Rapport hijackthis

Ensuite (et seulement ensuite!):

Télécharge OTMoveIt: http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

# Sauvegarde-le sur ton Bureau.

# Double-Clique sur OTMoveIt.exe pour le lancer.

# Copie le chemin suivant:

C:\WINDOWS\system32\sstqp.exe

# Retourne dans OTMoveit, fais un clique-droit dans la fenêtre "Paste List of Files/Folders to be moved" et choisis Coller.

# Clique sur le bouton rouge Moveit!.

# Ferme OTMoveIt.

Note : Si un fichier ou un dossier ne peut être déplacer immédiatement il te sera demander de redémarrer ta machine pour finir le processus. Si c'est le cas, choisis Yes.

Poste le rapport de OTMoveIT: C:\_OTMoveIt\MovedFiles

j'ai deja avast installé, par contre pour zone alarm je n'arrive plus a l'installer, il me dit que la connection avec le serveur n'a pas pu etre effectué ...

oui je l'ai arreté du démarrage, je le réactive et je relance hijackthis?

re :)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:34, on 2008-01-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Narjess\Bureau\test.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CEventSink Class - {B7154C4D-87C0-4A2C-AB64-DA132BAC2EE6} - d:\Program Files\Hotspot Shield\AnchorFree\ie\AFBho.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] D:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Uniblue SpyEraser] "d:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2FF85F55-2B3C-4253-A813-44FAA7527C13}: NameServer = 193.95.75.10 193.95.75.13
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

Bonjour,

poste un nouveau rapport HiJackThis stp ;o)

re, dsl j'avais des problemes de connection. alors voila le rapport de vundo, il n'a rien detecté

Scan started at 13:40:56 2008-01-10

Listing files found while scanning....

No infected files were found.

ben s'il a été effacé comment ça se fait que quand je fais msconfig je le trouve dans démarrage?

lol j'avais cru comprendre que sstqp.exe et uideinyl.dll étaient associés au virus c'est pour ça que je les ai arreté :s

rundll32.exe "c:\windows\system32\uideinyl.dll",b
c:\windows\system32\sstqp.exe
c'est les 2 commandes des processus que j'ai désactivé au démarrage
merci de ton aide.
@+

Username "Narjess" - 2008-01-06 2:08:34 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Cache de résolution DNS vidé.

System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"Logitech Utility"="Logi_MwX.Exe"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"CnxTrApp"="rundll32.exe \"C:\\Program Files\\Conexant\\Conexant USB Network\\CnxTrApp.dll\",AppEntry -REG \"Conexant\\Conexant USB Network\""
"ZoneAlarm Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Uniblue RegistryBooster 2"="D:\\Program Files\\Uniblue\\RegistryBooster 2\\RegistryBooster.exe /S"
"Uniblue SpyEraser"="\"d:\\Program Files\\Uniblue\\SpyEraser\\SpyEraser.exe\" -m"
"Uniblue SpeedUpMyPC"="D:\\Program Files\\Uniblue\\SpeedUpMyPC 3\\SpeedUpMyPC.exe -s"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

par contre je voudrais préciser que j'avais uideinyl.dll et sstqp.exe comme processus au démarrage et je les ai enlevé depuis a chaque redemarrage l'utilitaire de configuration systeme s'affiche

Une dernière manip:

Télécharge FixWareout sur le bureau: http://downloads.subratam.org/Fixwareout.exe

* Lance le fix: clique sur "Next", puis "Install", assure-toi que l’option "Run fixit" est activée puis clique sur "Finish"
* Il sera demandé ensuite de redémarrer l’ordinateur : redémarre-le
* Si le système met un peu plus de temps au démarrage, c'est normal

Le contenu du rapport qui s'affichera à l'écran sera enregistré dans un fichier nommé report.txt, poste le stp.

