Win32 Zlob-bmv

;)

MERCIII, si tu ne m'avais pas aidé mon ordinateur serait foutu. encore merci pour ton travail

Alors tu peux mettre en résolu le topic (au-dessus de ton premier message dans le rectangle jaune.

Tu peux supprimer tous les rapports.

Fais de temps en temps un scan en mode sans echec de tous tes disques avec antivir et Avg

Quand tu télécharges quelques chose avant de dézipper ou d'installer, un clic droit sur le ou les fichiers et un scan de ce ou ces fichiers avec AVG et même chose avec Antivir (ça prend 2 secondes) et si il y a le moindre doute, poubelle.

Voili Voilou.
@+

;)

_

et est ce que je peus supprimer les rapport que j'ai sauvegardé ?

elle va bien. est ce que c'est fini maintenant ?

Comment va la machine ?

_

Voilà, j'ai fait tout ce que vous m'avez dit de faire et maintenant ?

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 20:35:57 21/03/2008

+ Résultat de l'analyse:

C:\System Volume Information\_restore{B80E15C8-F3B9-49CC-B4B6-3DD51B825612}\RP194\A0050568.dll -> Not-A-Virus.Adware.Agent : Nettoyé.
C:\System Volume Information\_restore{B80E15C8-F3B9-49CC-B4B6-3DD51B825612}\RP204\A0052722.dll -> Not-A-Virus.Adware.Agent : Nettoyé.
C:\Program Files\Mozilla Firefox\components\nsBrowserGal.dll -> Not-A-Virus.Adware.BHO : Nettoyé.
C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.

Fin du rapport

AntiVir PersonalEdition Classic
Report file date: vendredi 21 mars 2008 19:13

Scanning for 1036370 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Administrator
Computer name: ADMIN-F8DE8530F

Version information:
BUILD.DAT : 269 15604 Bytes 9/10/2007 14:31:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 8/23/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 8/16/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 8/14/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 8/21/2007 12:35:20
ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 5/31/2006 12:32:40
ANTIVIR1.VDF : 6.39.0.129 7251968 Bytes 7/10/2007 12:32:46
ANTIVIR2.VDF : 6.39.1.43 1542656 Bytes 8/25/2007 17:21:02
ANTIVIR3.VDF : 6.39.1.51 29696 Bytes 8/28/2007 07:22:36
AVEWIN32.DLL : 7.6.0.5 2789888 Bytes 8/29/2007 17:09:10
AVWINLL.DLL : 1.0.0.7 14376 Bytes 2/26/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 7/18/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 8/3/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 7/18/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 8/28/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 7/18/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 3/8/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 8/7/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 8/21/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 7/23/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: E:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: vendredi 21 mars 2008 19:13

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
12 processes with 12 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'E:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '45' files ).

Starting the file scan:

Begin scan in 'C:\' <System>
C:\pagefile.sys
[WARNING] The file could not be opened!
Begin scan in 'E:\' <Data>

End of the scan: vendredi 21 mars 2008 19:41
Used time: 28:05 min

The scan has been done completely.

7077 Scanning directories
201165 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
201165 Files not concerned
1327 Archives were scanned
1 Warnings
0 Notes

Continue toute la procédure jusqu'à la fin.

-->- Recherche:

C:\Qoobox: trouvé !
C:\Documents and Settings\Administrator\Desktop\BtFix.zip: trouvé !
C:\Documents and Settings\Administrator\Desktop\ComboFix.exe: trouvé !
C:\Documents and Settings\Administrator\Desktop\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\Administrator\Desktop\Btfix: trouvé !
C:\Documents and Settings\Administrator\Desktop\SmitFraudfix: trouvé !
C:\Documents and Settings\Administrator\Desktop\BTFix\Btfix: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\Monjack\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\Administrator\Desktop\BtFix.zip: supprimé !
C:\Documents and Settings\Administrator\Desktop\ComboFix.exe: supprimé !
C:\Documents and Settings\Administrator\Desktop\SmitFraudFix.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Program Files\Trend Micro\Monjack\HijackThis.exe: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\Administrator\Desktop\Btfix: supprimé !
C:\Documents and Settings\Administrator\Desktop\SmitFraudfix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

===================== TOOLSCLEANER2 ========================
Pour supprimer les outils que l'on a utilisé.

