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2010-03-25 23:10:02 142120]
"AspireService"="C:\Program Files\Acer\Acer eMode Management\AspireService.exe" [2006-06-09 10:24:18 110592]
"MediaSync"="C:\Program Files\Acer\Acer eConsole\MediaSync.exe" [2006-05-04 12:55:20 425984]

C:\Documents and Settings\HelpAssistant\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

C:\Documents and Settings\Sofiane\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

C:\Documents and Settings\HelpAssistant\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

C:\Documents and Settings\Sofiane\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

C:\Documents and Settings\All Users\Menu D'marrer\Programmes\D'marrage\
Acer WLAN 11g USB Dongle.lnk - C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
WiFi Station pour Livebox.lnk - C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiStationLB.exe [2008-5-10 721408]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2008-10-8 394856]

C:\Documents and Settings\HelpAssistant\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Acer TV-FM\\PowerCinema.exe"=
"C:\\Program Files\\Acer TV-FM\\PCMService.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"C:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"C:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"C:\\Program Files\\Hercules\\Classic Link\\Station2.exe"=
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4493:TCP"= 4493:TCP:Services
"7486:TCP"= 7486:TCP:Services
"7774:TCP"= 7774:TCP:Services
"7775:TCP"= 7775:TCP:Services
"3385:TCP"= 3385:TCP:Services
"5270:TCP"= 5270:TCP:Services
"8290:TCP"= 8290:TCP:Services
"8291:TCP"= 8291:TCP:Services
"2494:TCP"= 2494:TCP:Services
"3488:TCP"= 3488:TCP:Services
"9008:TCP"= 9008:TCP:Services
"9009:TCP"= 9009:TCP:Services
"5461:TCP"= 5461:TCP:Services
"9422:TCP"= 9422:TCP:Services
"2978:TCP"= 2978:TCP:Services
"4456:TCP"= 4456:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop

R0 m5287;m5287;C:\WINDOWS\system32\drivers\m5287.sys [05/02/2005 09:00:12 85888]
R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [03/05/2010 20:29:45 28552]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;C:\Program Files\Avira\AntiVir Desktop\sched.exe [24/01/2010 15:16:11 108289]
R2 FsUsbExService;FsUsbExService;C:\WINDOWS\system32\FsUsbExService.Exe [10/08/2009 22:11:04 233472]
R3 FsUsbExDisk;FsUsbExDisk;C:\WINDOWS\system32\FsUsbExDisk.Sys [10/08/2009 22:11:04 36608]
S2 gupdate;Service Google Update (gupdate);C:\Program Files\Google\Update\GoogleUpdate.exe [06/01/2010 23:29:59 135664]
S3 camfilt2;camfilt2;C:\WINDOWS\system32\drivers\camfilt2.sys [20/09/2009 00:22:20 98432]
S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [29/05/2009 17:13:20 234864]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);C:\WINDOWS\system32\drivers\ss_bbus.sys [10/08/2009 22:11:23 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);C:\WINDOWS\system32\drivers\ss_bmdfl.sys [10/08/2009 22:11:23 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;C:\WINDOWS\system32\drivers\ss_bmdm.sys [10/08/2009 22:11:23 121856]
.
Contenu du dossier 'Tâches planifiées'

2010-04-12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34:12 . 2008-07-30 10:34:12]

2010-05-13 C:\WINDOWS\Tasks\Google Software Updater.job
- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-31 11:21:55 . 2009-03-23 08:47:25]

2010-05-13 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-06 21:29:59 . 2010-01-06 21:29:50]

2010-05-13 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-06 21:29:59 . 2010-01-06 21:29:50]

2010-05-13 C:\WINDOWS\Tasks\User_Feed_Synchronization-{EA792E68-90A3-42D3-8F03-B602173DF34B}.job
- C:\WINDOWS\system32\msfeedssync.exe [2007-08-13 16:36:40 . 2009-03-08 02:31:54]
.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
TCP: {AE37FE06-5406-4CFF-B038-CAA9986D4684} = 80.10.246.2,80.10.146.129
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

