Virus Virtumonde (rapport hijackthis)

Oops j'suis pas allé en mode sans échec J'envoie quand meme le rapport vous m'en redonnerez des nouvelles

ComboFix 08-02-20.2 - Proprietaire 2008-02-24 22:06:18.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1361 [GMT -5:00]
Endroit: C:\Users\Proprietaire\Desktop\Logiciel\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-01-25 to 2008-02-25 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-22 22:24 --------- d-----w C:\Program Files\Steam
2008-02-21 12:37 --------- d-----w C:\Users\Proprietaire\AppData\Roaming\Grisoft
2008-02-21 12:37 --------- d-----w C:\ProgramData\Grisoft
2008-02-21 12:30 --------- d-----w C:\Program Files\CCleaner
2008-02-21 00:03 --------- d-----w C:\Program Files\Winamp
2008-02-20 23:15 --------- d-----w C:\Program Files\Echovoice
2008-02-20 16:19 --------- d-----w C:\Program Files\LcdStudio
2008-02-20 15:34 --------- d-----w C:\Program Files\World of Warcraft
2008-02-20 15:12 --------- d-----w C:\ProgramData\Logitech
2008-02-20 15:12 --------- d-----w C:\Program Files\Logitech
2008-02-20 08:24 174 --sha-w C:\Program Files\desktop.ini
2008-02-20 08:17 --------- d-----w C:\Program Files\Windows Mail
2008-02-20 08:17 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 08:17 --------- d-----w C:\Program Files\Windows Calendar
2008-02-20 08:05 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-02-20 08:05 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-02-20 08:05 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-20 08:05 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-02-20 08:05 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-02-20 08:05 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-02-20 08:05 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-02-20 08:05 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-02-20 08:05 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-20 08:05 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-20 08:05 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-02-20 08:05 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-20 08:05 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-02-20 08:04 57,856 ----a-w C:\Windows\System32\SLUINotify.dll
2008-02-20 08:04 566,784 ----a-w C:\Windows\System32\SLCommDlg.dll
2008-02-20 08:04 39,936 ----a-w C:\Windows\System32\slcinst.dll
2008-02-20 08:04 351,232 ----a-w C:\Windows\System32\SLUI.exe
2008-02-20 08:04 33,280 ----a-w C:\Windows\System32\slwmi.dll
2008-02-20 08:04 268,288 ----a-w C:\Windows\System32\mcbuilder.exe
2008-02-20 08:04 223,232 ----a-w C:\Windows\System32\SLC.dll
2008-02-20 08:04 2,605,568 ----a-w C:\Windows\System32\SLsvc.exe
2008-02-20 08:04 186,368 ----a-w C:\Windows\System32\SLLUA.exe
2008-02-19 17:36 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-19 17:24 87,040 ----a-w C:\Windows\System32\msoert2.dll
2008-02-19 17:24 39,424 ----a-w C:\Windows\System32\ACCTRES.dll
2008-02-19 17:24 205,824 ----a-w C:\Windows\System32\msoeacct.dll
2008-02-19 17:24 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-02-19 17:24 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-19 17:23 49,664 ----a-w C:\Windows\System32\csrsrv.dll
2008-02-19 17:23 376,320 ----a-w C:\Windows\System32\winsrv.dll
2008-02-19 17:21 414,208 ----a-w C:\Windows\System32\msscp.dll
2008-02-19 17:21 374,456 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-02-19 17:20 86,016 ----a-w C:\Windows\System32\icfupgd.dll
2008-02-19 17:20 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-02-19 17:20 61,952 ----a-w C:\Windows\System32\cmifw.dll
2008-02-19 17:20 396,800 ----a-w C:\Windows\System32\MPSSVC.dll
2008-02-19 17:20 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll
2008-02-19 17:20 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-02-19 17:20 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll
2008-02-19 17:20 16,896 ----a-w C:\Windows\System32\wfapigp.dll
2008-02-19 17:20 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-02-19 17:20 104,448 ----a-w C:\Windows\System32\DWWIN.EXE
2008-02-19 17:20 1,191,936 ----a-w C:\Windows\System32\msxml3.dll
2008-02-19 17:19 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-19 17:19 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-19 17:19 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-19 17:19 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-19 17:19 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-19 17:19 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-02-19 17:18 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-02-19 17:18 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-02-19 17:18 1,335,296 ----a-w C:\Windows\System32\msxml6.dll
2008-02-19 17:17 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-02-19 17:17 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-02-19 17:15 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-02-19 17:15 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-02-19 17:15 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-02-19 17:15 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-02-19 17:15 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-02-19 17:15 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-02-19 17:14 633,856 ----a-w C:\Windows\System32\user32.dll
2008-02-19 17:14 5,120 ----a-w C:\Windows\System32\wmi.dll
2008-02-19 17:14 152,576 ----a-w C:\Windows\System32\imagehlp.dll
2008-02-19 17:14 12,800 ----a-w C:\Windows\system32\drivers\fs_rec.sys
2008-02-19 17:13 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-19 17:13 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-19 17:13 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-19 17:13 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-19 17:12 750,080 ----a-w C:\Windows\System32\qmgr.dll
2008-02-19 16:16 4,608 ----a-w C:\Windows\System32\w95inf32.dll
2008-02-19 16:16 --------- d-----w C:\Program Files\PCI Audio Applications
2008-02-19 16:11 --------- d-----w C:\Program Files\C-Media
2008-02-19 13:02 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-02-19 13:02 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-02-19 13:02 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-02-19 13:02 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-02-19 12:59 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-02-19 12:59 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-02-19 12:59 33,624 ----a-w C:\Windows\System32\wups.dll
2008-02-19 12:58 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-02-19 12:58 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-02-19 12:56 --------- d-sh--w C:\ProgramData\Modèles
2008-02-19 12:56 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-02-19 12:56 --------- d-sh--w C:\ProgramData\Favoris
2008-02-19 12:56 --------- d-sh--w C:\ProgramData\Bureau
2008-02-19 12:56 --------- d-sh--w C:\Program Files\Fichiers communs
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07C7156E-D651-4ACC-9AD3-498C916E9651}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C989676-A9A4-402A-89FE-9D26E2C0481D}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 15:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{536974A3-4821-4C16-A313-597557CAD947}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{56875E49-4A7A-4E14-9E71-BB7A07A13FDE}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7D4A6800-AD98-46EE-BB37-5A67E9C0E7D1}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-8287-79A187E26987}]
2007-10-24 09:27 1918936 --a------ C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33}
{A057A204-BACC-4D26-8287-79A187E26987}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-8287-79a187e26987}]
[HKEY_CLASSES_ROOT\vmntoolbar.VMNTOOLBAR]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 15:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-19 12:15 1232896]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 18:03 152872]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 07:35 125440]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-08-16 15:19 5728112]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 12:58 495616]
"Speech Recognition"="C:\Windows\Speech\Common\sapisvr.exe" [2006-11-02 04:45 49664]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"Steam"="c:\program files\steam\steam.exe" [2007-11-29 21:49 1266936]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 07:36 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-02-20 03:08 1006264]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-11 21:28 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-11 21:28 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-11 21:28 81920]
"VX1000"="C:\Windows\vVX1000.exe" [2007-04-10 16:46 709992]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 20:52 49152]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 22:17 52256]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 16:45 279912]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 01:15 631362]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224]
"C-Media Echo Control"="C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe" [2001-12-05 16:47 147456]
"C-Media Mixer"="Mixer.exe" [2004-08-10 23:44 1228800 C:\Windows\mixer.exe]
"CmPCIaudio"="CMICNFG3.CPL" []
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 18:30 1687824]
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-17 19:08 2094352]
"Echovoice Gamer Statistics"="C:\Program Files\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe" [2006-11-28 16:52 53248]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]