• Télécharger ToolsCleaner2
• Double-clic dessus à l'endroit où il a été téléchargé :
• clic sur Recherche
• patienter un moment le temps qu'il travaille...
• Lorsque la recherche est terminée ToolsCleaner affiche une liste des différents outils trouvés,
• clic sur Suppression afin de les supprimer.
• Fermer le programme en cliquant sur Quitter.
• Poster le rapport qui se trouve ici >>> C:\TCleaner.txt

Un petit coup de polish
===================== CCLEANER ========================

Tu pourras le garder celui là pour faire le ménage de temps en temps en suivant la procédure ci-dessous) (qui est à faire maintenant)

• Fermer toutes les applications
• Lancer CCLeaner
• cocher dans le menu Nettoyeur - onglet Windows :
Internet Explorer: Fichiers Internet Temporaires, Cookies
• Système: Vider la Poubelle, Fichiers Temporaires, Presse-papiers
• Avancé: Vieilles données du Prefetch
• Décocher dans le menu Options - sous-menu Avancé :
Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures
• Cocher dans le menu Nettoyeur - onglet Applications : Internet: Sun Java
• Cocher , si cela est possible, dans le menu Nettoyeur - onglet Applications :
Firefox/Mozilla: Cache Internet, Cookies
• Click sur Analyse
• Click sur le bouton Lancer le nettoyage dans le menu Nettoyeur.
• Click sur Registre
• Sélectionner tout
• Click sur Chercher des erreurs (En bas)

Une fois le scan terminé sélectionner tout
• Click sur Réparer les erreurs sélectionnées

==========================

Tu as Antivir. Excellent.

------
• Redémarrer en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
• Attention, pas d’accès à internet dans ce mode. Enregistrer ou imprimer les consignes.

• Relancer le Pc et tapoter la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
• Avec les touches « flèches », sélectionner Mode sans échec ==> entrée ==>nom utilisateur habituel
-------
• Faire une analyse complète de la machine

En fin de scan ( qui est assez long)
• Clic Sauvegarder REPORT puis Enregistrer sous et choisir bureau
-------
• Relancer la machine en mode normal
• Copier/coller le rapport ici

================ AVG ANTI-SPYWARE ===================
Gratuit à garder avec Antivir car il ne fait pas la même chose.
Merci à ep44 pour ce mode explicatif
------
• Redémarrer en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
• Attention, pas d’accès à internet dans ce mode. Enregistrer ou imprimer les consignes.

• Relancer le Pc et tapoter la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
• Avec les touches « flèches », sélectionner Mode sans échec ==> entrée ==>nom utilisateur habituel
-------
• Dans ANALYSE ( en forme de loupe ) <<===== I M P O R T A N T
• Paramètres ==> sous COMMENT REAGIR==>click sur Actions recommandées ==>Quarantaine
• Click : Analyse complète du système

En fin de scan ( qui est assez long)
• Clic Appliquer toutes les actions <== ceci Très important
• Clic Sauvegarder rapport puis Enregistrer sous et choisir bureau
-------
• Relancer la machine en mode normal
• Copier/coller le rapport ici

====================

Quand tu auras fait tout ça. (Il y en a pour un moment).

=========== POINT DE RESTAURATION SYSTEME =============

* Désactivation :
Clic droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs"
• Appliquer
• patienter jusqu’a ce que cela soit marqué "désactivé" puis Ok.

* Activation :
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs"
• Appliquer
• patienter que cela soit à nouveau sur "surveillance" puis Ok.
• Redémarrer l'ordinateur..

Pour désactiver et réactiver sur Vista
Pour désactiver et réactiver sur XP

_

en tout cas un grand Merci d'avance

Pas tout à fait, j'arrive avec la suite et la fin.

_

eeuuhhh, je crois que ça va bien, il n'y a plus de messages qui apparaissent en me disant que l'ordinateur est infesté de spyware et il n'y a plus non plus de pop-up qui s'ouvrent avec un message me disant "this ad has bee provided by internet programm"
est ce wue c'est fini ?

Good.

Comment va la machine ?