Toolbar-Locked - (no file)

salut voila le lien c joint : https://www.cjoint.com/?folP3z2LZu

hello voila le rapport

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4086

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

10/05/2010 18:04:26
mbam-log-2010-05-10 (18-04-26).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 330924
Temps écoulé: 57 minute(s), 49 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\system volume information\_restore{787DC6C3-51B9-452C-97E3-A31D31627396}\RP504\A0197075.exe (Adware.UltraReach) -> No action taken.
C:\system volume information\_restore{787DC6C3-51B9-452C-97E3-A31D31627396}\RP504\A0197221.exe (Adware.ADON) -> No action taken.
C:\system volume information\_restore{787DC6C3-51B9-452C-97E3-A31D31627396}\RP504\A0197581.exe (Adware.UltraReach) -> No action taken.
C:\system volume information\_restore{787DC6C3-51B9-452C-97E3-A31D31627396}\RP504\A0198213.exe (Adware.ADON) -> No action taken.
C:\system volume information\_restore{787DC6C3-51B9-452C-97E3-A31D31627396}\RP504\A0198574.exe (Adware.UltraReach) -> No action taken.
C:\system volume information\_restore{787DC6C3-51B9-452C-97E3-A31D31627396}\RP504\A0199213.exe (Adware.ADON) -> No action taken.
C:\system volume information\_restore{787DC6C3-51B9-452C-97E3-A31D31627396}\RP504\A0199575.exe (Adware.UltraReach) -> No action taken.

salut dédétraqué

bah en fait c'est vrai que mon ordinateur va mieux mais il bug toujours au bout d'un moment je ne peux pas le laisser marcher toute la journée...

Avira AntiVir Personal
Date de création du fichier de rapport : samedi 8 mai 2010 14:32

La recherche porte sur 2081209 souches de virus.

Détenteur de la licence : Avira AntiVir Personal - FREE Antivirus
Numéro de série : 0000149996-ADJIE-0000001
Plateforme : Windows XP
Version de Windows : (Service Pack 3) [5.1.2600]
Mode Boot : Mode sans échec
Identifiant : Sofiane
Nom de l'ordinateur : BOUDIAF

Informations de version :
BUILD.DAT : 9.0.0.75 21698 Bytes 22/01/2010 23:14:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 13/10/2009 10:25:46
AVSCAN.DLL : 9.0.3.0 49409 Bytes 03/03/2009 09:21:02
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 10:35:11
LUKERES.DLL : 9.0.2.0 13569 Bytes 03/03/2009 09:21:31
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 06:35:52
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19/11/2009 13:18:02
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20/01/2010 13:18:14
VBASE003.VDF : 7.10.3.75 996864 Bytes 26/01/2010 16:43:56
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05/03/2010 19:54:00
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15/04/2010 18:06:59
VBASE006.VDF : 7.10.6.83 2048 Bytes 15/04/2010 18:07:02
VBASE007.VDF : 7.10.6.84 2048 Bytes 15/04/2010 18:07:03
VBASE008.VDF : 7.10.6.85 2048 Bytes 15/04/2010 18:07:03
VBASE009.VDF : 7.10.6.86 2048 Bytes 15/04/2010 18:07:03
VBASE010.VDF : 7.10.6.87 2048 Bytes 15/04/2010 18:07:03
VBASE011.VDF : 7.10.6.88 2048 Bytes 15/04/2010 18:07:03
VBASE012.VDF : 7.10.6.89 2048 Bytes 15/04/2010 18:07:03
VBASE013.VDF : 7.10.6.90 2048 Bytes 15/04/2010 18:07:04
VBASE014.VDF : 7.10.6.123 126464 Bytes 19/04/2010 18:01:12
VBASE015.VDF : 7.10.6.152 123392 Bytes 21/04/2010 15:40:11
VBASE016.VDF : 7.10.6.178 122880 Bytes 22/04/2010 15:54:11
VBASE017.VDF : 7.10.6.206 120320 Bytes 26/04/2010 18:08:17
VBASE018.VDF : 7.10.6.232 99328 Bytes 28/04/2010 18:08:18
VBASE019.VDF : 7.10.7.2 155648 Bytes 30/04/2010 18:08:18
VBASE020.VDF : 7.10.7.26 119808 Bytes 04/05/2010 15:07:07
VBASE021.VDF : 7.10.7.51 118272 Bytes 06/05/2010 16:16:40
VBASE022.VDF : 7.10.7.52 2048 Bytes 06/05/2010 16:16:40
VBASE023.VDF : 7.10.7.53 2048 Bytes 06/05/2010 16:16:40
VBASE024.VDF : 7.10.7.54 2048 Bytes 06/05/2010 16:16:40
VBASE025.VDF : 7.10.7.55 2048 Bytes 06/05/2010 16:16:40
VBASE026.VDF : 7.10.7.56 2048 Bytes 06/05/2010 16:16:40
VBASE027.VDF : 7.10.7.57 2048 Bytes 06/05/2010 16:16:40
VBASE028.VDF : 7.10.7.58 2048 Bytes 06/05/2010 16:16:41
VBASE029.VDF : 7.10.7.59 2048 Bytes 06/05/2010 16:16:41
VBASE030.VDF : 7.10.7.60 2048 Bytes 06/05/2010 16:16:41
VBASE031.VDF : 7.10.7.66 70656 Bytes 07/05/2010 16:16:44
Version du moteur : 8.2.1.236
AEVDF.DLL : 8.1.2.0 106868 Bytes 23/04/2010 15:54:18
AESCRIPT.DLL : 8.1.3.28 1298810 Bytes 05/05/2010 15:54:09
AESCN.DLL : 8.1.5.0 127347 Bytes 25/02/2010 21:30:33
AESBX.DLL : 8.1.3.1 254324 Bytes 23/04/2010 15:54:18
AERDL.DLL : 8.1.4.6 541043 Bytes 16/04/2010 18:09:19
AEPACK.DLL : 8.2.1.1 426358 Bytes 20/03/2010 12:38:08
AEOFFICE.DLL : 8.1.0.41 201083 Bytes 18/03/2010 21:50:56
AEHEUR.DLL : 8.1.1.27 2670967 Bytes 05/05/2010 15:54:07
AEHELP.DLL : 8.1.11.3 242039 Bytes 02/04/2010 15:47:51
AEGEN.DLL : 8.1.3.7 373106 Bytes 16/04/2010 18:07:27
AEEMU.DLL : 8.1.2.0 393588 Bytes 23/04/2010 15:54:15
AECORE.DLL : 8.1.15.1 192886 Bytes 05/05/2010 15:54:01
AEBB.DLL : 8.1.1.0 53618 Bytes 23/04/2010 15:54:14
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 07:47:30
AVPREF.DLL : 9.0.3.0 44289 Bytes 26/08/2009 14:13:31
AVREP.DLL : 8.0.0.7 159784 Bytes 18/02/2010 13:21:53
AVREG.DLL : 9.0.0.0 36609 Bytes 07/11/2008 14:24:42
AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 14:05:22
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 09:36:37
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 07:20:57
NETNT.DLL : 9.0.0.0 11521 Bytes 07/11/2008 14:40:59
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 17/06/2009 12:44:26
RCTEXT.DLL : 9.0.73.0 88321 Bytes 02/11/2009 15:58:32