* Ouvre Hijackthis, choisis "do a scan only"

Coche la case devant les lignes :

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2FF85F55-2B3C-4253-A813-44FAA7527C13}: NameServer = 193.95.75.10 193.95.75.13

Ferme toutes les autres fenêtres actives et clique sur "Fix checked"

euh non je connais pas mais d'apres ce que j'ai vu c'est une communauté africaine pour l'internet ou un truc du genre ?
il n'y a plus de problémes dans le rapport hijackthis au fait?

RE
l'analyse bitdefender n'a rien detecté...

oui il n'est pas détecté par les anti virus mais FxRajump est spécialement conçu pour ce virus d'apres ce que j'ai lu

Re
This website is not authorized to host this active X control... voila le message que j'ai quand je veux démarrer l'analyse en ligne

j'ai téléchargé FxRajump, j'ai fait une analyse et il ne trouve pas levirus ravmon donc c'est pas ça :/

Re,

fais une analyse BitDefender à partir d'IE: http://www.bitdefender.fr/scan8/

et poste le rapport stp.

NB: ça peut être un peu long ...

voila le rapport hijackthis lol

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:38, on 2008-01-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
d:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\program files\Steam\Steam.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Narjess\Bureau\test.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CEventSink Class - {B7154C4D-87C0-4A2C-AB64-DA132BAC2EE6} - d:\Program Files\Hotspot Shield\AnchorFree\ie\AFBho.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CnxTrApp] rundll32.exe "C:\Program Files\Conexant\Conexant USB Network\CnxTrApp.dll",AppEntry -REG "Conexant\Conexant USB Network"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] D:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Uniblue SpyEraser] "d:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\WINSOS\WINSOS.EXE" MINI
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2FF85F55-2B3C-4253-A813-44FAA7527C13}: NameServer = 193.95.75.10 193.95.75.13
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - d:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

bonjour
voici le rapport combofix

ComboFix 08-01-04.1 - Narjess 2008-01-05 12:56:37.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.200 [GMT 1:00]
Running from: C:\Documents and Settings\Narjess\Mes documents\My Completed Downloads\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\bmfftyhc.ini
C:\WINDOWS\system32\chytffmb.dll
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\drivers\Lqu26.sys
C:\WINDOWS\system32\drivers\Otx37.sys
C:\WINDOWS\system32\drivers\Xdh48.sys
C:\WINDOWS\system32\jkkihfg.dll
C:\WINDOWS\system32\pqtss.ini
C:\WINDOWS\system32\pqtss.ini2
C:\WINDOWS\system32\sstqp.dll
C:\WINDOWS\system32\sstqp.exe
C:\WINDOWS\system32\vfwchocb.dll

[code] <pre>
"C:\Program Files\Alwil Software\Avast4\ashDisp .exe" replaces infected copy of "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
Error moving C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe to C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe: 5.
"C:\WINDOWS\system32\ctfmon .exe" moved to QooBox
</pre> [/code]
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NPF
-------\LEGACY_SMTPDRV
-------\smtpdrv

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-05 to 2008-01-05 ))))))))))))))))))))))))))))))))))))
.