(Nous n'avons pas fini)

_

rapport hijackthis après combofix :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:43:04, on 21/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Ananda Computers\Bijoy2003\Bijoy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\Monjack\Monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bijoy2003.lnk = C:\Program Files\Ananda Computers\Bijoy2003\Bijoy.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA974} (3DVista Viewer Control) - http://www.3dvista.com/downloads/viewer3dv.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

rapport ComboFix :

ComboFix 08-03-20.5 - Administrator 2008-03-21 18:37:48.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.521 [GMT 1:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt..txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
c:\windows\system32\cpmsky.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Mes t‚l‚chargements\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Apps\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Apps\Legal\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Apps\moxplugins\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Apps\Oem\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Apps\tools\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\caticons\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\combined_bitmaps\authoring_wiz\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\combined_bitmaps\custom_window\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\combined_bitmaps\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\combined_bitmaps\main_window\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\combined_bitmaps\tag_palette\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\combined_bitmaps\widgets\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\combined_bitmaps\workflow_icons\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\database\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\database\odbc\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\layouts\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\locales\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\locales\fr_fr\bitmaps\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\locales\fr_fr\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\locales\fr_fr\upsell\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\3.0\Shared_Assets\locales\fr_fr\upsell\images\Desktop_.ini
C:\Program Files\Adobe\Photoshop Album Edition D‚couverte\Desktop_.ini
c:\windows\system32\cpmsky.dll

.
((((((((((((((((((((((((( Files Created from 2008-02-21 to 2008-03-21 )))))))))))))))))))))))))))))))
.