Configuration pour la recherche actuelle :
Nom de la tâche...............................: Disques durs locaux
Fichier de configuration......................: c:\program files\avira\antivir desktop\alldiscs.avp
Documentation.................................: bas
Action principale.............................: interactif
Action secondaire.............................: ignorer
Recherche sur les secteurs d'amorçage maître..: marche
Recherche sur les secteurs d'amorçage.........: marche
Secteurs d'amorçage...........................: C:, D:,
Recherche dans les programmes actifs..........: marche
Recherche en cours sur l'enregistrement.......: marche
Recherche de Rootkits.........................: arrêt
Contrôle d'intégrité de fichiers système......: arrêt
Fichier mode de recherche.....................: Sélection de fichiers intelligente
Recherche sur les archives....................: marche
Limiter la profondeur de récursivité..........: 20
Archive Smart Extensions......................: marche
Heuristique de macrovirus.....................: marche
Heuristique fichier...........................: élevé

Début de la recherche : samedi 8 mai 2010 14:32

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'11' processus ont été contrôlés avec '11' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD1
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD2
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD3
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD4
[INFO] Aucun virus trouvé !

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'D:\'
[INFO] Aucun virus trouvé !

La recherche sur les renvois aux fichiers exécutables (registre) commence :
Le registre a été contrôlé ( '67' fichiers).