2008-01-05 12:42 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-03 23:34 . 2008-01-03 23:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2008-01-03 23:34 . 2008-01-03 23:34 10,624 --a------ C:\WINDOWS\system32\drivers\pxark.sys
2008-01-03 23:33 . 2008-01-03 23:35 <REP> d-------- C:\Documents and Settings\Narjess\Application Data\PrevxCSI
2008-01-03 08:34 . 2008-01-03 21:28 1,031,762 ---hs---- C:\WINDOWS\system32\lyniediu.ini
2008-01-02 18:53 . 2008-01-02 18:54 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-01-02 02:21 . 2008-01-04 05:17 <REP> d-------- C:\Program Files\Winsos
2008-01-01 21:37 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-01-01 21:37 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-01 21:37 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-01 21:37 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-01 21:37 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-01 21:37 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-01 21:36 . 2008-01-01 21:36 <REP> d-------- C:\Program Files\Alwil Software
2008-01-01 21:36 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-01-01 21:24 . 2008-01-01 21:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-01 21:24 . 2008-01-01 21:28 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-01-01 21:23 . 2008-01-05 13:24 1,501,216 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-01 21:23 . 2008-01-01 21:23 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-01-01 21:23 . 2007-06-21 21:54 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-01-01 21:23 . 2008-01-01 21:23 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-01-01 21:23 . 2007-06-21 21:55 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2008-01-01 21:23 . 2007-06-21 21:55 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-01-01 21:23 . 2007-06-21 21:55 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-01-01 21:23 . 2008-01-05 13:24 21,800 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-01 21:23 . 2007-06-21 21:55 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-01-01 21:21 . 2008-01-05 13:27 <REP> d-------- C:\WINDOWS\Internet Logs
2008-01-01 20:35 . 2008-01-01 20:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-12-28 23:54 . 2001-08-17 21:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys
2007-12-28 23:54 . 2004-08-03 22:31 154,624 --a--c--- C:\WINDOWS\system32\dllcache\wlluc48.sys
2007-12-28 23:54 . 2001-08-23 17:47 87,040 --a--c--- C:\WINDOWS\system32\dllcache\wiafbdrv.dll
2007-12-28 23:54 . 2001-08-23 17:47 54,272 --a--c--- C:\WINDOWS\system32\dllcache\wiamsmud.dll
2007-12-28 23:54 . 2001-08-23 17:05 35,402 --a--c--- C:\WINDOWS\system32\dllcache\wlandrv2.sys
2007-12-28 23:54 . 2004-08-03 23:07 8,832 --a--c--- C:\WINDOWS\system32\dllcache\wmiacpi.sys
2007-12-28 23:52 . 2001-08-23 17:47 525,568 --a--c--- C:\WINDOWS\system32\dllcache\tridxp.dll
2007-12-28 23:51 . 2001-08-23 17:46 147,200 --a--c--- C:\WINDOWS\system32\dllcache\smidispb.dll
2007-12-28 23:50 . 2001-08-23 17:46 252,032 --a--c--- C:\WINDOWS\system32\dllcache\sis300iv.dll
2007-12-28 23:49 . 2001-08-23 17:47 495,616 --a--c--- C:\WINDOWS\system32\dllcache\sblfx.dll
2007-12-28 23:48 . 2001-08-23 17:18 899,914 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2007-12-28 23:47 . 2004-08-19 16:09 363,520 --a--c--- C:\WINDOWS\system32\dllcache\psisdecd.dll
2007-12-28 23:46 . 2001-08-17 22:05 351,616 --a--c--- C:\WINDOWS\system32\dllcache\ovcodek2.sys
2007-12-28 23:45 . 2001-08-17 20:50 198,144 --a--c--- C:\WINDOWS\system32\dllcache\nv3.sys
2007-12-28 23:44 . 2001-08-17 20:50 103,296 --a--c--- C:\WINDOWS\system32\dllcache\mtxvideo.sys
2007-12-28 23:44 . 2004-08-03 23:10 49,024 --a--c--- C:\WINDOWS\system32\dllcache\mstape.sys
2007-12-28 23:44 . 2001-08-23 17:08 22,144 --a--c--- C:\WINDOWS\system32\dllcache\mxcard.sys
2007-12-28 23:44 . 2004-08-03 23:00 22,016 --a--c--- C:\WINDOWS\system32\dllcache\msircomm.sys
2007-12-28 23:44 . 2001-08-17 21:49 19,968 --a--c--- C:\WINDOWS\system32\dllcache\mxnic.sys
2007-12-28 23:44 . 2001-08-23 17:47 19,968 --a--c--- C:\WINDOWS\system32\dllcache\mxicfg.dll
2007-12-28 23:44 . 2001-08-17 21:48 12,416 --a--c--- C:\WINDOWS\system32\dllcache\msriffwv.sys
2007-12-28 23:44 . 2001-08-23 17:47 7,168 --a--c--- C:\WINDOWS\system32\dllcache\mxport.dll
2007-12-28 23:44 . 2004-08-03 22:58 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