C:\Users\Proprietaire\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-12-14 17:55:45 106496]
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-01-30 21:02:36 2880336]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 20:40:10 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
backup=C:\Windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Lancement rapide d'Adobe Reader.lnk]
backup=C:\Windows\pss\Lancement rapide d'Adobe Reader.lnk.CommonStartup
backupExtension=.CommonStartup
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Lancement rapide d'Adobe Reader.lnk

[HKLM\~\startupfolder\C:^Users^Proprietaire^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SM.lnk]
backup=C:\Windows\pss\SM.lnk.Startup
backupExtension=.Startup
path=C:\Users\Proprietaire\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SM.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2007-04-09 07:23 200704 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2007-01-08 22:26 68640 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

R1 KS0108;KS0108;C:\Program Files\LcdStudio\ks0108.sys [2006-02-11 17:31]
R1 LC7981;LC7981;C:\Program Files\LcdStudio\LC7981.sys [2006-02-11 17:31]
R1 n3900;n3900;C:\Program Files\LcdStudio\n3900.sys [2006-08-08 09:46]
R1 SED133x;SED133x;C:\Program Files\LcdStudio\SED133x.sys [2006-02-11 17:31]
R1 T6963C;T6963C;C:\Program Files\LcdStudio\T6963c.sys [2006-02-11 17:31]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 09:52]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-05-17 16:45]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2008-01-30 10:11]
R3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-02-14 19:54]
R3 VX1000;VX-1000;C:\Windows\system32\DRIVERS\VX1000.sys [2007-04-10 16:46]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51]
S2 HDDTService;HDD Temperature;C:\Program Files\PalickSoft\HDD Temperature\HDDTSvc.exe [2004-11-24 14:10]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{618d802c-e3ac-11db-8477-806e6f6e6963}]
\shell\AutoRun\command - D:\demo32.exe

*Newly Created Service* - AVG_ANTI-SPYWARE_DRIVER
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-19 06:28:25 C:\Windows\Tasks\Microsoft_Hardware_Launch_vVX1000_exe.job"
- C:\Windows\vVX1000.exe
"2507-04-21 18:45:37 C:\Windows\Tasks\User_Feed_Synchronization-{76DE0A83-C550-467A-A559-218C50487C21}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-24 22:12:52
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\Windows\Explorer.exe [6.00.6000.16549]
-> C:\Program Files\RocketDock\RocketDock.dll
.
Temps d'accomplissement: 2008-02-24 22:14:16
ComboFix-quarantined-files.txt 2008-02-25 03:14:11
ComboFix2.txt 2008-02-20 20:39:32
.
2008-02-21 23:10:19 --- E O F ---

Salut

très bien poste un nouveau rapport combo stp

++

Voici le dernier rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:36:21, on 2008-02-21
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\vVX1000.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe
C:\Windows\mixer.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Users\Proprietaire\Desktop\ChatViewer.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\Xfire\xfire.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\system32\conime.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\winamp toolbar\WinampTbServer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\CCM.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07C7156E-D651-4ACC-9AD3-498C916E9651} - (no file)
O2 - BHO: (no name) - {1C989676-A9A4-402A-89FE-9D26E2C0481D} - (no file)
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: (no name) - {536974A3-4821-4C16-A313-597557CAD947} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {56875E49-4A7A-4E14-9E71-BB7A07A13FDE} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7D4A6800-AD98-46EE-BB37-5A67E9C0E7D1} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: VMN Toolbar - {A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: VMN Toolbar - {A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX1000] C:\Windows\vVX1000.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [C-Media Echo Control] C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Echovoice Gamer Statistics] C:\Program Files\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {E85362EF-40D4-4E5D-BE07-D6B036CCA277} (GoPets Control) - https://secure.gopetslive.com/dev/gopets.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HDD Temperature (HDDTService) - PalickSoft - C:\Program Files\PalickSoft\HDD Temperature\HDDTSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

Ha bah salut finalement ca ces terminer plus rapidement que prévu sauf que j'ai pas pu poster avant.. Alors voila bitdefender

BitDefender Online Scanner

Scan report generated at: Thu, Feb 21, 2008 - 13:09:10

Scan path: C:\;D:\;

Statistics

Time

03:11:43

Files

977621

Folders

26902

Boot Sectors

2

Archives

5656

Packed Files

67630

Results

Identified Viruses

1

Infected Files

2

Suspect Files

0

Warnings

0

Disinfected

0

Deleted Files

2

Engines Info

Virus Definitions

982714

Engine build

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins

16

Archive plugins

41

Unpack plugins

7

E-mail plugins

6

System plugins

5

Scan Settings

First Action

Disinfect

Second Action

Delete

Heuristics

Yes

Enable Warnings

Yes

Scanned Extensions

*;