La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\' <ACER>
C:\pagefile.sys
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
[REMARQUE] Ce fichier est un fichier système Windows.
[REMARQUE] Il est correct que ce fichier ne puisse pas être ouvert pour la recherche.
Recherche débutant dans 'D:\' <ACERDATA>

Fin de la recherche : samedi 8 mai 2010 15:43
Temps nécessaire: 1:10:26 Heure(s)

La recherche a été effectuée intégralement

18926 Les répertoires ont été contrôlés
552362 Des fichiers ont été contrôlés
0 Des virus ou programmes indésirables ont été trouvés
0 Des fichiers ont été classés comme suspects
0 Des fichiers ont été supprimés
0 Des virus ou programmes indésirables ont été réparés
0 Les fichiers ont été déplacés dans la quarantaine
0 Les fichiers ont été renommés
1 Impossible de contrôler des fichiers
552361 Fichiers non infectés
9750 Les archives ont été contrôlées
1 Avertissements
1 Consignes

salut voila le rapoort d'antivir

salut rabah mais tout le monde dit qu'antivir est plus performant qu'avast

salut salut

tu n'aurais pas une autre solution car le scan est trop long a chaque fois mon ordinateur bug avant la fin. il y a un fichier log ds le dossier mais ce sont 2 lignes

re voila le rapport

.
======= RAPPORT D'AD-REMOVER 2.0.0.0,D | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 01/05/10 à 19:50
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 19:54:13 le 06/05/2010 | Mode normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\ADR.exe
SE: Microsoft® Windows XP(TM) Service Pack 3 - X86
Nom du PC: BOUDIAF
Utilisateur actuel: Sofiane
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Everest Poker
C:\Documents and Settings\HelpAssistant\Application Data\Desktopicon
C:\Documents and Settings\HelpAssistant\Application Data\EoRezo
C:\Documents and Settings\HelpAssistant\Application Data\Viewpoint
C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\AskToolbar
C:\Documents and Settings\Invité\Application Data\EoRezo
C:\Documents and Settings\Invité\Local Settings\Application Data\AskToolbar
C:\Documents and Settings\Sana\Application Data\EoRezo
C:\Documents and Settings\Sana\Application Data\ItsLabel
C:\Documents and Settings\Sana\Application Data\Viewpoint
C:\Documents and Settings\Sana\Local Settings\Application Data\AskToolbar
C:\Documents and Settings\Sofiane\Application Data\Viewpoint
C:\Program Files\Application Updater
C:\Program Files\Mozilla FireFox\Components\AskHPRFF.js
C:\Program Files\Viewpoint

