Virus via msn..!

DqM -  
Bonjour,
j'ai choppé un virus via msn , le msg envoyé par un de mes contact était : "http."monadresse".1fp9.info" je vous ai donc fait un rapport avec hijackthis : aidez moi svp!

Logfile of HijackThis v1.99.1
Scan saved at 17:59:20, on 18/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\DaMien\Bureau\w3hph.exe
C:\PROGRA~1\Grisoft\AVG7\avgwb.dat
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\DaMien\Bureau\log\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\DaMien\OctoshapeClient.exe" -inv:bootrun
O4 - HKCU\..\Run: [TheTurtle] C:\Program Files\TheTurtle\TheTurtle.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://www.pplive.com/zh-cn/other/live/install.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Configuration: Windows XP
Firefox 2.0.0.14

29 réponses

Résumé de la discussion

Le sujet décrit une infection par un virus reçue via MSN et analyse un log HijackThis détaillant de multiples processus et éléments de démarrage problématiques sur Windows XP SP2. Plusieurs réponses proposent des outils de décontamination: MSNFix pour nettoyer l'infection, puis ComboFix, avec des avertissements sur la présence potentielle de composants résiduels et nécessité de redémarrer en mode normal. Les rapports HijackThis listent éléments potentiellement malveillants en démarrage, barres d'outils et modules BHO, ainsi que des services et pilotes liés à divers logiciels, avec entrées réseau et autorisations firewall modifiées. D'autres éléments montrent des outils de Wanadoo et des composants AVG et RealPlayer présents dans les journaux, indiquant des installations légitimes coexistant avec des composants potentiellement indésirables.

Bobot (l’IA à votre service)
  1. btengs
    Hello

    Je suis toujours virusé... pouvez vous m'aider ?

    merci beaucoup
    2. DqM Auteur
      le truc kaspersky a trouvé des virus , mais le log bug au moment de choisir les fichier a supprimer , je peu pas les choisir... sinon malware bytes a rien trouvé.. je sais plus ou sont les rapports jvai retenté kaspersky
      1. ludsfa
        salut Dqm.

        on reprends et finit pour toi dqm.

        1) Télécharge MalwareByte's Anti-Malware sur ton Bureau.
        Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.
        https://www.majorgeeks.com/files/details/malwarebytes_anti_malware.html

        Une fois l'installation et la mise à jour effectuées, redémarre en mode sans échec.
        AIDE : Redémarrer en mode sans échec :
        http://www.infos-du-net.com/forum/272325-11-tuto-demarrer-mode-echec

        * Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".
        * Afin de lancer la recherche, clic sur"Rechercher".
        * Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :

        -- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
        -- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.
        REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.

        AIDE : Tuto en images sur MBAM:
        http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

        2)fais une analyse en ligne avec kaspersky attention cette analyse ne fonctionne qu'avec internet explorer

        https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

        * Clique sur démarrer online-scanner.
        * Clique maintenant sur J'accepte.
        * Valide l'installation d'un ou de plusieurs ActiveX si c'est nécessaire.
        * Patiente pendant l'installation des Mises à jour.
        * Choisis par la suite l'analyse du Poste de travail
        * Sauvegarde puis colle le rapport généré en fin d'analyse.

        AIDE : Tuto sur le scan en ligne:
        http://www.infos-du-net.com/forum/266006-11-tutos#t159015

        NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne.
        2. DqM Auteur
          le voici :

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 12:47:32, on 30/04/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\Program Files\Logitech\Video\LogiTray.exe
          C:\WINDOWS\system32\LVCOMSX.EXE
          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
          C:\WINDOWS\Mixer.exe
          C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
          C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
          C:\Program Files\SuperCopier2\SuperCopier2.exe
          C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
          C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
          C:\Program Files\Logitech\Video\FxSvr2.exe
          C:\PROGRA~1\Wanadoo\ComComp.exe
          C:\PROGRA~1\Wanadoo\Toaster.exe
          C:\PROGRA~1\Wanadoo\Inactivity.exe
          C:\PROGRA~1\Wanadoo\PollingModule.exe
          C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
          C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
          C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
          C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
          C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
          C:\WINDOWS\System32\FTRTSVC.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\WINDOWS\system32\HPZipm12.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\wdfmgr.exe
          C:\WINDOWS\system32\wscntfy.exe
          C:\PROGRA~1\Grisoft\AVG7\avgw.exe
          C:\WINDOWS\System32\alg.exe
          C:\PROGRA~1\Wanadoo\Watch.exe
          C:\Program Files\Windows Media Player\wmplayer.exe
          C:\Program Files\Mozilla Firefox\firefox.exe
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
          C:\WINDOWS\system32\wbem\wmiprvse.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
          O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
          O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
          O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
          O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
          O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
          O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
          O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
          O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
          O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\DaMien\OctoshapeClient.exe" -inv:bootrun
          O4 - HKCU\..\Run: [TheTurtle] C:\Program Files\TheTurtle\TheTurtle.exe
          O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
          O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
          O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://www.pplive.com/zh-cn/other/live/install.cab
          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
          O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
          O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
          O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
          O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
          O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
          1. ludsfa
            Bteng , normalement il faut que tu créer ton propre sujet.

            bon ok

            Télécharger sur le bureau
            Navilog.exe :
            http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

            = double-clic dessus pour l'installer et le lancer
            Quand installé
            = taper F
            = Appuyer sur une touche jusqu' arriver aux options
            = Choisir option 1 ( = taper 1 )
            ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes

            un rapport : fixnavi.txt
            dans ==> C :
            poste moi le rapport.
            1. btengs
              Merci Ludsfa,

              je me suis fait débouté quand j'avais créé mon post ^^

              J'ai fait ta manip' , voici le rapport :

              Microsoft Windows XP [version 5.1.2600]
              Internet Explorer : 6.0.2900.2180
              Système de fichiers : NTFS

              Executé en mode normal

              *** Recherche Programmes installés ***

              *** Recherche dossiers dans "C:\WINDOWS" ***

              *** Recherche dossiers dans "C:\Program Files" ***

              *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

              *** Recherche dossiers dans "c:\docume~1\alluse~1\menudm~1\progra~1" ***

              *** Recherche dossiers dans "C:\Documents and Settings\FeuxFollets\applic~1" ***

              *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***

              *** Recherche dossiers dans "C:\Documents and Settings\FeuxFollets\locals~1\applic~1" ***

              *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***

              *** Recherche dossiers dans "C:\Documents and Settings\FeuxFollets\menudm~1\progra~1" ***

              *** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***

              *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
              pour + d'infos : http://www.gmer.net

              Aucun Fichier trouvé

              *** Recherche avec GenericNaviSearch ***
              !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
              !!! A vérifier impérativement avant toute suppression manuelle !!!