2008-03-21 18:31 . 2008-03-21 18:31 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-03-21 18:30 . 2008-03-21 18:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-21 18:30 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-21 12:32 . 2008-03-21 12:36 3,956 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-21 12:31 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-03-21 12:31 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-03-21 12:31 . 2008-03-14 09:09 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-03-21 12:31 . 2008-03-15 17:16 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-03-21 12:31 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-03-21 12:31 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-03-21 12:31 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-03-21 11:37 . 2008-03-21 12:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-21 11:34 . 2008-03-21 11:34 352,092 --a------ C:\cc_20080321_1134.reg
2008-03-21 11:18 . 2008-03-21 11:18 <DIR> d-------- C:\Program Files\CCleaner
2008-03-20 18:47 . 2008-03-20 18:47 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-03-20 17:07 . 2008-03-20 17:07 <DIR> dr------- C:\Documents and Settings\All Users\Application Data\winpcdoctor
2008-03-20 17:01 . 2008-03-20 17:44 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-20 16:12 . 2008-03-20 16:12 261,896 --a------ C:\Documents and Settings\Administrator\Application Data\setup_en[1].exe
2008-03-15 15:36 . 2008-03-15 15:36 80,121 --a------ C:\WINDOWS\system32\adzgalore-remove.exe
2008-03-15 15:36 . 2008-03-15 15:36 40,713 --a------ C:\WINDOWS\system32\cpmsky-uninst.exe
2008-03-05 17:12 . 2003-01-10 10:56 30,921 --a------ C:\WINDOWS\system32\drivers\SQCaptur.sys
2008-03-05 17:12 . 2003-01-10 09:30 25,449 --a------ C:\WINDOWS\system32\drivers\SQCamD.sys
2008-03-02 15:49 . 2008-03-15 16:31 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\LimeWire
2008-02-29 13:01 . 2008-02-29 13:01 244 --ah----- C:\sqmnoopt08.sqm
2008-02-29 13:01 . 2008-02-29 13:01 232 --ah----- C:\sqmdata08.sqm
2008-02-21 03:11 . 2008-02-21 03:11 3,162 --a------ C:\WINDOWS\system32\dtu_fr.qm
2008-02-21 03:05 . 2008-02-21 03:05 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 03:05 . 2008-02-21 03:05 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-02-21 03:05 . 2008-02-21 03:05 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2008-02-21 03:05 . 2008-02-21 03:05 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-02-21 03:05 . 2008-02-21 03:05 9,878 --a------ C:\WINDOWS\system32\dsm_fr.qm
2008-02-21 03:05 . 2008-02-21 03:05 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2008-02-21 03:03 . 2008-02-21 03:03 630,784 --a------ C:\WINDOWS\system32\divxdec.ax
2008-02-21 03:03 . 2008-02-21 03:03 352,401 --a------ C:\WINDOWS\system32\DivXMedia.ax
2008-02-21 03:03 . 2008-02-21 03:03 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 03:03 . 2008-02-21 03:03 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-21 03:03 . 2008-02-21 03:03 8,835 --a------ C:\WINDOWS\system32\dpufr.qm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-21 17:26 --------- d-----w C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2008-03-21 17:00 --------- d-----w C:\Program Files\Norton Security Scan
2008-03-21 11:41 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-20 22:46 --------- d-----w C:\Program Files\NCH Swift Sound
2008-03-20 22:38 --------- d-----w C:\Program Files\Accent EXCEL Password Recovery
2008-03-20 18:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-03-20 16:51 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-16 21:36 --------- d-----w C:\Program Files\Java
2008-03-06 17:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-22 12:42 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Nokia
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-02-20 13:30 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-02-13 11:56 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Nokia Multimedia Player
2008-02-12 15:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Registry Helper
2008-02-12 15:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-02-12 12:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite
2008-02-12 12:27 --------- d-----w C:\Documents and Settings\Administrator\Application Data\PC Suite
2008-02-09 18:51 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2008-02-09 18:50 --------- d-----w C:\Program Files\Windows Media Components
2008-02-09 18:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-02-09 18:49 --------- d-----w C:\Program Files\Ulead Systems
2008-02-09 18:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-09 18:39 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-02-09 18:39 --------- d-----w C:\Program Files\Nokia
2008-02-09 18:39 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-02-09 18:39 --------- d-----w C:\Program Files\Common Files\Nokia
2008-02-09 18:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-02-07 20:49 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-03 00:08 414,272 ----a-w C:\WINDOWS\system32\DivXc32f.dll
2008-02-03 00:08 414,272 ----a-w C:\WINDOWS\system32\DivXc32.dll
2008-01-29 00:48 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-28 12:05 --------- d-----w C:\Program Files\Logitech
2008-01-28 12:05 --------- d-----w C:\Program Files\Common Files\FotoWire
2008-01-28 12:05 --------- d-----w C:\Documents and Settings\Administrator\Application Data\FotoWire
2008-01-28 12:03 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-01-28 12:03 --------- d-----w C:\Program Files\Common Files\Logitech
2007-09-23 10:40 675,880 ----a-w C:\Documents and Settings\Administrator\avcenter.exe.exe
2007-09-20 10:32 43,314 ----a-w C:\Documents and Settings\Administrator\UninstWA.exe.exe
2007-09-12 11:42 2,457,600 ----a-w C:\Documents and Settings\Administrator\Photoshop Album Starter Edition.exe.exe
2007-09-07 13:44 323,584 ----a-w C:\Documents and Settings\Administrator\ddtester.exe.exe
2007-09-02 17:37 9,164,192 ----a-w C:\Documents and Settings\Administrator\EXCEL.EXE.exe
2007-09-02 17:37 5,974,136 ----a-w C:\Documents and Settings\Administrator\POWERPNT.EXE.exe
2007-08-31 11:10 54,048 ----a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2007-08-27 12:33 316,832 ----a-w C:\Documents and Settings\Administrator\SETLANG.EXE.exe
2007-08-26 22:56 837,632 ----a-w C:\Documents and Settings\Administrator\STHSDVD.EXE.exe
2007-08-26 22:56 814,080 ----a-w C:\Documents and Settings\Administrator\STHSVCD.EXE.exe
2007-08-26 22:56 40,448 ----a-w C:\Documents and Settings\Administrator\UNINST32.exe.exe
2007-08-26 22:17 83,360 ----a-w C:\Documents and Settings\Administrator\OSA.EXE.exe
2007-08-26 22:16 2,660,472 ----a-w C:\Documents and Settings\Administrator\FRONTPG.EXE.exe
2007-08-26 17:49 65,536 ----a-w C:\Documents and Settings\Administrator\AcroRd32.exe.exe
2007-08-26 16:54 90,112 ----a-w C:\Documents and Settings\Administrator\CLIStart.exe.exe
2007-08-26 11:28 204,845 ----a-w C:\Documents and Settings\Administrator\realplay.exe.exe
2006-02-19 01:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
.