(!) -- Fichiers temporaires supprimés.
.
HKCU\Software\AppDataLow\Software\Dealio
HKLM\Software\Application Updater
HKLM\Software\Classes\AxMetaStream.MetaStreamCtl
HKLM\Software\Classes\AxMetaStream.MetaStreamCtl.1
HKLM\Software\Classes\AxMetaStream.MetaStreamCtlSecondary
HKLM\Software\Classes\AxMetaStream.MetaStreamCtlSecondary.1
HKLM\Software\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
HKLM\Software\Classes\Installer\Products\96DC878CBD58B624183A7E1157AABE19
HKLM\Software\Classes\TypeLib\{4F7D1B07-6203-41F0-947B-A29CC9ECD9B0}
HKLM\Software\Classes\TypeLib\{9DBB28C1-1925-11D3-A498-00104B6EB52E}
HKLM\Software\MetaStream
HKLM\Software\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
HKLM\Software\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\96DC878CBD58B624183A7E1157AABE19
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C878CD69-85DB-426B-81A3-E71175AAEB91}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
HKLM\Software\Viewpoint
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Application Updater\ApplicationUpdater.exe
.
(Orpheline) BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} (CLSID manquant)
.
============== SCAN ADDITIONNEL ==============
.
* Mozilla FireFox Version Impossible d'obtenir la version *
.
C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Sofiane\\Mes documents\\Mes images
C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - browser.search.defaultenginename: Ask.com
C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - browser.startup.homepage: hxxp://fr.ask.com?o=15788&l=dis
C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.2.3
C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\Invalidprefs.js - browser.search.defaultenginename: Google
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\Invalidprefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\Invalidprefs.js - browser.search.selectedEngine: Google
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\Invalidprefs.js - browser.search.defaultenginename: Google
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\Invalidprefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\Invalidprefs.js - browser.search.selectedEngine: Google
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Sofiane\\Mes documents\\Mes images
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\prefs.js - browser.search.defaultenginename: Ask.com
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\prefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\prefs.js - browser.startup.homepage: hxxp://fr.ask.com?o=15788&l=dis
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.2.3
C:\Documents and Settings\HelpAssistant\..\a4t6ygw2.default\prefs.js - keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\Invalidprefs.js - browser.search.defaultenginename: Google
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\Invalidprefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\Invalidprefs.js - browser.search.selectedEngine: Google
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\Invalidprefs.js - browser.startup.homepage_override.mstone: rv:1.8.1.11
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\Invalidprefs.js - browser.startup.homepage: hxxp://lo.st#home
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Invité\\Mes documents\\Téléchargements
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\prefs.js - browser.search.defaultenginename: Yahoo
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\prefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\prefs.js - browser.search.selectedEngine: Yahoo
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.2.3
C:\Documents and Settings\HelpAssistant\..\u93ws6is.default\prefs.js - keyword.URL: hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
C:\Documents and Settings\Invité\..\u93ws6is.default\Invalidprefs.js - browser.search.defaultenginename: Google
C:\Documents and Settings\Invité\..\u93ws6is.default\Invalidprefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\Invité\..\u93ws6is.default\Invalidprefs.js - browser.search.selectedEngine: Google
C:\Documents and Settings\Invité\..\u93ws6is.default\Invalidprefs.js - browser.startup.homepage_override.mstone: rv:1.8.1.11
C:\Documents and Settings\Invité\..\u93ws6is.default\Invalidprefs.js - browser.startup.homepage: hxxp://lo.st#home
C:\Documents and Settings\Invité\..\u93ws6is.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Invité\\Mes documents\\Téléchargements
C:\Documents and Settings\Invité\..\u93ws6is.default\prefs.js - browser.search.defaultenginename: Yahoo
C:\Documents and Settings\Invité\..\u93ws6is.default\prefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
C:\Documents and Settings\Invité\..\u93ws6is.default\prefs.js - browser.search.selectedEngine: Yahoo
C:\Documents and Settings\Invité\..\u93ws6is.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.2.3
C:\Documents and Settings\Invité\..\u93ws6is.default\prefs.js - keyword.URL: hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
C:\Documents and Settings\Sana\..\nh4azdym.default\Invalidprefs.js - browser.download.lastDir: C:\\Documents and Settings\\Sana\\Mes documents\\Mes images
C:\Documents and Settings\Sana\..\nh4azdym.default\Invalidprefs.js - browser.startup.homepage_override.mstone: rv:1.9.0.8
C:\Documents and Settings\Sana\..\nh4azdym.default\Invalidprefs.js - browser.startup.homepage: hxxp://y.lo.st
C:\Documents and Settings\Sana\..\nh4azdym.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Sana\\Mes documents
C:\Documents and Settings\Sana\..\nh4azdym.default\prefs.js - browser.search.defaultenginename: Yahoo
C:\Documents and Settings\Sana\..\nh4azdym.default\prefs.js - browser.search.selectedEngine: Yahoo
C:\Documents and Settings\Sana\..\nh4azdym.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.2.3
C:\Documents and Settings\Sana\..\nh4azdym.default\prefs.js - keyword.URL: hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
.
EFFACÉ: C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - user_pref("browser.search.defaultengine", "Ask.com");
EFFACÉ: C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - user_pref("browser.search.defaultenginename", "Ask.com");
EFFACÉ: C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - user_pref("browser.search.order.1", "Ask.com");
EFFACÉ: C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - user_pref("browser.startup.homepage", "hxxp://fr.ask.com?o=15788&l=dis");
EFFACÉ: C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - user_pref("extensions.mywebsearch.openSearchURL", "hxxp://search.mywebsearch.com/mywebsearch/opensearch.jhtml?id=ZJfox000&ptb=OCfSJyhHfYqUvWGt6IzCRA");
EFFACÉ: C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - user_pref("extensions.mywebsearch.prevKwdEnabled", true);
EFFACÉ: C:\Documents and Settings\Sofiane\..\a4t6ygw2.default\prefs.js - user_pref("extensions.mywebsearch.prevKwdURL", "chrome://browser-region/locale/region.properties");
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
.
========================================
.
C:\Ad-Remover\Quarantine: 44 Fichier(s)
C:\Ad-Remover\Backup: 14 Fichier(s)
.
C:\Ad-Report-CLEAN[1].txt - 518 Octet(s)
C:\Ad-Report-CLEAN[2].txt - 11607 Octet(s)
.
Fin à: 20:06:58, 06/05/2010
.
============== E.O.F - CLEAN[2] ==============

je ne sais pas si c'est normal mais le rapport est trés court :

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

helloo voila le lien extras : https://www.cjoint.com/?ffwEgjIrdE

le lien OTL : https://www.cjoint.com/?ffwGJEvMqK

ComboFix 10-05-04.06 - Sofiane 05/05/2010 18:22:47.9.2 - x86 NETWORK
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.767.577 [GMT 2:00]
Lancé depuis: c:\documents and settings\Sofiane\Bureau\Cmb.exe
Commutateurs utilisés :: c:\documents and settings\Sofiane\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\system32\drivers\lsvtm.sys"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\lsvtm.sys

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-05 au 2010-05-05 ))))))))))))))))))))))))))))))))))))
.