              * Recherche dans "C:\WINDOWS\system32" *

              * Recherche dans "C:\Documents and Settings\FeuxFollets\locals~1\applic~1" *

              * Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

              *** Recherche fichiers ***

              *** Recherche clés spécifiques dans le Registre ***

              *** Module de Recherche complémentaire ***
              (Recherche fichiers spécifiques)

              1)Recherche nouveaux fichiers Instant Access :

              2)Recherche Heuristique :

              * Dans "C:\WINDOWS\system32" :

              * Dans "C:\Documents and Settings\FeuxFollets\locals~1\applic~1" :

              * Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :

              3)Recherche Certificats :

              Certificat Egroup absent !
              Certificat Electronic-Group absent !
              Certificat OOO-Favorit absent !
              Certificat Sunny-Day-Design-Ltd absent !

              4)Recherche fichiers connus :

              *** Analyse terminée le 30/04/2008 à 8:18:33,06 ***


              MERCI DE TON AIDE

          3. ludsfa
            salut dqm

            on à pas finit.

            on reprends car tu as une infection vundo.

            tu me refais un hijackthis stp.
            1. btengs
              Bonjour à tous

              Idem j'ai des pb avec MSN et j'ai déjà essayé beaucoup de vos conseils... sans succès :s
              Voici mon rapport Hijack :

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 23:24:18, on 27/04/2008
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
              C:\WINDOWS\system32\ZoneLabs\vsmon.exe
              C:\Program Files\Ad-Aware 2007\aawservice.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
              C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
              C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
              C:\WINDOWS\eHome\ehRecvr.exe
              C:\WINDOWS\eHome\ehSched.exe
              C:\WINDOWS\system32\nvsvc32.exe
              C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
              C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
              C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
              C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
              C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
              C:\WINDOWS\system32\dllhost.exe
              C:\Program Files\Apoint\Apoint.exe
              C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
              C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
              C:\Program Files\ZoneAlarm\zlclient.exe
              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
              C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
              C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
              C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
              C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
              C:\Program Files\Sony\ISB Utility\ISBMgr.exe
              C:\Program Files\RealPlayer\RealPlay.exe
              C:\Program Files\Skype\Phone\Skype.exe
              C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
              C:\Program Files\Apoint\Apntex.exe
              C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
              C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
              C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
              C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
              C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
              C:\Program Files\Windows Live\Messenger\usnsvc.exe
              C:\Program Files\Internet Explorer\iexplore.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
              C:\Documents and Settings\FeuxFollets\Bureau\HiJackThis.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-vaio.com/fr/
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.com/fr/
              R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.club-vaio.com/fr/
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
              O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\RealPlayer\rpbrowserrecordplugin.dll
              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
              O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
              O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
              O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
              O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
              O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\ZoneAlarm\zlclient.exe"
              O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
              O4 - HKLM\..\Run: [VAIO Update 3] "C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe" /Stationary
              O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
              O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
              O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
              O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
              O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
              O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
              O4 - Global Startup: Bluetooth Manager.lnk = ?
              O8 - Extra context menu item: Ajouter un site de support RSS à VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
              O8 - Extra context menu item: Transfert par Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
              O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15035/CTPID.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{8CDAEFAE-C0F6-4C02-971D-13B37D297AF6}: NameServer = 192.168.1.1
              O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware 2007\aawservice.exe
              O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
              O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
              O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
              O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
              O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
              O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
              O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
              O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
              O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
              O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
              O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\Avlib\SSScsiSV.exe
              O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
              O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
              O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
              O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
              O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
              O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
              O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
              O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
              O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
              O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
              O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
              O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
              1. DqM Auteur
                rien a changé lusdfa , j'ai tjr le virus et impossible de le trouver...
            3. ludsfa
              ok refais un hijackthis et dit moi comment va le pc.

              je crois que tu n'as pas fait ceci:

              Fix les lignes dans le cadre ci-dessous avec Hijackthis : AIDE EN IMAGES :http://dcangeldark.blogspot.com/2008/02/hijackthis-202-corriger-des-lignes.html

              O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
              O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe


              si c'est le cas fait le ensuite redémarre ton pc et fait un nouveau rapport hijackthis.
              1. DqM Auteur
                voila :

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 23:45:46, on 26/04/2008
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\csrss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\WINDOWS\Explorer.EXE
                C:\WINDOWS\system32\RUNDLL32.EXE
                C:\Program Files\Logitech\Video\LogiTray.exe
                C:\WINDOWS\system32\LVCOMSX.EXE
                C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
                C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                C:\WINDOWS\Mixer.exe
                C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
                C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
                C:\Program Files\SuperCopier2\SuperCopier2.exe
                C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
                C:\PROGRA~1\Wanadoo\ComComp.exe
                C:\Program Files\Logitech\Video\FxSvr2.exe
                C:\PROGRA~1\Wanadoo\Toaster.exe
                C:\PROGRA~1\Wanadoo\Inactivity.exe
                C:\PROGRA~1\Wanadoo\PollingModule.exe
                C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
                C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
                C:\WINDOWS\System32\FTRTSVC.exe
                C:\WINDOWS\system32\nvsvc32.exe
                C:\WINDOWS\system32\HPZipm12.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\wdfmgr.exe
                C:\WINDOWS\system32\wscntfy.exe
                C:\WINDOWS\System32\alg.exe
                C:\PROGRA~1\Wanadoo\Watch.exe
                C:\WINDOWS\system32\wuauclt.exe
                C:\WINDOWS\system32\wbem\wmiprvse.exe
                C:\Program Files\Mozilla Firefox\firefox.exe
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
                O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
                O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
                O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
                O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
                O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
                O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
                O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\DaMien\OctoshapeClient.exe" -inv:bootrun
                O4 - HKCU\..\Run: [TheTurtle] C:\Program Files\TheTurtle\TheTurtle.exe
                O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
                O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://www.pplive.com/zh-cn/other/live/install.cab
                O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
                O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
            4. DqM Auteur
              abon? le revoila alors!:

              ComboFix 08-04-20.2 - DaMien 2008-04-25 11:54:21.2 - NTFSx86 MINIMAL
              Endroit: C:\Documents and Settings\DaMien\Bureau\ComboFix.exe

              [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
              .

              ((((((((((((((((((((((((((((( Fichiers créés 2008-03-25 to 2008-04-25 ))))))))))))))))))))))))))))))))))))
              .