2007-12-28 23:44 . 2001-08-17 22:00 2,944 --a--c--- C:\WINDOWS\system32\dllcache\msmpu401.sys
2007-12-28 23:43 . 2001-08-23 17:03 320,384 --a--c--- C:\WINDOWS\system32\dllcache\mgaum.sys
2007-12-28 23:43 . 2001-08-23 17:46 235,648 --a--c--- C:\WINDOWS\system32\dllcache\mgaud.dll
2007-12-28 23:43 . 2004-08-19 16:10 56,832 --a--c--- C:\WINDOWS\system32\dllcache\msdvbnp.ax
2007-12-28 23:43 . 2004-08-03 23:10 51,328 --a--c--- C:\WINDOWS\system32\dllcache\msdv.sys
2007-12-28 23:43 . 2001-08-17 22:02 35,200 --a--c--- C:\WINDOWS\system32\dllcache\msgame.sys
2007-12-28 23:43 . 2001-08-17 21:52 17,280 --a--c--- C:\WINDOWS\system32\dllcache\mraid35x.sys
2007-12-28 23:43 . 2004-08-03 23:10 15,360 --a--c--- C:\WINDOWS\system32\dllcache\mpe.sys
2007-12-28 23:43 . 2001-08-17 21:52 6,528 --a--c--- C:\WINDOWS\system32\dllcache\miniqic.sys
2007-12-28 23:43 . 2001-08-17 21:48 6,016 --a--c--- C:\WINDOWS\system32\dllcache\msfsio.sys
2007-12-28 23:40 . 2004-08-19 16:00 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2007-12-28 23:37 . 2004-08-19 16:09 702,845 --a--c--- C:\WINDOWS\system32\dllcache\i81xdnt5.dll
2007-12-28 23:35 . 2001-08-17 21:28 542,879 --a--c--- C:\WINDOWS\system32\dllcache\hsf_msft.sys
2007-12-28 23:34 . 2001-08-23 17:46 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll
2007-12-28 23:32 . 2001-08-17 20:15 455,680 --a--c--- C:\WINDOWS\system32\dllcache\fus2base.sys
2007-12-28 23:32 . 2001-08-17 20:15 455,296 --a--c--- C:\WINDOWS\system32\dllcache\fusbbase.sys
2007-12-28 23:32 . 2001-08-17 20:14 444,416 --a--c--- C:\WINDOWS\system32\dllcache\fpcibase.sys
2007-12-28 23:32 . 2001-08-17 20:15 442,240 --a--c--- C:\WINDOWS\system32\dllcache\fpnpbase.sys
2007-12-28 23:32 . 2001-08-17 20:14 441,728 --a--c--- C:\WINDOWS\system32\dllcache\fpcmbase.sys
2007-12-28 23:32 . 2001-08-23 17:47 92,672 --a--c--- C:\WINDOWS\system32\dllcache\fuusd.dll
2007-12-28 23:32 . 2001-08-23 17:47 72,192 --a--c--- C:\WINDOWS\system32\dllcache\fnfilter.dll
2007-12-28 23:32 . 2004-08-03 22:31 34,173 --a--c--- C:\WINDOWS\system32\dllcache\forehe.sys
2007-12-28 23:30 . 2001-08-23 17:13 634,166 --a--c--- C:\WINDOWS\system32\dllcache\el656ct5.sys
2007-12-28 23:29 . 2001-08-17 20:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys
2007-12-28 23:28 . 2001-08-23 17:04 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys
2007-12-28 23:27 . 2001-08-23 17:03 715,466 --a--c--- C:\WINDOWS\system32\dllcache\cbmdmkxx.sys
2007-12-28 23:26 . 2002-09-18 16:22 189,986 --a--c--- C:\WINDOWS\system32\dllcache\c_1361.nls
2007-12-28 23:25 . 2001-08-23 17:46 81,920 --a--c--- C:\WINDOWS\system32\dllcache\brmfcwia.dll
2007-12-28 23:24 . 2001-08-17 21:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys
2007-12-28 23:23 . 2001-08-17 22:07 56,960 --a--c--- C:\WINDOWS\system32\dllcache\aic78xx.sys
2007-12-28 23:23 . 2001-08-17 22:07 55,168 --a--c--- C:\WINDOWS\system32\dllcache\aic78u2.sys
2007-12-28 23:23 . 2001-08-17 20:11 27,678 --a--c--- C:\WINDOWS\system32\dllcache\ali5261.sys
2007-12-28 23:23 . 2001-08-17 21:49 26,624 --a--c--- C:\WINDOWS\system32\dllcache\alifir.sys
2007-12-28 23:23 . 2001-08-23 17:47 24,576 --a--c--- C:\WINDOWS\system32\dllcache\agcgauge.ax
2007-12-28 23:23 . 2001-08-17 20:11 16,969 --a--c--- C:\WINDOWS\system32\dllcache\amb8002.sys
2007-12-28 23:23 . 2001-08-17 21:52 12,800 --a--c--- C:\WINDOWS\system32\dllcache\aha154x.sys
2007-12-28 23:23 . 2001-08-17 21:51 5,248 --a--c--- C:\WINDOWS\system32\dllcache\aliide.sys
2007-12-28 23:21 . 2001-08-23 17:46 66,048 --a--c--- C:\WINDOWS\system32\dllcache\s3legacy.dll
2007-12-28 13:14 . 2007-12-29 00:16 <REP> d-------- C:\Program Files\Windows Live
2007-12-28 07:08 . 2007-12-28 07:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2007-12-28 06:57 . 2008-01-04 00:54 <REP> d-------- C:\VundoFix Backups
2007-12-28 06:37 . 2007-12-28 07:12 <REP> d-------- C:\Documents and Settings\Narjess\Application Data\Uniblue
2007-12-12 23:32 . 2007-12-12 23:32 <REP> d-------- C:\Program Files\MSECache
2007-12-11 00:40 . 2007-12-11 00:40 <REP> d-------- C:\Program Files\Windows Journal Viewer
2007-12-10 23:55 . 2007-12-11 00:10 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-12-07 02:51 . 2002-09-18 16:23 55,808 --a------ C:\WINDOWS\system32\freecell.exe
2007-12-07 02:51 . 2002-09-18 16:23 55,808 --a--c--- C:\WINDOWS\system32\dllcache\freecell.exe
2007-12-07 02:50 . 2007-12-12 08:12 1,393 --a------ C:\WINDOWS\imsins.BAK