------- Sigcheck -------

2007-08-26 03:13 502272 6e8ca4fcb30282f216f5db9dd58a5f81 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-03-21_17.34.58,07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-21 17:24:34 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:07 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-05 22:13 68856]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55 5674352]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-01-30 13:11 3497984]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-06-01 11:46 196608]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-01-28 13:03 20480]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"P17Helper"="P17.dll" [2005-05-03 12:38 64512 C:\WINDOWS\system32\P17.dll]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 18:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2003-12-13 01:50 33792]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41 49152]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17 159744]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-13 22:29 185632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-06 23:13 286720]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-05-21 19:11 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-06-01 11:09 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-06-01 11:03 217088]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 19:33 57344]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-06-10 10:44 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44 81920]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 12:25 249896]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:07 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-08-25 23:25:56 110592]
Bijoy2003.lnk - C:\Program Files\Ananda Computers\Bijoy2003\Bijoy.exe [2007-10-31 14:59:31 2449465]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22 288472]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 06:56:20 73728]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-01-28 13:03:27 450560]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56 65588]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Documents and Settings\\Administrator\\Application Data\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a7caa37-53b1-11dc-a4c4-0019d1edc862}]
\Shell\Auto\command - G:\setup.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{308c5533-535a-11dc-a4c3-0019d1edc862}]
\Shell\Auto\command - F:\setup.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47aaf66a-610f-11dc-a4dd-0019d1edc862}]
\Shell\Auto\command - setup.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

*Newly Created Service* - AVG_ANTI-SPYWARE_DRIVER
*Newly Created Service* - AVG_ANTI-SPYWARE_GUARD
*Newly Created Service* - SSMDRV
.
Contents of the 'Scheduled Tasks' folder
"2008-03-21 17:00:14 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-21 18:39:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-21 18:39:39
ComboFix-quarantined-files.txt 2008-03-21 17:39:32
ComboFix2.txt 2008-03-21 16:35:11
.
2008-03-13 01:33:47 --- E O F ---

nouveau rapport hijackths

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:34:08, on 21/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Ananda Computers\Bijoy2003\Bijoy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Documents and Settings\Administrator\Desktop\Monjack\Monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: cpmsky.biz browser optimizer - {BCA95E31-1FBF-4F84-8F23-1BA653007A1E} - C:\WINDOWS\system32\cpmsky.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [PostSetupCheck] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\cpmsky.dll" DllStart
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bijoy2003.lnk = C:\Program Files\Ananda Computers\Bijoy2003\Bijoy.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA974} (3DVista Viewer Control) - http://www.3dvista.com/downloads/viewer3dv.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Tu as 2 antivirus, 1 de trop

=============== DESINSTALLER AVAST ==================

desintaller avast qui est une vrai passoire via le lien ci dessous

desintal Avast

===================================
En complément d'antivir on fait ça

================ AVG ANTI-SPYWARE ===================
Gratuit
Merci à ep44 pour ce mode explicatif
Télécharger:
AVG-AntiSpyware
• Installer
• Le lancer
• Click : Mise à jour
Ne rien faire d'autre pour l'instant avec.

----------------------- Fixer des lignes HitjackThis -------------------

Relancer Hitjackthis

• Fixer cette/ces lignes


O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: (no name) - {8FD66659-A7AF-4641-9999-C56607D3A0AB} - (no file)

O2 - BHO: (no name) - {994B5FB4-0103-44A6-B6B3-C73572B362BC} - (no file)

O22 - SharedTaskScheduler: hyperproduction - {9d19a1a9-3cdf-4f15-a5ca-ea3905febded} - (no file)



• Pour fixer cette/ces lignes.
• Cliquer sur la petite case à gauche de chaque ligne à fixer.

• Une fois cette/ces lignes cochées, cliquer sur le bouton en bas FIX CHECKED
• Fermer et relancer HitJackThis
• Copier/Coller le nouveau rapport sur le forum.

fais ceci :

• Copier le texte ci-dessous :


File::
c:\windows\system32\cpmsky.dll

Registry::
Software\Microsoft\Windows\CurrentVersion\Run]
"PostSetupCheck"=-


• Ouvrir le Bloc-Notes puis coller le texte copié. (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
• Sauvegarder ce fichier sous le nom de CFScript.txt.
• Glisser maintenant le fichier CFScript.txt dans Combofix.exe comme montré ici
• Cela va relancer Combofix,
• Une fenêtre bleue va apparaître: un message qui apparait ( Type 1 to continue, or 2 to abort)
• taper 1 puis valider.

• Patienter le temps du scan. Le bureau va disparaitre à plusieurs reprises: c'est normal!
• Ne toucher à rien tant que le scan n'est pas terminé.

• Après redémarrage, copier/coller le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

S'il n'y a pas de redémarrage, poster quand même les rapports.