              2008-04-24 21:31 . 2008-04-24 21:31 20,064 --a------ C:\Documents and Settings\DaMien\Application Data\GDIPFONTCACHEV1.DAT
              2008-04-21 23:47 . 2008-04-21 23:47 <REP> d-------- C:\Program Files\MSN Reaper
              2008-04-21 14:07 . 2008-04-21 14:08 <REP> d-------- C:\MSNFix
              2008-04-20 20:21 . 2008-04-22 11:42 <REP> d-------- C:\Program Files\Google
              2008-04-20 14:20 . 2008-04-21 03:11 <REP> d-------- C:\Program Files\Kaspersky Lab
              2008-04-20 14:18 . 2008-04-20 14:18 <REP> d-------- C:\Program Files\ToniArts
              2008-04-20 13:51 . 2008-04-20 13:51 <REP> d-------- C:\WINDOWS\ERUNT
              2008-04-20 13:48 . 2008-04-20 14:19 <REP> d-------- C:\SDFix
              2008-04-20 13:19 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
              2008-04-20 00:33 . 2008-04-20 00:33 <REP> d-------- C:\Program Files\AxBx
              2008-04-18 23:04 . 2008-04-18 23:04 <REP> d-------- C:\Program Files\Trend Micro
              2008-04-13 18:40 . 2008-04-21 12:11 <REP> dr-h----- C:\$VAULT$.AVG
              2008-04-13 16:50 . 2008-04-13 16:50 <REP> d-------- C:\Program Files\Games
              2008-04-13 16:50 . 1996-07-10 09:05 297,472 --a------ C:\WINDOWS\uninst.exe
              2008-04-13 16:49 . 2008-04-13 16:49 <REP> d-------- C:\Documents and Settings\DaMien\WINDOWS
              2008-04-08 16:00 . 2008-04-08 16:00 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
              2008-04-08 16:00 . 2008-04-25 11:40 <REP> d-------- C:\Documents and Settings\DaMien\Application Data\AVG7
              2008-04-08 15:59 . 2008-04-08 15:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
              2008-04-08 15:59 . 2008-04-09 08:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg7
              2008-04-08 15:18 . 2008-04-08 15:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
              2008-04-08 14:49 . 2003-03-02 17:44 7,552 --a------ C:\WINDOWS\system32\drivers\enodpl.sys
              2008-04-08 14:49 . 2003-04-19 00:32 4,736 --a------ C:\WINDOWS\system32\drivers\tandpl.sys
              2008-04-08 13:50 . 2008-04-08 13:50 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys.install_backup
              2008-04-08 13:50 . 2008-04-08 13:50 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll.install_backup
              2008-04-08 13:41 . 2008-04-08 13:41 <REP> d-------- C:\Program Files\AVG
              2008-04-06 19:22 . 2008-04-06 19:22 <REP> d-------- C:\WINDOWS\system32\AlertModule
              2008-04-06 19:22 . 2004-08-23 14:49 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe
              2008-04-06 19:22 . 2005-10-06 14:55 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
              2008-04-06 19:21 . 2008-04-25 11:42 <REP> d-------- C:\Program Files\Wanadoo
              2008-04-06 19:18 . 2008-04-06 19:18 <REP> d-------- C:\Program Files\SAGEM

              .
              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2008-04-25 00:26 --------- d-----w C:\Program Files\eMule
              2008-04-21 23:37 --------- d-----w C:\Program Files\Warcraft III
              2008-04-20 22:45 --------- d-----w C:\Program Files\7-Zip
              2008-04-20 12:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
              2008-04-19 23:39 --------- d-----w C:\Program Files\Warcraft III 1.21
              2008-04-19 22:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
              2008-04-13 16:56 --------- d-----w C:\Documents and Settings\DaMien\Application Data\uTorrent
              2008-04-08 16:53 --------- d-----w C:\Program Files\Windows Live
              2008-04-05 15:04 --------- d-----w C:\Program Files\Everest Poker
              2008-03-31 20:15 --------- d-----w C:\Program Files\Messenger Plus! Live
              2008-03-29 11:46 --------- d-----w C:\Documents and Settings\DaMien\Application Data\BSplayer PRO
              2008-03-21 10:54 --------- d-----w C:\Documents and Settings\DaMien\Application Data\U3
              2008-03-17 18:04 --------- d-----w C:\Documents and Settings\DaMien\Application Data\Sports Interactive
              2008-03-17 17:58 --------- d-----w C:\Program Files\D-Tools
              2008-03-17 17:51 --------- d--h--w C:\Program Files\Zero G Registry
              2008-03-17 17:47 --------- d-----w C:\Program Files\Sports Interactive
              2008-02-27 12:59 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
              2008-02-27 12:58 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
              2008-02-12 14:53 691,545 ----a-w C:\WINDOWS\unins000.exe
              2001-11-23 06:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
              .

              ((((((((((((((((((((((((((((( snapshot@2008-04-21_ 0.52.11,87 )))))))))))))))))))))))))))))))))))))))))
              .
              - 2008-04-20 22:45:23 2,048 --s-a-w C:\WINDOWS\bootstat.dat
              + 2008-04-25 09:53:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat
              .
              ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              REGEDIT4
              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
              "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]
              "Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\DaMien\OctoshapeClient.exe" [ ]
              "TheTurtle"="C:\Program Files\TheTurtle\TheTurtle.exe" [ ]
              "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 18:45 1052672]
              "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
              "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
              "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
              "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
              "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
              "NWEReboot"="" []
              "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
              "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
              "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-01-14 01:07 185896]
              "C-Media Mixer"="Mixer.exe" [2003-03-20 10:21 1855488 C:\WINDOWS\mixer.exe]
              "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
              "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
              "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 12:45 579584]

              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
              "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]
              "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-08 16:00 219136]

              C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
              Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
              "msacm.scg726"= scg726.acm
              "msacm.alf2cd"= alf2cd.acm
              "vidc.dvsd"= mcdvd_32.dll
              "msacm.ivimp3en"= ivimp3en.acm
              "VIDC.YV12"= yv12vfw.dll
              "msacm.ac3acm"= ac3acm.acm
              "msacm.lameacm"= lameACM.acm

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
              "EnableFirewall"= 0 (0x0)

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "%windir%\\system32\\sessmgr.exe"=
              "C:\\Program Files\\uTorrent\\utorrent.exe"=
              "C:\\Program Files\\eMule\\emule.exe"=
              "C:\\Program Files\\Hamachi\\hamachi.exe"=
              "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
              "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
              "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
              "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
              "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
              "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
              "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
              "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
              "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
              "C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
              "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

              R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
              R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
              S3 AdWatchDrv;AW Realtime Driver;C:\WINDOWS\system32\drivers\AWRTPD.sys [2007-06-04 16:14]
              S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-10-19 17:21]
              S3 cm102u32;C-Media CM6501 Like Sound Interface;C:\WINDOWS\system32\drivers\c6501.sys []

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
              \Shell\AutoRun\command - F:\install.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04c8d8af-ea5a-11dc-8aa4-00138fd549fc}]
              \Shell\AutoRun\command - H:\
              \Shell\explore\Command - RECYCLED\INFO.exe
              \Shell\open\Command - RECYCLED\INFO.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{07ab1e9e-d25d-11dc-8a8a-00138fd549fc}]
              \Shell\AutoRun\command - H:\u.bat
              \Shell\explore\Command - H:\u.bat
              \Shell\open\Command - H:\u.bat

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d6ac0c8-c506-11dc-8a7f-00138fd549fc}]
              \Shell\AutoRun\command - H:\juok3st.bat
              \Shell\explore\Command - H:\juok3st.bat
              \Shell\open\Command - H:\juok3st.bat

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6197fb43-0dee-11dc-8a56-806d6172696f}]
              \Shell\AutoRun\command - D:\Bin\assetup.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6886ba6e-6de2-11dc-89eb-00138fd549fc}]
              \Shell\AutoRun\command - H:\LaunchU3.exe

              .
              **************************************************************************

              catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2008-04-25 11:57:00
              Windows 5.1.2600 Service Pack 2 NTFS

              Balayage processus cachés ...