2010-05-04 11:44 . 2010-05-04 12:01 -------- d-----w- C:\Cmb
2010-05-03 21:14 . 2010-05-03 21:15 -------- d-----w- C:\tdsskiller
2010-05-03 20:41 . 2010-05-03 20:53 -------- d-----w- C:\Ad-Remover
2010-05-03 18:29 . 2009-06-30 07:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys
2010-05-03 18:29 . 2010-05-03 18:29 -------- d-----w- c:\program files\Panda Security
2010-05-02 21:27 . 2010-05-02 21:27 -------- d-----w- C:\rsit
2010-05-02 19:16 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 19:15 . 2010-05-02 19:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-02 19:15 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-02 18:29 . 2010-05-02 19:05 -------- d---a-w- C:\Navilog1
2010-05-02 18:29 . 2010-05-02 19:03 -------- d-----w- c:\program files\navilog1
2010-05-02 18:01 . 2010-05-02 18:49 -------- d-----w- C:\ToolBar SD
2010-05-02 15:56 . 2010-05-03 15:06 -------- d-----w- c:\documents and settings\HelpAssistant\Tracing
2010-05-02 15:56 . 2010-05-02 15:56 -------- d-----w- c:\documents and settings\HelpAssistant\UserData
2010-05-02 15:56 . 2010-05-02 15:56 -------- d-----w- c:\documents and settings\HelpAssistant\temp
2010-05-02 15:56 . 2010-05-02 15:56 -------- d-----w- c:\documents and settings\HelpAssistant\PrivacIE
2010-05-02 15:53 . 2010-05-02 16:10 -------- d-----w- c:\documents and settings\HelpAssistant\IETldCache
2010-05-02 15:53 . 2010-05-02 15:53 -------- d-----w- c:\documents and settings\HelpAssistant\IECompatCache
2010-05-02 15:53 . 2010-05-02 15:53 -------- d-----w- c:\documents and settings\HelpAssistant\Contacts
2010-05-02 15:51 . 2010-05-02 15:51 -------- d-----w- c:\documents and settings\HelpAssistant\.moovida
2010-05-02 15:51 . 2010-05-02 15:51 -------- d-----w- c:\documents and settings\HelpAssistant\.housecall6.6
2010-04-26 20:56 . 2010-04-26 20:56 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-04-17 21:58 . 2010-05-02 15:13 820440 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-04-17 20:10 . 2010-04-17 20:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Micro Application
2010-04-12 20:50 . 2001-08-23 15:47 99840 ----a-w- c:\windows\system32\srusd.dll
2010-04-12 20:50 . 2001-08-23 15:47 99840 ----a-w- c:\windows\system32\dllcache\srusd.dll
2010-04-12 20:50 . 2001-08-23 15:20 6912 ----a-w- c:\windows\system32\drivers\serscan.sys
2010-04-12 20:50 . 2001-08-23 15:20 6912 ----a-w- c:\windows\system32\dllcache\serscan.sys
2010-04-12 20:50 . 2001-08-23 15:47 72192 ----a-w- c:\windows\system32\fnfilter.dll
2010-04-12 20:50 . 2001-08-23 15:47 72192 ----a-w- c:\windows\system32\dllcache\fnfilter.dll
2010-04-12 20:39 . 2002-06-19 22:00 32256 ----a-w- c:\windows\system32\escwiad.dll
2010-04-12 20:39 . 2002-06-19 22:00 22528 ----a-w- c:\windows\system32\esccmd.dll
2010-04-12 20:39 . 2001-11-14 22:00 47104 ----a-w- c:\windows\system32\escimgd.dll
2010-04-12 20:39 . 2001-11-14 22:00 33280 ----a-w- c:\windows\system32\esccm.dll
2010-04-12 20:39 . 2001-11-14 22:00 32256 ----a-w- c:\windows\system32\escwiab.dll
2010-04-12 20:39 . 2001-11-14 22:00 27648 ----a-w- c:\windows\system32\escimg.dll
2010-04-12 20:39 . 2002-01-30 22:00 126976 ----a-w- c:\windows\system32\Esint23.dll
2010-04-12 13:36 . 2010-04-12 13:36 -------- d-----w- c:\program files\iPod
2010-04-12 13:36 . 2010-04-12 13:37 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-04 17:13 . 2008-07-25 22:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-05-04 12:40 . 2008-05-11 10:42 -------- d-----w- c:\documents and settings\Sofiane\Application Data\uTorrent
2010-05-02 21:27 . 2008-10-19 16:47 -------- d-----w- c:\program files\Trend Micro
2010-05-01 18:05 . 2008-05-11 10:42 -------- d-----w- c:\program files\uTorrent
2010-04-29 13:18 . 2009-12-10 18:43 -------- d-----w- c:\program files\Free Video Converter
2010-04-28 10:59 . 2010-04-28 10:59 789 ----a-w- c:\program files\Raccourci vers HiJackThis.lnk
2010-04-26 20:57 . 2009-06-22 13:35 -------- d-----w- c:\program files\Windows Live
2010-04-26 09:25 . 2010-01-01 16:20 -------- d-----w- c:\program files\ImgBurn
2010-04-17 20:10 . 2008-08-02 14:26 -------- d-----w- c:\program files\Micro Application
2010-04-17 14:21 . 2008-05-11 18:56 -------- d-----w- c:\program files\Google
2010-04-14 11:20 . 2008-05-14 20:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-12 20:39 . 2006-05-21 03:55 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-12 13:37 . 2009-11-30 23:01 -------- d-----w- c:\program files\iTunes
2010-04-12 13:36 . 2009-04-11 08:09 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-12 13:27 . 2009-04-11 08:11 -------- d-----w- c:\program files\Bonjour
2010-04-12 13:13 . 2009-11-30 22:42 -------- d-----w- c:\program files\Safari
2010-04-09 22:41 . 2010-01-24 20:35 -------- d-----w- c:\program files\Messenger Plus! Live
2010-04-03 13:00 . 2009-02-16 11:36 -------- d-----w- c:\program files\CCleaner
2010-03-30 15:18 . 2009-11-30 23:03 75792 ---ha-w- c:\windows\system32\mlfcache.dat
2010-03-28 11:21 . 2006-05-20 20:02 86622 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-28 11:21 . 2006-05-20 20:02 514962 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-14 20:53 . 2009-11-13 21:00 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-03-10 06:16 . 2004-08-05 05:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:17 . 2005-07-03 02:16 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 17:24 . 2009-08-26 18:19 98104 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-02-24 13:11 . 2005-01-19 04:26 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 19:06 . 2005-09-29 18:28 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:06 . 2005-09-29 18:28 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03 . 2010-03-21 21:41 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 09:46 . 2010-02-12 09:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 09:46 . 2010-02-12 09:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-02-12 04:34 . 2004-08-05 05:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-05 05:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"PopUpStopperFreeEdition"="c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 536576]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-04-02 102400]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-25 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"snpstd"="c:\windows\vsnpstd.exe" [2003-12-31 40960]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-27 61440]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-11-09 198160]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\program files\MpcStar\Codecs\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]