Exclude Extensions

Scan Emails

Yes

Scan Archives

Yes

Scan Packed

Yes

Scan Files

Yes

Scan Boot

Yes

Scanned File

Status

C:\Windows\System32\klhleaey.dll

Infected with: Trojan.Vundo.DZC

C:\Windows\System32\klhleaey.dll

Deleted

C:\Windows\System32\xynprcwd.dll

Infected with: Trojan.Vundo.DZC

C:\Windows\System32\xynprcwd.dll

Deleted

Et je poste dans un autre message le hijackthis

Loll on se reparle demain je crois bien.. Il me reste encore 10 hrs 30 à l'antivirus lol.. Au mieux il va redescendre cette aprem (mouais j'suis du québec) mais je crois bien qu'il va finir vers les minuits 1 hrs pour toi alors bon ^^

Bonne journée a toi !!

Donc voici le premier rapport de AVG que je viens tout juste de terminer..

Deja avec le cleaner mon ordi semble allez plus vite donc si sa peux faire 2 pierre d'un coup c'est encore mieux :P

Je démarre l'antivirus avec bitdefender à l'instant

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 09:50:19 2008-02-21

+ Résultat de l'analyse:

C:\$WINDOWS.~Q\DATA\Users\Proprietaire\AppData\Local\Temp\removalfile.bat -> Not-A-Virus.Adware.Virtumonde : Ignoré.
C:\Users\Proprietaire\AppData\Roaming\Microsoft\Windows\Cookies\proprietaire@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Users\Proprietaire\AppData\Roaming\Microsoft\Windows\Cookies\proprietaire@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.

Fin du rapport

Hummm y'a un fichier qui a été ignoré pcq'il représentais un faible risque..

Salut

ok, fais ce qui est indiqué ici stp : http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr

++

Ha bah pour l'instant le rapport est positif.. Donc pas eu besoin de redémarrer l'ordi puisqu'il n'a rien trouver..

J'ai fait un test de cliquer sur poste de travail et y'a pas eu le bug attendu que virtumonde fait...

Mais bon pas de fausse joie car on sais jamais.. hier j'ai eu aussi un petit répit lol

[02/20/2008, 17:36:38] - VirtumundoBeGone v1.5 ( "C:\Users\Proprietaire\Desktop\VirtumundoBeGone.exe" )
[02/20/2008, 17:36:44] - Detected System Information:
[02/20/2008, 17:36:44] - Windows Version: 6.0.6000,
[02/20/2008, 17:36:44] - Current Username: Proprietaire (Admin)
[02/20/2008, 17:36:44] - Windows is in NORMAL mode.
[02/20/2008, 17:36:44] - Searching for Browser Helper Objects:
[02/20/2008, 17:36:44] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[02/20/2008, 17:36:44] - BHO 2: {07C7156E-D651-4ACC-9AD3-498C916E9651} ()
[02/20/2008, 17:36:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/20/2008, 17:36:45] - No filename found. Continuing.
[02/20/2008, 17:36:45] - BHO 3: {1C989676-A9A4-402A-89FE-9D26E2C0481D} ()
[02/20/2008, 17:36:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/20/2008, 17:36:45] - No filename found. Continuing.
[02/20/2008, 17:36:45] - BHO 4: {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} (Winamp Toolbar BHO)
[02/20/2008, 17:36:45] - BHO 5: {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} (VMN Toolbar)
[02/20/2008, 17:36:45] - BHO 6: {536974A3-4821-4C16-A313-597557CAD947} ()
[02/20/2008, 17:36:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/20/2008, 17:36:45] - No filename found. Continuing.
[02/20/2008, 17:36:45] - BHO 7: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[02/20/2008, 17:36:45] - BHO 8: {56875E49-4A7A-4E14-9E71-BB7A07A13FDE} ()
[02/20/2008, 17:36:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/20/2008, 17:36:45] - No filename found. Continuing.
[02/20/2008, 17:36:45] - BHO 9: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} (Groove GFS Browser Helper)
[02/20/2008, 17:36:45] - BHO 10: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/20/2008, 17:36:45] - BHO 11: {7D4A6800-AD98-46EE-BB37-5A67E9C0E7D1} ()
[02/20/2008, 17:36:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/20/2008, 17:36:45] - No filename found. Continuing.
[02/20/2008, 17:36:45] - BHO 12: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[02/20/2008, 17:36:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/20/2008, 17:36:45] - No filename found. Continuing.
[02/20/2008, 17:36:45] - BHO 13: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[02/20/2008, 17:36:45] - BHO 14: {A057A204-BACC-4D26-8287-79A187E26987} (VMN Toolbar)
[02/20/2008, 17:36:45] - BHO 15: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/20/2008, 17:36:45] - Finished Searching Browser Helper Objects
[02/20/2008, 17:36:45] - Finishing up...
[02/20/2008, 17:36:45] - Nothing found! Exiting...