              Balayage caché autostart entries ...

              Balayage des fichiers cachés ...

              Scan terminé avec succès
              Les fichiers cachés: 0

              **************************************************************************
              .
              Temps d'accomplissement: 2008-04-25 11:58:54
              ComboFix-quarantined-files.txt 2008-04-25 09:58:15
              ComboFix2.txt 2008-04-20 22:52:32

              Pre-Run: 27,746,488,320 octets libres
              Post-Run: 27,734,511,616 octets libres

              162 --- E O F --- 2008-01-11 11:30:12
              1. ludsfa
                re dqm,

                je ne vois pas ta réponse ???

                je ne vois que le post 20 et 21 et sa s'arrête là.

                a+
                1. DqM Auteur
                  salu voila le rapport:

                  ComboFix 08-04-20.2 - DaMien 2008-04-25 11:54:21.2 - NTFSx86 MINIMAL
                  Endroit: C:\Documents and Settings\DaMien\Bureau\ComboFix.exe

                  [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                  .

                  ((((((((((((((((((((((((((((( Fichiers créés 2008-03-25 to 2008-04-25 ))))))))))))))))))))))))))))))))))))
                  .

                  2008-04-24 21:31 . 2008-04-24 21:31 20,064 --a------ C:\Documents and Settings\DaMien\Application Data\GDIPFONTCACHEV1.DAT
                  2008-04-21 23:47 . 2008-04-21 23:47 <REP> d-------- C:\Program Files\MSN Reaper
                  2008-04-21 14:07 . 2008-04-21 14:08 <REP> d-------- C:\MSNFix
                  2008-04-20 20:21 . 2008-04-22 11:42 <REP> d-------- C:\Program Files\Google
                  2008-04-20 14:20 . 2008-04-21 03:11 <REP> d-------- C:\Program Files\Kaspersky Lab
                  2008-04-20 14:18 . 2008-04-20 14:18 <REP> d-------- C:\Program Files\ToniArts
                  2008-04-20 13:51 . 2008-04-20 13:51 <REP> d-------- C:\WINDOWS\ERUNT
                  2008-04-20 13:48 . 2008-04-20 14:19 <REP> d-------- C:\SDFix
                  2008-04-20 13:19 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
                  2008-04-20 00:33 . 2008-04-20 00:33 <REP> d-------- C:\Program Files\AxBx
                  2008-04-18 23:04 . 2008-04-18 23:04 <REP> d-------- C:\Program Files\Trend Micro
                  2008-04-13 18:40 . 2008-04-21 12:11 <REP> dr-h----- C:\$VAULT$.AVG
                  2008-04-13 16:50 . 2008-04-13 16:50 <REP> d-------- C:\Program Files\Games
                  2008-04-13 16:50 . 1996-07-10 09:05 297,472 --a------ C:\WINDOWS\uninst.exe
                  2008-04-13 16:49 . 2008-04-13 16:49 <REP> d-------- C:\Documents and Settings\DaMien\WINDOWS
                  2008-04-08 16:00 . 2008-04-08 16:00 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
                  2008-04-08 16:00 . 2008-04-25 11:40 <REP> d-------- C:\Documents and Settings\DaMien\Application Data\AVG7
                  2008-04-08 15:59 . 2008-04-08 15:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                  2008-04-08 15:59 . 2008-04-09 08:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg7
                  2008-04-08 15:18 . 2008-04-08 15:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
                  2008-04-08 14:49 . 2003-03-02 17:44 7,552 --a------ C:\WINDOWS\system32\drivers\enodpl.sys
                  2008-04-08 14:49 . 2003-04-19 00:32 4,736 --a------ C:\WINDOWS\system32\drivers\tandpl.sys
                  2008-04-08 13:50 . 2008-04-08 13:50 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys.install_backup
                  2008-04-08 13:50 . 2008-04-08 13:50 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll.install_backup
                  2008-04-08 13:41 . 2008-04-08 13:41 <REP> d-------- C:\Program Files\AVG
                  2008-04-06 19:22 . 2008-04-06 19:22 <REP> d-------- C:\WINDOWS\system32\AlertModule
                  2008-04-06 19:22 . 2004-08-23 14:49 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe
                  2008-04-06 19:22 . 2005-10-06 14:55 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
                  2008-04-06 19:21 . 2008-04-25 11:42 <REP> d-------- C:\Program Files\Wanadoo
                  2008-04-06 19:18 . 2008-04-06 19:18 <REP> d-------- C:\Program Files\SAGEM

                  .
                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2008-04-25 00:26 --------- d-----w C:\Program Files\eMule
                  2008-04-21 23:37 --------- d-----w C:\Program Files\Warcraft III
                  2008-04-20 22:45 --------- d-----w C:\Program Files\7-Zip
                  2008-04-20 12:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
                  2008-04-19 23:39 --------- d-----w C:\Program Files\Warcraft III 1.21
                  2008-04-19 22:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
                  2008-04-13 16:56 --------- d-----w C:\Documents and Settings\DaMien\Application Data\uTorrent
                  2008-04-08 16:53 --------- d-----w C:\Program Files\Windows Live
                  2008-04-05 15:04 --------- d-----w C:\Program Files\Everest Poker
                  2008-03-31 20:15 --------- d-----w C:\Program Files\Messenger Plus! Live
                  2008-03-29 11:46 --------- d-----w C:\Documents and Settings\DaMien\Application Data\BSplayer PRO
                  2008-03-21 10:54 --------- d-----w C:\Documents and Settings\DaMien\Application Data\U3
                  2008-03-17 18:04 --------- d-----w C:\Documents and Settings\DaMien\Application Data\Sports Interactive
                  2008-03-17 17:58 --------- d-----w C:\Program Files\D-Tools
                  2008-03-17 17:51 --------- d--h--w C:\Program Files\Zero G Registry
                  2008-03-17 17:47 --------- d-----w C:\Program Files\Sports Interactive
                  2008-02-27 12:59 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
                  2008-02-27 12:58 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
                  2008-02-12 14:53 691,545 ----a-w C:\WINDOWS\unins000.exe
                  2001-11-23 06:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
                  .