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-05 07:37 --------- d-----w C:\Documents and Settings\Narjess\Application Data\teamspeak2
2008-01-02 18:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-01 19:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-31 00:43 --------- d-----w C:\Documents and Settings\Narjess\Application Data\Skype
2007-12-29 07:47 --------- d-----w C:\Program Files\SnadBoy's Revelation v2
2007-12-28 23:52 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-28 23:35 --------- d-----w C:\Program Files\MessengerPlus! 3
2007-12-28 12:21 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-12-28 09:00 --------- d-----w C:\Program Files\QuickTime
2007-12-28 07:47 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-12-28 06:10 --------- d-----w C:\Program Files\SuperCopier2
2007-12-28 00:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-28 00:11 --------- d-----w C:\Program Files\Windows Defender
2007-12-24 17:45 --------- d-----w C:\Program Files\Windows Live Safety Center
2007-12-12 22:38 51,864 ----a-w C:\Documents and Settings\Narjess\Application Data\GDIPFONTCACHEV1.DAT
2007-12-03 17:44 --------- d-----w C:\Documents and Settings\Narjess\Application Data\Samsung
2007-12-03 14:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-03 14:05 --------- d-----w C:\Program Files\Samsung
2007-11-21 17:20 --------- d-----w C:\Program Files\Yahoo!
2007-11-19 17:13 --------- d-----w C:\Program Files\Steam
2007-11-18 19:30 --------- d-----w C:\Documents and Settings\Narjess\Application Data\Screenshot Sender
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-12 10:34 --------- d-----w C:\Documents and Settings\Narjess\Application Data\Hamachi
2007-11-05 00:24 --------- d-----w C:\Documents and Settings\Narjess\Application Data\dvdcss
2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-25 09:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-23 16:49 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
1995-09-20 15:16 456,976 ----a-w C:\Program Files\Fichiers communs\dao3032.dll
2006-01-10 19:38 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin
.
[code]<pre>
----a-w 2,434,492 2008-01-04 04:10:30 C:\Program Files\Winsos\WINSOS .EXE
----a-w 919,016 2008-01-05 11:30:34 C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
</pre>[/code]