tant pie ! on continue :

Télécharger VirtumundoBegone sur le bureau: http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double cliquer sur VirtumundoBeGone.exe et suivre les instructions.
Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau, poste le stp
(Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu)

la suite, demain !

@+

:'( Apres avoir tout essayer non sa ne marche pas... J'ai fait le click droit --executer en tant qu'administrateur

Mais rien y fait.. J'ai aussi tenter le scan complet avec l'autre exe qui avait avec mais nahh sa ne fais pas ce que tu me disais.. Arff...

dac jvais essayer

c'est peut être à cause de vista ...

fais un clic droit dessus < executer en tant qu'administrateur

++

Bon je reviens du mode sans echec bredouille...

En faite quand je double click sur runthis.cmd y'a bien la fenetre qui ouvre mais elle se referme aussi vite et meme si je fais Y y'a rien qui apparait..

Ensuite j'ai double cliker sur catchme et j'ai cliquer sur Scan dans l'onglet files mais j'ai arreter aussi vite puique je n'étais vraiment pas sur que sa revienne au meme.. Voila pourquoi je suis revenu bredouille sur le forum..

Alors ??

non, pas grave !

Télécharge SDFix sur ton bureau

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
Redémarre ton ordinateur en mode sans échec
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script.
Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

Bon voila le rapport!!

J'avais deja fait quelques scan avec ce logiciel auparavent donc voila c'est normal que j'ai plusieurs rapport XD

VundoFix V6.7.8

Checking Java version...

Scan started at 15:32:38 2008-02-18

Listing files found while scanning....

VundoFix V6.7.8

Checking Java version...

Scan started at 15:40:26 2008-02-18

Listing files found while scanning....

C:\Windows\System32\ccbeg.ini
C:\Windows\System32\ccbeg.ini2
C:\Windows\System32\gebcc.dll
C:\Windows\System32\khffgfd.dll
C:\Windows\System32\lafexxvl.dll
C:\Windows\System32\pmnnm.dll
C:\Windows\System32\qrnvwqds.dll
C:\Windows\System32\sqjqglqw.dll
C:\Windows\System32\xynprcwd.dll

Beginning removal...

Beginning removal...

VundoFix V6.7.8

Checking Java version...

Scan started at 16:55:28 2008-02-18

Listing files found while scanning....

VundoFix V6.7.8

Checking Java version...

Scan started at 11:04:03 2008-02-19

Listing files found while scanning....

VundoFix V6.7.8

Checking Java version...

Scan started at 15:58:32 2008-02-20

Listing files found while scanning....

C:\windows\Panther\catalogs\OnlineUpgradeStore.dat
C:\Windows\System32\klhleaey.dll
C:\Windows\System32\lafexxvl.dll
C:\Windows\System32\sqjqglqw.dll
C:\Windows\System32\xwkoulxe.dll
C:\Windows\System32\xynprcwd.dll
C:\Windows\System32\yeaelhlk.ini

Beginning removal...

Au fait c'est normal qu'a la fin comme tu m'avais dis l'écran devienne noir... Mais le prob c'est quil ne m'a pas demander si je voulais redémarrer et ses redémarrer tout seul.. Sa change quelque chose??