                  ((((((((((((((((((((((((((((( snapshot@2008-04-21_ 0.52.11,87 )))))))))))))))))))))))))))))))))))))))))
                  .
                  - 2008-04-20 22:45:23 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                  + 2008-04-25 09:53:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                  .
                  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  REGEDIT4
                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
                  "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]
                  "Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\DaMien\OctoshapeClient.exe" [ ]
                  "TheTurtle"="C:\Program Files\TheTurtle\TheTurtle.exe" [ ]
                  "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 18:45 1052672]
                  "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
                  "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
                  "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
                  "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
                  "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
                  "NWEReboot"="" []
                  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
                  "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
                  "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-01-14 01:07 185896]
                  "C-Media Mixer"="Mixer.exe" [2003-03-20 10:21 1855488 C:\WINDOWS\mixer.exe]
                  "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
                  "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
                  "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 12:45 579584]

                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]
                  "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-08 16:00 219136]

                  C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                  Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                  "msacm.scg726"= scg726.acm
                  "msacm.alf2cd"= alf2cd.acm
                  "vidc.dvsd"= mcdvd_32.dll
                  "msacm.ivimp3en"= ivimp3en.acm
                  "VIDC.YV12"= yv12vfw.dll
                  "msacm.ac3acm"= ac3acm.acm
                  "msacm.lameacm"= lameACM.acm

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                  "EnableFirewall"= 0 (0x0)

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                  "%windir%\\system32\\sessmgr.exe"=
                  "C:\\Program Files\\uTorrent\\utorrent.exe"=
                  "C:\\Program Files\\eMule\\emule.exe"=
                  "C:\\Program Files\\Hamachi\\hamachi.exe"=
                  "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                  "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                  "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
                  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
                  "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
                  "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
                  "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
                  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                  "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                  "C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
                  "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

                  R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
                  R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
                  S3 AdWatchDrv;AW Realtime Driver;C:\WINDOWS\system32\drivers\AWRTPD.sys [2007-06-04 16:14]
                  S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-10-19 17:21]
                  S3 cm102u32;C-Media CM6501 Like Sound Interface;C:\WINDOWS\system32\drivers\c6501.sys []

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
                  \Shell\AutoRun\command - F:\install.exe

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04c8d8af-ea5a-11dc-8aa4-00138fd549fc}]
                  \Shell\AutoRun\command - H:\
                  \Shell\explore\Command - RECYCLED\INFO.exe
                  \Shell\open\Command - RECYCLED\INFO.exe

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{07ab1e9e-d25d-11dc-8a8a-00138fd549fc}]
                  \Shell\AutoRun\command - H:\u.bat
                  \Shell\explore\Command - H:\u.bat
                  \Shell\open\Command - H:\u.bat

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d6ac0c8-c506-11dc-8a7f-00138fd549fc}]
                  \Shell\AutoRun\command - H:\juok3st.bat
                  \Shell\explore\Command - H:\juok3st.bat
                  \Shell\open\Command - H:\juok3st.bat

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6197fb43-0dee-11dc-8a56-806d6172696f}]
                  \Shell\AutoRun\command - D:\Bin\assetup.exe

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6886ba6e-6de2-11dc-89eb-00138fd549fc}]
                  \Shell\AutoRun\command - H:\LaunchU3.exe

                  .
                  **************************************************************************

                  catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2008-04-25 11:57:00
                  Windows 5.1.2600 Service Pack 2 NTFS

                  Balayage processus cachés ...

                  Balayage caché autostart entries ...

                  Balayage des fichiers cachés ...

                  Scan terminé avec succès
                  Les fichiers cachés: 0

                  **************************************************************************
                  .
                  Temps d'accomplissement: 2008-04-25 11:58:54
                  ComboFix-quarantined-files.txt 2008-04-25 09:58:15
                  ComboFix2.txt 2008-04-20 22:52:32

                  Pre-Run: 27,746,488,320 octets libres
                  Post-Run: 27,734,511,616 octets libres

                  162 --- E O F --- 2008-01-11 11:30:12
                  1. DqM Auteur
                    Une fois de plus :

                    ComboFix 08-04-20.2 - DaMien 2008-04-25 11:54:21.2 - NTFSx86 MINIMAL
                    Endroit: C:\Documents and Settings\DaMien\Bureau\ComboFix.exe

                    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                    .

                    ((((((((((((((((((((((((((((( Fichiers créés 2008-03-25 to 2008-04-25 ))))))))))))))))))))))))))))))))))))
                    .

                    2008-04-24 21:31 . 2008-04-24 21:31 20,064 --a------ C:\Documents and Settings\DaMien\Application Data\GDIPFONTCACHEV1.DAT
                    2008-04-21 23:47 . 2008-04-21 23:47 <REP> d-------- C:\Program Files\MSN Reaper
                    2008-04-21 14:07 . 2008-04-21 14:08 <REP> d-------- C:\MSNFix
                    2008-04-20 20:21 . 2008-04-22 11:42 <REP> d-------- C:\Program Files\Google
                    2008-04-20 14:20 . 2008-04-21 03:11 <REP> d-------- C:\Program Files\Kaspersky Lab
                    2008-04-20 14:18 . 2008-04-20 14:18 <REP> d-------- C:\Program Files\ToniArts
                    2008-04-20 13:51 . 2008-04-20 13:51 <REP> d-------- C:\WINDOWS\ERUNT
                    2008-04-20 13:48 . 2008-04-20 14:19 <REP> d-------- C:\SDFix
                    2008-04-20 13:19 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
                    2008-04-20 00:33 . 2008-04-20 00:33 <REP> d-------- C:\Program Files\AxBx
                    2008-04-18 23:04 . 2008-04-18 23:04 <REP> d-------- C:\Program Files\Trend Micro
                    2008-04-13 18:40 . 2008-04-21 12:11 <REP> dr-h----- C:\$VAULT$.AVG
                    2008-04-13 16:50 . 2008-04-13 16:50 <REP> d-------- C:\Program Files\Games
                    2008-04-13 16:50 . 1996-07-10 09:05 297,472 --a------ C:\WINDOWS\uninst.exe
                    2008-04-13 16:49 . 2008-04-13 16:49 <REP> d-------- C:\Documents and Settings\DaMien\WINDOWS
                    2008-04-08 16:00 . 2008-04-08 16:00 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
                    2008-04-08 16:00 . 2008-04-25 11:40 <REP> d-------- C:\Documents and Settings\DaMien\Application Data\AVG7
                    2008-04-08 15:59 . 2008-04-08 15:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                    2008-04-08 15:59 . 2008-04-09 08:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg7
                    2008-04-08 15:18 . 2008-04-08 15:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
                    2008-04-08 14:49 . 2003-03-02 17:44 7,552 --a------ C:\WINDOWS\system32\drivers\enodpl.sys
                    2008-04-08 14:49 . 2003-04-19 00:32 4,736 --a------ C:\WINDOWS\system32\drivers\tandpl.sys
                    2008-04-08 13:50 . 2008-04-08 13:50 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys.install_backup
                    2008-04-08 13:50 . 2008-04-08 13:50 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll.install_backup
                    2008-04-08 13:41 . 2008-04-08 13:41 <REP> d-------- C:\Program Files\AVG
                    2008-04-06 19:22 . 2008-04-06 19:22 <REP> d-------- C:\WINDOWS\system32\AlertModule
                    2008-04-06 19:22 . 2004-08-23 14:49 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe
                    2008-04-06 19:22 . 2005-10-06 14:55 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
                    2008-04-06 19:21 . 2008-04-25 11:42 <REP> d-------- C:\Program Files\Wanadoo
                    2008-04-06 19:18 . 2008-04-06 19:18 <REP> d-------- C:\Program Files\SAGEM