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"Uniblue RegistryBooster 2"="D:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-12-05 15:51 1885464]
"Uniblue SpyEraser"="d:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" [2007-12-03 15:39 1260296]
"Uniblue SpeedUpMyPC"="D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe" [2007-12-07 09:42 9479448]
"WINSOS VERIFY"="C:\Program Files\WINSOS\WINSOS.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 03:06 7311360]
"nwiz"="nwiz.exe" [2006-06-01 16:22 1519616 C:\WINDOWS\system32\nwiz.exe]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-11 08:50 20992 C:\WINDOWS\LOGI_MWX.EXE]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 03:06 86016]
"CnxTrApp"="C:\Program Files\Conexant\Conexant USB Network\CnxTrApp.dll" [2003-07-18 07:32 247296]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [ ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-01-05 12:30 79224]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-19 16:10 160768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 13:45 36040]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 14:39 294400]
"{89AF1DCA-6355-4465-94B0-E3D49FD2896B}"= C:\WINDOWS\system32\jkkihfg.dll [ ]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hlp40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lqu26.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Mrv61.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Otx37.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Uae15.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Xdh48.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\f82171ea]
rundll32.exe C:\WINDOWS\system32\uideinyl.dll,b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\sstqp.exe

R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [2006-12-16 21:37]
S3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2004-03-02 07:24]
S3 ATE_PROCMON;ATE_PROCMON;D:\program files\Anti Trojan Elite\ATEPMon.sys []
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2002-09-06 19:34]
S3 Hlp40;Hlp40;C:\WINDOWS\System32\drivers\Hlp40.sys []
S3 Lqu26;Lqu26;C:\WINDOWS\System32\drivers\Lqu26.sys []
S3 Mrv61;Mrv61;C:\WINDOWS\System32\drivers\Mrv61.sys []
S3 Otx37;Otx37;C:\WINDOWS\System32\drivers\Otx37.sys []
S3 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-01-03 23:34]
S3 Uae15;Uae15;C:\WINDOWS\System32\drivers\Uae15.sys []
S3 Xdh48;Xdh48;C:\WINDOWS\System32\drivers\Xdh48.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26e675d5-bd9a-11db-86ff-0007e9633dcf}]
\Shell\AutoRun\command - 021.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c3982789-2783-11dc-8729-0007e9633dcf}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d813385c-5351-11db-86cc-0007e9633dcf}]
\Shell\AutoRun\command - RavMon.exe

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-01-05 12:00:00 C:\WINDOWS\Tasks\BCF692D881210C10.job"
- c:\docume~1\narjess\applic~1\mfcdke~1\test meal support.exe
"2008-01-05 12:29:18 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-12-28 06:10:02 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- d:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-12-28 06:09:57 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- d:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-12-28 07:01:14 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- d:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
"2008-01-05 11:50:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"

Bonjour!

Il a quand même effacé qq fichiers ^^

Télécharge Combofix.exe sur ton Bureau: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Déconnecte-toi du net et désactive ton antivirus pour que Combofix puisse s'exécuter normalement.

* Double clique sur Combofix.exe
* Mets le en langue française F
* Tape sur la touche 1 (Yes) pour démarrer le scan
* Lorsque le scan sera terminé, un rapport apparaîtra
* Poste le rapport qui se se trouve là: C:\Combofix.txt

++