Oui oui faut pas s'inquieter je ne disais pas ca méchament ;) je suis de nature patiente et je comprend très bien.. Avec tout les cas que vous pouvez avoir dans une journée je ne veux pas mettre de l'eau sur l'huile en étant moi aussi un cas qui aime critiquer sans raison ^^

Enfin voila vundo est a la phase 2.. Sa ne devrais plus tarder ^^

on n'abandonne pas nos postes comme ça ! :)

suffit juste d'être un peu patient quand on "tarde" à répondre, car on a une vie à côté aussi ! ;)

# Télécharger Vundofix.exe (par Atribune) sur votre Bureau : http://www.atribune.org/ccount/click.php?id=4

* Double-cliquer sur VundoFix.exe afin de le lancer.
* Cliquer sur le bouton Scan for Vundo.
* Lorsque le scan est complété, cliquer sur le bouton Remove Vundo.
* Une invite de commande demandera si l’on souhaite supprimer les fichiers, cliquer sur YES
* Après avoir cliqué "YES", le Bureau disparaîtra un moment lors de la suppression des fichiers. * Une nouvelle invite de commande annoncera que le PC devra s'éteindre ("shutdown"). Cliquer sur OK , puis laisser le redémarrer.
* Le contenu du rapport est situé dans C:\vundofix.txt, poste le stp

++

Coucou me revoila avec le rapport!

--------------------------------------------------------
ComboFix 08-02-20.2 - Proprietaire 2008-02-20 15:24:53.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.2630 [GMT -5:00]
Endroit: C:\Users\Proprietaire\Desktop\ComboFix.exe
.