                    .
                    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    2008-04-25 00:26 --------- d-----w C:\Program Files\eMule
                    2008-04-21 23:37 --------- d-----w C:\Program Files\Warcraft III
                    2008-04-20 22:45 --------- d-----w C:\Program Files\7-Zip
                    2008-04-20 12:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
                    2008-04-19 23:39 --------- d-----w C:\Program Files\Warcraft III 1.21
                    2008-04-19 22:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
                    2008-04-13 16:56 --------- d-----w C:\Documents and Settings\DaMien\Application Data\uTorrent
                    2008-04-08 16:53 --------- d-----w C:\Program Files\Windows Live
                    2008-04-05 15:04 --------- d-----w C:\Program Files\Everest Poker
                    2008-03-31 20:15 --------- d-----w C:\Program Files\Messenger Plus! Live
                    2008-03-29 11:46 --------- d-----w C:\Documents and Settings\DaMien\Application Data\BSplayer PRO
                    2008-03-21 10:54 --------- d-----w C:\Documents and Settings\DaMien\Application Data\U3
                    2008-03-17 18:04 --------- d-----w C:\Documents and Settings\DaMien\Application Data\Sports Interactive
                    2008-03-17 17:58 --------- d-----w C:\Program Files\D-Tools
                    2008-03-17 17:51 --------- d--h--w C:\Program Files\Zero G Registry
                    2008-03-17 17:47 --------- d-----w C:\Program Files\Sports Interactive
                    2008-02-27 12:59 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
                    2008-02-27 12:58 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
                    2008-02-12 14:53 691,545 ----a-w C:\WINDOWS\unins000.exe
                    2001-11-23 06:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
                    .

                    ((((((((((((((((((((((((((((( snapshot@2008-04-21_ 0.52.11,87 )))))))))))))))))))))))))))))))))))))))))
                    .
                    - 2008-04-20 22:45:23 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                    + 2008-04-25 09:53:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                    .
                    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    .
                    REGEDIT4
                    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
                    "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]
                    "Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\DaMien\OctoshapeClient.exe" [ ]
                    "TheTurtle"="C:\Program Files\TheTurtle\TheTurtle.exe" [ ]
                    "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 18:45 1052672]
                    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
                    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
                    "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
                    "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
                    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
                    "NWEReboot"="" []
                    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
                    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
                    "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-01-14 01:07 185896]
                    "C-Media Mixer"="Mixer.exe" [2003-03-20 10:21 1855488 C:\WINDOWS\mixer.exe]
                    "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
                    "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
                    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 12:45 579584]

                    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]
                    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-08 16:00 219136]

                    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

                    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                    "msacm.scg726"= scg726.acm
                    "msacm.alf2cd"= alf2cd.acm
                    "vidc.dvsd"= mcdvd_32.dll
                    "msacm.ivimp3en"= ivimp3en.acm
                    "VIDC.YV12"= yv12vfw.dll
                    "msacm.ac3acm"= ac3acm.acm
                    "msacm.lameacm"= lameACM.acm

                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                    "EnableFirewall"= 0 (0x0)

                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                    "%windir%\\system32\\sessmgr.exe"=
                    "C:\\Program Files\\uTorrent\\utorrent.exe"=
                    "C:\\Program Files\\eMule\\emule.exe"=
                    "C:\\Program Files\\Hamachi\\hamachi.exe"=
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
                    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
                    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
                    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
                    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
                    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                    "C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
                    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

                    R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
                    R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
                    S3 AdWatchDrv;AW Realtime Driver;C:\WINDOWS\system32\drivers\AWRTPD.sys [2007-06-04 16:14]
                    S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-10-19 17:21]
                    S3 cm102u32;C-Media CM6501 Like Sound Interface;C:\WINDOWS\system32\drivers\c6501.sys []

                    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
                    \Shell\AutoRun\command - F:\install.exe

                    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04c8d8af-ea5a-11dc-8aa4-00138fd549fc}]
                    \Shell\AutoRun\command - H:\
                    \Shell\explore\Command - RECYCLED\INFO.exe
                    \Shell\open\Command - RECYCLED\INFO.exe

                    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{07ab1e9e-d25d-11dc-8a8a-00138fd549fc}]
                    \Shell\AutoRun\command - H:\u.bat
                    \Shell\explore\Command - H:\u.bat
                    \Shell\open\Command - H:\u.bat

                    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d6ac0c8-c506-11dc-8a7f-00138fd549fc}]
                    \Shell\AutoRun\command - H:\juok3st.bat
                    \Shell\explore\Command - H:\juok3st.bat
                    \Shell\open\Command - H:\juok3st.bat

                    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6197fb43-0dee-11dc-8a56-806d6172696f}]
                    \Shell\AutoRun\command - D:\Bin\assetup.exe

                    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6886ba6e-6de2-11dc-89eb-00138fd549fc}]
                    \Shell\AutoRun\command - H:\LaunchU3.exe

                    .
                    **************************************************************************

                    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2008-04-25 11:57:00
                    Windows 5.1.2600 Service Pack 2 NTFS

                    Balayage processus cachés ...

                    Balayage caché autostart entries ...

                    Balayage des fichiers cachés ...

                    Scan terminé avec succès
                    Les fichiers cachés: 0

                    **************************************************************************
                    .
                    Temps d'accomplissement: 2008-04-25 11:58:54
                    ComboFix-quarantined-files.txt 2008-04-25 09:58:15
                    ComboFix2.txt 2008-04-20 22:52:32

                    Pre-Run: 27,746,488,320 octets libres
                    Post-Run: 27,734,511,616 octets libres

                    162 --- E O F --- 2008-01-11 11:30:12
                    1. DqM Auteur
                      salut , voila un nouveau rapport :

                      ComboFix 08-04-20.2 - DaMien 2008-04-25 11:54:21.2 - NTFSx86 MINIMAL
                      Endroit: C:\Documents and Settings\DaMien\Bureau\ComboFix.exe

                      [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                      .

                      ((((((((((((((((((((((((((((( Fichiers créés 2008-03-25 to 2008-04-25 ))))))))))))))))))))))))))))))))))))
                      .