c:\documents and settings\Sofiane\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\Sofiane\Menu D'marrer\Programmes\D'marrage\
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
WiFi Station pour Livebox.lnk - c:\program files\Hercules\WiFi Station pour Livebox\WiFiStationLB.exe [2008-5-10 721408]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-10-8 394856]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Acer TV-FM\\PowerCinema.exe"=
"c:\\Program Files\\Acer TV-FM\\PCMService.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"c:\\Program Files\\Hercules\\Classic Link\\Station2.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2431:TCP"= 2431:TCP:Services
"3362:TCP"= 3362:TCP:Services
"3306:TCP"= 3306:TCP:Services
"5112:TCP"= 5112:TCP:Services
"7886:TCP"= 7886:TCP:Services
"7887:TCP"= 7887:TCP:Services
"3300:TCP"= 3300:TCP:Services
"5100:TCP"= 5100:TCP:Services
"5379:TCP"= 5379:TCP:Services
"9258:TCP"= 9258:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [05/02/2005 09:00 85888]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [03/05/2010 20:29 28552]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [24/01/2010 15:16 108289]
S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [08/01/2010 01:51 380928]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [10/08/2009 22:11 233472]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [06/01/2010 23:29 135664]
S3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [20/09/2009 00:22 98432]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [10/08/2009 22:11 36608]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [29/05/2009 17:13 234864]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [10/08/2009 22:11 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [10/08/2009 22:11 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [10/08/2009 22:11 121856]
.
Contenu du dossier 'Tâches planifiées'