Incapable d'obtenir les privilèges Système

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Users\Proprietaire\AppData\Roaming\inst.exe
C:\Users\Proprietaire\AppData\Roaming\macromedia\Flash Player\#SharedObjects\N9HYP4VY\www.broadcaster.com
C:\Users\Proprietaire\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Users\Proprietaire\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Windows\System32\avsgjagv.ini
C:\Windows\System32\ccbeg.ini
C:\Windows\System32\ccbeg.ini2
C:\Windows\System32\dwcrpnyx.ini
C:\Windows\system32\gebcc.dll
C:\Windows\system32\jkhhe.dll
C:\Windows\system32\jlhlorae.dll
C:\Windows\system32\khffgfd.dll
C:\Windows\System32\sdqwvnrq.ini
C:\Windows\system32\sstts.dll
C:\Windows\System32\sttss.ini
C:\Windows\System32\sttss.ini2
C:\Windows\system32\vgajgsva.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2008-01-20 to 2008-02-20 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-20 20:34 --------- d-----w C:\Program Files\Steam
2008-02-20 16:19 --------- d-----w C:\Program Files\LcdStudio
2008-02-20 15:34 --------- d-----w C:\Program Files\World of Warcraft
2008-02-20 15:12 --------- d-----w C:\ProgramData\Logitech
2008-02-20 15:12 --------- d-----w C:\Program Files\Logitech
2008-02-20 08:24 174 --sha-w C:\Program Files\desktop.ini
2008-02-20 08:17 --------- d-----w C:\Program Files\Windows Mail
2008-02-20 08:17 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 08:17 --------- d-----w C:\Program Files\Windows Calendar
2008-02-20 08:09 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys
2008-02-20 08:09 619,008 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-02-20 08:09 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys
2008-02-20 08:09 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys
2008-02-20 08:09 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-02-20 08:09 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys
2008-02-20 08:09 2,923,520 ----a-w C:\Windows\explorer.exe
2008-02-20 08:05 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-20 08:05 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-02-20 08:05 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-20 08:05 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-20 08:05 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-02-20 08:05 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-20 08:05 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-02-20 08:03 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-20 08:03 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-20 08:03 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-20 08:03 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-19 17:36 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-19 17:24 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-19 17:22 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-02-19 17:22 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-02-19 17:22 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-02-19 17:22 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-02-19 17:22 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-02-19 17:22 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-02-19 17:22 15,872 ----a-w C:\Windows\system32\drivers\mouhid.sys
2008-02-19 17:22 15,872 ----a-w C:\Windows\system32\drivers\kbdhid.sys
2008-02-19 17:20 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-02-19 17:20 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-02-19 17:20 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-02-19 17:19 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-19 17:19 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-19 17:15 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-02-19 17:15 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-02-19 17:15 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-02-19 17:15 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-02-19 17:14 12,800 ----a-w C:\Windows\system32\drivers\fs_rec.sys
2008-02-19 17:13 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-19 16:16 --------- d-----w C:\Program Files\PCI Audio Applications
2008-02-19 16:11 --------- d-----w C:\Program Files\C-Media
2008-02-19 12:56 --------- d-sh--w C:\ProgramData\Modèles
2008-02-19 12:56 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-02-19 12:56 --------- d-sh--w C:\ProgramData\Favoris
2008-02-19 12:56 --------- d-sh--w C:\ProgramData\Bureau
2008-02-19 12:56 --------- d-sh--w C:\Program Files\Fichiers communs
2008-02-19 07:36 --------- d-----w C:\Users\Proprietaire\AppData\Roaming\ScummVM
2008-02-19 07:36 --------- d-----w C:\Users\Proprietaire\AppData\Roaming\Screenshot Sender
2008-02-19 07:36 --------- d-----w C:\Users\Proprietaire\AppData\Roaming\Printer Info Cache
2008-02-19 07:36 --------- d-----w C:\Users\Proprietaire\AppData\Roaming\Orbit