                      2008-04-24 21:31 . 2008-04-24 21:31 20,064 --a------ C:\Documents and Settings\DaMien\Application Data\GDIPFONTCACHEV1.DAT
                      2008-04-21 23:47 . 2008-04-21 23:47 <REP> d-------- C:\Program Files\MSN Reaper
                      2008-04-21 14:07 . 2008-04-21 14:08 <REP> d-------- C:\MSNFix
                      2008-04-20 20:21 . 2008-04-22 11:42 <REP> d-------- C:\Program Files\Google
                      2008-04-20 14:20 . 2008-04-21 03:11 <REP> d-------- C:\Program Files\Kaspersky Lab
                      2008-04-20 14:18 . 2008-04-20 14:18 <REP> d-------- C:\Program Files\ToniArts
                      2008-04-20 13:51 . 2008-04-20 13:51 <REP> d-------- C:\WINDOWS\ERUNT
                      2008-04-20 13:48 . 2008-04-20 14:19 <REP> d-------- C:\SDFix
                      2008-04-20 13:19 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
                      2008-04-20 00:33 . 2008-04-20 00:33 <REP> d-------- C:\Program Files\AxBx
                      2008-04-18 23:04 . 2008-04-18 23:04 <REP> d-------- C:\Program Files\Trend Micro
                      2008-04-13 18:40 . 2008-04-21 12:11 <REP> dr-h----- C:\$VAULT$.AVG
                      2008-04-13 16:50 . 2008-04-13 16:50 <REP> d-------- C:\Program Files\Games
                      2008-04-13 16:50 . 1996-07-10 09:05 297,472 --a------ C:\WINDOWS\uninst.exe
                      2008-04-13 16:49 . 2008-04-13 16:49 <REP> d-------- C:\Documents and Settings\DaMien\WINDOWS
                      2008-04-08 16:00 . 2008-04-08 16:00 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
                      2008-04-08 16:00 . 2008-04-25 11:40 <REP> d-------- C:\Documents and Settings\DaMien\Application Data\AVG7
                      2008-04-08 15:59 . 2008-04-08 15:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                      2008-04-08 15:59 . 2008-04-09 08:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg7
                      2008-04-08 15:18 . 2008-04-08 15:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
                      2008-04-08 14:49 . 2003-03-02 17:44 7,552 --a------ C:\WINDOWS\system32\drivers\enodpl.sys
                      2008-04-08 14:49 . 2003-04-19 00:32 4,736 --a------ C:\WINDOWS\system32\drivers\tandpl.sys
                      2008-04-08 13:50 . 2008-04-08 13:50 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys.install_backup
                      2008-04-08 13:50 . 2008-04-08 13:50 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll.install_backup
                      2008-04-08 13:41 . 2008-04-08 13:41 <REP> d-------- C:\Program Files\AVG
                      2008-04-06 19:22 . 2008-04-06 19:22 <REP> d-------- C:\WINDOWS\system32\AlertModule
                      2008-04-06 19:22 . 2004-08-23 14:49 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe
                      2008-04-06 19:22 . 2005-10-06 14:55 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
                      2008-04-06 19:21 . 2008-04-25 11:42 <REP> d-------- C:\Program Files\Wanadoo
                      2008-04-06 19:18 . 2008-04-06 19:18 <REP> d-------- C:\Program Files\SAGEM

                      .
                      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-04-25 00:26 --------- d-----w C:\Program Files\eMule
                      2008-04-21 23:37 --------- d-----w C:\Program Files\Warcraft III
                      2008-04-20 22:45 --------- d-----w C:\Program Files\7-Zip
                      2008-04-20 12:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
                      2008-04-19 23:39 --------- d-----w C:\Program Files\Warcraft III 1.21
                      2008-04-19 22:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
                      2008-04-13 16:56 --------- d-----w C:\Documents and Settings\DaMien\Application Data\uTorrent
                      2008-04-08 16:53 --------- d-----w C:\Program Files\Windows Live
                      2008-04-05 15:04 --------- d-----w C:\Program Files\Everest Poker
                      2008-03-31 20:15 --------- d-----w C:\Program Files\Messenger Plus! Live
                      2008-03-29 11:46 --------- d-----w C:\Documents and Settings\DaMien\Application Data\BSplayer PRO
                      2008-03-21 10:54 --------- d-----w C:\Documents and Settings\DaMien\Application Data\U3
                      2008-03-17 18:04 --------- d-----w C:\Documents and Settings\DaMien\Application Data\Sports Interactive
                      2008-03-17 17:58 --------- d-----w C:\Program Files\D-Tools
                      2008-03-17 17:51 --------- d--h--w C:\Program Files\Zero G Registry
                      2008-03-17 17:47 --------- d-----w C:\Program Files\Sports Interactive
                      2008-02-27 12:59 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
                      2008-02-27 12:58 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
                      2008-02-12 14:53 691,545 ----a-w C:\WINDOWS\unins000.exe
                      2001-11-23 06:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
                      .

                      ((((((((((((((((((((((((((((( snapshot@2008-04-21_ 0.52.11,87 )))))))))))))))))))))))))))))))))))))))))
                      .
                      - 2008-04-20 22:45:23 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                      + 2008-04-25 09:53:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                      .
                      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      .
                      REGEDIT4
                      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
                      "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]
                      "Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\DaMien\OctoshapeClient.exe" [ ]
                      "TheTurtle"="C:\Program Files\TheTurtle\TheTurtle.exe" [ ]
                      "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 18:45 1052672]
                      "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
                      "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
                      "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
                      "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
                      "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
                      "NWEReboot"="" []
                      "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
                      "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
                      "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-01-14 01:07 185896]
                      "C-Media Mixer"="Mixer.exe" [2003-03-20 10:21 1855488 C:\WINDOWS\mixer.exe]
                      "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
                      "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
                      "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 12:45 579584]

                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]
                      "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-08 16:00 219136]

                      C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                      Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

                      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                      "msacm.scg726"= scg726.acm
                      "msacm.alf2cd"= alf2cd.acm
                      "vidc.dvsd"= mcdvd_32.dll
                      "msacm.ivimp3en"= ivimp3en.acm
                      "VIDC.YV12"= yv12vfw.dll
                      "msacm.ac3acm"= ac3acm.acm
                      "msacm.lameacm"= lameACM.acm

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                      "EnableFirewall"= 0 (0x0)

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                      "%windir%\\system32\\sessmgr.exe"=
                      "C:\\Program Files\\uTorrent\\utorrent.exe"=
                      "C:\\Program Files\\eMule\\emule.exe"=
                      "C:\\Program Files\\Hamachi\\hamachi.exe"=
                      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
                      "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
                      "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
                      "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
                      "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
                      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                      "C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
                      "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

                      R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
                      R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
                      S3 AdWatchDrv;AW Realtime Driver;C:\WINDOWS\system32\drivers\AWRTPD.sys [2007-06-04 16:14]
                      S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-10-19 17:21]
                      S3 cm102u32;C-Media CM6501 Like Sound Interface;C:\WINDOWS\system32\drivers\c6501.sys []

                      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
                      \Shell\AutoRun\command - F:\install.exe

                      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04c8d8af-ea5a-11dc-8aa4-00138fd549fc}]
                      \Shell\AutoRun\command - H:\
                      \Shell\explore\Command - RECYCLED\INFO.exe
                      \Shell\open\Command - RECYCLED\INFO.exe

                      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{07ab1e9e-d25d-11dc-8a8a-00138fd549fc}]
                      \Shell\AutoRun\command - H:\u.bat
                      \Shell\explore\Command - H:\u.bat
                      \Shell\open\Command - H:\u.bat

                      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d6ac0c8-c506-11dc-8a7f-00138fd549fc}]
                      \Shell\AutoRun\command - H:\juok3st.bat
                      \Shell\explore\Command - H:\juok3st.bat
                      \Shell\open\Command - H:\juok3st.bat

                      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6197fb43-0dee-11dc-8a56-806d6172696f}]
                      \Shell\AutoRun\command - D:\Bin\assetup.exe

                      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6886ba6e-6de2-11dc-89eb-00138fd549fc}]
                      \Shell\AutoRun\command - H:\LaunchU3.exe

                      .
                      **************************************************************************

                      catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-04-25 11:57:00
                      Windows 5.1.2600 Service Pack 2 NTFS

                      Balayage processus cachés ...