2010-04-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-05-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-31 08:47]

2010-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 21:29]

2010-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 21:29]

2010-05-05 c:\windows\Tasks\User_Feed_Synchronization-{EA792E68-90A3-42D3-8F03-B602173DF34B}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://fr.ask.com?o=15788&l=dis
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
mWindow Title =
uInternet Settings,ProxyOverride = local;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
TCP: {AE37FE06-5406-4CFF-B038-CAA9986D4684} = 80.10.246.2,80.10.146.129
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\Sofiane\Application Data\Mozilla\Firefox\Profiles\a4t6ygw2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://fr.ask.com?o=15788&l=dis
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\Sofiane\Application Data\Mozilla\Firefox\Profiles\a4t6ygw2.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin.dll
FF - plugin: c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin6.dll
FF - plugin: c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin7.dll
FF - plugin: c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-05 18:34
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x83929440]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf76d3f28
\Driver\ACPI -> ACPI.sys @ 0xf7625cb8
\Driver\atapi -> atapi.sys @ 0xf75dd852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
SecurityProcedure -> ntoskrnl.exe @ 0x805df529
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
SecurityProcedure -> ntoskrnl.exe @ 0x805df529
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-2261729735-2498202468-3724448963-1006\Software\SecuROM\License information*]
"datasecu"=hex:d8,0e,22,f9,ab,7b,1b,60,74,d5,5b,ce,c8,df,5f,7b,d9,1f,20,bb,e9,
97,25,e3,ef,93,c6,f0,95,dd,51,bc,a5,98,50,ca,26,73,dd,60,75,25,a5,ea,0d,e2,\
"rkeysecu"=hex:ff,5e,ef,21,07,54,25,77,5e,85,2e,c5,79,63,46,a6
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(868)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(676)
c:\windows\system32\eappprxy.dll
.
Heure de fin: 2010-05-05 18:43:41 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-05-05 16:43
ComboFix2.txt 2010-05-04 12:01

Avant-CF: 12 586 717 184 octets libres
Après-CF: 12 507 107 328 octets libres

- - End Of File - - 6B5C22369CD20A37019924018D0FE428

salut salut voila le rapport avec virustotal

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.05.05 -
AhnLab-V3 2010.05.05.00 2010.05.05 -
AntiVir 8.2.1.224 2010.05.04 -
Antiy-AVL 2.0.3.7 2010.04.30 -
Authentium 5.2.0.5 2010.05.05 -
Avast 4.8.1351.0 2010.05.04 -
Avast5 5.0.332.0 2010.05.04 -
AVG 9.0.0.787 2010.05.04 -
BitDefender 7.2 2010.05.05 -
CAT-QuickHeal 10.00 2010.05.04 -
ClamAV 0.96.0.3-git 2010.05.05 -
Comodo 4768 2010.05.05 -
DrWeb 5.0.2.03300 2010.05.05 -
eSafe 7.0.17.0 2010.05.03 Win32.TrojanHorse
eTrust-Vet 35.2.7468 2010.05.04 -
F-Prot 4.5.1.85 2010.05.05 -
F-Secure 9.0.15370.0 2010.05.05 -
Fortinet 4.0.14.0 2010.05.03 -
GData 21 2010.05.05 -
Ikarus T3.1.1.84.0 2010.05.05 -
Jiangmin 13.0.900 2010.05.04 -
Kaspersky 7.0.0.125 2010.05.05 -
McAfee 5.400.0.1158 2010.05.05 -
McAfee-GW-Edition 2010.1 2010.05.04 -
Microsoft 1.5703 2010.05.04 -
NOD32 5086 2010.05.04 -
Norman 6.04.12 2010.05.04 -
nProtect 2010-05-04.01 2010.05.04 -
Panda 10.0.2.7 2010.05.04 -
PCTools 7.0.3.5 2010.05.04 -
Prevx 3.0 2010.05.05 -
Rising 22.46.02.01 2010.05.05 -
Sophos 4.53.0 2010.05.05 -
Sunbelt 6262 2010.05.05 -
Symantec 20091.2.0.41 2010.05.05 -
TheHacker 6.5.2.0.275 2010.05.03 -
TrendMicro 9.120.0.1004 2010.05.05 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.05 -
VBA32 3.12.12.4 2010.05.04 -
ViRobot 2010.5.4.2303 2010.05.05 -
VirusBuster 5.0.27.0 2010.05.04 -