2008-02-19 07:36 --------- d-----w C:\Users\Proprietaire\AppData\Roaming\NHN Corporation
2008-02-19 07:36 --------- d-----w C:\Users\Proprietaire\AppData\Roaming\My Games
2008-02-19 07:36 --------- d-----w C:\Users\Proprietaire\AppData\Roaming\Morpheus
2008-02-19 07:15 --------- d-----w C:\ProgramData\Xfire
2008-02-19 07:14 --------- d-----w C:\ProgramData\Messenger Plus!
2008-02-19 07:13 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-02-19 07:11 --------- d-----w C:\Program Files\Techland
2008-02-19 07:11 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-02-19 07:11 --------- d-----w C:\Program Files\Team6 game studios
2008-02-19 07:11 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-02-19 07:09 --------- d-----w C:\Program Files\Starcraft
2008-02-19 07:09 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-19 07:08 --------- d-----w C:\Program Files\Sports Interactive
2008-02-19 07:08 --------- d-----w C:\Program Files\SpeedSim
2008-02-19 07:08 --------- d-----w C:\Program Files\Sony Setup
2008-02-19 07:08 --------- d-----w C:\Program Files\Sony
2008-02-19 07:08 --------- d-----w C:\Program Files\SM
2008-02-19 07:08 --------- d-----w C:\Program Files\Singles2
2008-02-19 07:06 --------- d-----w C:\Program Files\SimonT Hockey Simulator
2008-02-19 07:06 --------- d-----w C:\Program Files\Sierra On-Line
2008-02-19 07:06 --------- d-----w C:\Program Files\Sierra Entertainment
2008-02-19 07:06 --------- d-----w C:\Program Files\SHOUTcast
2008-02-19 07:06 --------- d-----w C:\Program Files\Shareaza
2008-02-19 07:04 --------- d-----w C:\Program Files\Nero
2008-02-19 07:04 --------- d-----w C:\Program Files\MSN BackUp
2008-02-19 07:04 --------- d-----w C:\Program Files\MSBuild
2008-02-19 07:04 --------- d-----w C:\Program Files\MRU-Blaster
2008-02-19 07:04 --------- d-----w C:\Program Files\Morpheus Ultra
2008-02-19 07:04 --------- d-----w C:\Program Files\Morpheus
2008-02-19 07:04 --------- d-----w C:\Program Files\mIRC
2008-02-19 07:04 --------- d-----w C:\Program Files\Microsoft.NET
2008-02-19 07:04 --------- d-----w C:\Program Files\Microsoft Works
2008-02-19 07:04 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-02-19 07:04 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-02-19 07:03 --------- d-----w C:\Program Files\Microsoft LifeCam
2008-02-19 07:02 --------- d-----w C:\Program Files\Microsoft Games
2008-02-19 07:02 --------- d-----w C:\Program Files\MessengerDiscovery
2008-02-19 07:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-02-19 07:01 --------- d-----w C:\Program Files\Maxis
2008-02-19 07:01 --------- d-----w C:\Program Files\Lionhead Studios Ltd
2008-02-19 07:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 15:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-8287-79A187E26987}]
2007-10-24 09:27 1918936 --a------ C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33}
{A057A204-BACC-4D26-8287-79A187E26987}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-8287-79a187e26987}]
[HKEY_CLASSES_ROOT\vmntoolbar.VMNTOOLBAR]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 15:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-19 12:15 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 07:34 2159104 C:\Windows\System32\oobefldr.dll]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 18:03 152872]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 07:35 125440]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-08-16 15:19 5728112]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 12:58 495616]
"Speech Recognition"="C:\Windows\Speech\Common\sapisvr.exe" [2006-11-02 04:45 49664]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"Steam"="c:\program files\steam\steam.exe" [2007-11-29 21:49 1266936]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 07:36 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-02-20 03:08 1006264]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-11 21:28 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-11 21:28 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-11 21:28 81920]
"VX1000"="C:\Windows\vVX1000.exe" [2007-04-10 16:46 709992]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 20:52 49152]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 22:17 52256]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 16:45 279912]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 01:15 631362]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224]
"C-Media Echo Control"="C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe" [2001-12-05 16:47 147456]
"C-Media Mixer"="Mixer.exe" [2004-08-10 23:44 1228800 C:\Windows\mixer.exe]
"CmPCIaudio"="CMICNFG3.CPL" []
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 18:30 1687824]
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-17 19:08 2094352]

C:\Users\Proprietaire\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-12-14 17:55:45 106496]
MRU-Blaster Silent Clean.lnk - C:\Program Files\MRU-Blaster\mrublaster.exe [2004-03-28 14:07:48 1216512]
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-01-30 21:02:36 2880336]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 20:40:10 210520]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-02-15 13:51:07 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-02-15 13:44:42 789008]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
backup=C:\Windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Lancement rapide d'Adobe Reader.lnk]
backup=C:\Windows\pss\Lancement rapide d'Adobe Reader.lnk.CommonStartup
backupExtension=.CommonStartup
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Lancement rapide d'Adobe Reader.lnk

[HKLM\~\startupfolder\C:^Users^Proprietaire^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SM.lnk]
backup=C:\Windows\pss\SM.lnk.Startup
backupExtension=.Startup
path=C:\Users\Proprietaire\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SM.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2007-04-09 07:23 200704 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2007-01-08 22:26 68640 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

R1 KS0108;KS0108;C:\Program Files\LcdStudio\ks0108.sys [2006-02-11 17:31]
R1 LC7981;LC7981;C:\Program Files\LcdStudio\LC7981.sys [2006-02-11 17:31]
R1 n3900;n3900;C:\Program Files\LcdStudio\n3900.sys [2006-08-08 09:46]
R1 SED133x;SED133x;C:\Program Files\LcdStudio\SED133x.sys [2006-02-11 17:31]
R1 T6963C;T6963C;C:\Program Files\LcdStudio\T6963c.sys [2006-02-11 17:31]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 09:52]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-05-17 16:45]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2008-01-30 10:11]
R3 VX1000;VX-1000;C:\Windows\system32\DRIVERS\VX1000.sys [2007-04-10 16:46]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51]
S2 HDDTService;HDD Temperature;C:\Program Files\PalickSoft\HDD Temperature\HDDTSvc.exe [2004-11-24 14:10]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-02-14 19:54]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{618d802c-e3ac-11db-8477-806e6f6e6963}]
\shell\AutoRun\command - D:\demo32.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-19 06:28:25 C:\Windows\Tasks\Microsoft_Hardware_Launch_vVX1000_exe.job"
- C:\Windows\vVX1000.exe
"2507-04-21 18:45:37 C:\Windows\Tasks\User_Feed_Synchronization-{76DE0A83-C550-467A-A559-218C50487C21}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 15:34:22
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Users\Proprietaire\Desktop\ChatViewer.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-20 15:39:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-20 20:39:24
.
2008-02-20 08:09:58 --- E O F ---

-------------------------------------------

Alors y'a qqc qui aide ?

Parfait je vais en mode sans echec et je reviens avec le rapport !

Salut

Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* Démarrer en mode sans echec
* Double cliquer combofix.exe.
* Appuyer sur la touche Y (Yes) pour démarrer le scan
* Le rapport sera crée dans: C:\Combofix.txt, poste le stp

++