                      Balayage caché autostart entries ...

                      Balayage des fichiers cachés ...

                      Scan terminé avec succès
                      Les fichiers cachés: 0

                      **************************************************************************
                      .
                      Temps d'accomplissement: 2008-04-25 11:58:54
                      ComboFix-quarantined-files.txt 2008-04-25 09:58:15
                      ComboFix2.txt 2008-04-20 22:52:32

                      Pre-Run: 27,746,488,320 octets libres
                      Post-Run: 27,734,511,616 octets libres

                      162 --- E O F --- 2008-01-11 11:30:12
                      1. ludsfa
                        salut dqm,

                        fait ce qui suit.

                        repasse une fois combofix et envois moi le rapport stp.
                        1. DqM Auteur
                          il n'a rien trouvé..

                          MSNFix 1.708

                          C:\MSNFix
                          Fix exécuté le 21/04/2008 - 14:07:31,65 By DaMien
                          mode normal

                          ************************ Recherche les fichiers présents

                          Aucun Fichier trouvé

                          ************************ Recherche les dossiers présents

                          Aucun dossier trouvé

                          ************************ Fichiers suspects

                          Aucun Fichier trouvé

                          ************************ HKLM\...\Winlogon\Userinit

                          Userinit = C:\WINDOWS\system32\userinit.exe,

                          ------------------------------------------------------------------------
                          Auteur : !aur3n7 Contact: https://www.ionos.fr/
                          ------------------------------------------------------------------------

                          --------------------------------------------- END ---------------------------------------------
                          1. ludsfa
                            bonjour,

                            recommence l'opération suivante: attention pas avec un autre msnfix

                            1) Télécharge MSNFix.zip (de !aur3n7) sur ton bureau : http://sosvirus.changelog.fr/MSNFix.zip

                            Décompresse-le (clic droit >> Extraire ici) et place les fichiers dans C:\MSNFix (très important).
                            Double-cliquer sur le fichier MSNFix.bat.
                            - Exécutez l'option R.
                            -- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage.

                            -Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal

                            - Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt

                            copie/colle le rapport.
                            1. DqM Auteur
                              voila tout ca , combofix a trouvé un virus qui était sur mon DD externe , il m'empéchait de l'ouvrir en double cliquant ( obligeant a right ouvrir ou explorer ) :

                              ComboFix 08-04-20.2 - DaMien 2008-04-21 0:48:08.1 - NTFSx86 MINIMAL
                              Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1751 [GMT 2:00]
                              Endroit: C:\Documents and Settings\DaMien\Bureau\ComboFix.exe

                              [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                              .

                              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                              .

                              I:\Autorun.inf

                              .
                              ((((((((((((((((((((((((((((( Fichiers créés 2008-03-20 to 2008-04-20 ))))))))))))))))))))))))))))))))))))
                              .

                              2008-04-20 20:21 . 2008-04-20 20:22 <REP> d-------- C:\Program Files\Google
                              2008-04-20 20:21 . 2008-04-20 20:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
                              2008-04-20 14:20 . 2008-04-20 14:20 <REP> d-------- C:\Program Files\Kaspersky Lab
                              2008-04-20 14:18 . 2008-04-20 14:18 <REP> d-------- C:\Program Files\ToniArts
                              2008-04-20 13:51 . 2008-04-20 13:51 <REP> d-------- C:\WINDOWS\ERUNT
                              2008-04-20 13:48 . 2008-04-20 14:19 <REP> d-------- C:\SDFix
                              2008-04-20 13:19 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
                              2008-04-20 00:33 . 2008-04-20 00:33 <REP> d-------- C:\Program Files\AxBx
                              2008-04-18 23:04 . 2008-04-18 23:04 <REP> d-------- C:\Program Files\Trend Micro
                              2008-04-13 18:40 . 2008-04-18 00:35 <REP> dr-h----- C:\$VAULT$.AVG
                              2008-04-13 16:50 . 2008-04-13 16:50 <REP> d-------- C:\Program Files\Games
                              2008-04-13 16:50 . 1996-07-10 09:05 297,472 --a------ C:\WINDOWS\uninst.exe
                              2008-04-13 16:49 . 2008-04-13 16:49 <REP> d-------- C:\Documents and Settings\DaMien\WINDOWS
                              2008-04-08 16:00 . 2008-04-08 16:00 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
                              2008-04-08 16:00 . 2008-04-20 14:30 <REP> d-------- C:\Documents and Settings\DaMien\Application Data\AVG7
                              2008-04-08 15:59 . 2008-04-08 15:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                              2008-04-08 15:59 . 2008-04-09 08:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg7
                              2008-04-08 15:18 . 2008-04-08 15:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
                              2008-04-08 14:49 . 2003-03-02 17:44 7,552 --a------ C:\WINDOWS\system32\drivers\enodpl.sys
                              2008-04-08 14:49 . 2003-04-19 00:32 4,736 --a------ C:\WINDOWS\system32\drivers\tandpl.sys
                              2008-04-08 13:50 . 2008-04-08 13:50 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys.install_backup
                              2008-04-08 13:50 . 2008-04-08 13:50 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll.install_backup
                              2008-04-08 13:41 . 2008-04-08 13:41 <REP> d-------- C:\Program Files\AVG
                              2008-04-06 19:22 . 2008-04-06 19:22 <REP> d-------- C:\WINDOWS\system32\AlertModule
                              2008-04-06 19:22 . 2004-08-23 14:49 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe
                              2008-04-06 19:22 . 2005-10-06 14:55 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
                              2008-04-06 19:21 . 2008-04-20 14:24 <REP> d-------- C:\Program Files\Wanadoo
                              2008-04-06 19:18 . 2008-04-06 19:18 <REP> d-------- C:\Program Files\SAGEM

                              .
                              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              2008-04-20 22:45 --------- d-----w C:\Program Files\7-Zip
                              2008-04-20 17:36 --------- d-----w C:\Program Files\Warcraft III
                              2008-04-20 12:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
                              2008-04-20 11:24 --------- d-----w C:\Program Files\eMule
                              2008-04-19 23:39 --------- d-----w C:\Program Files\Warcraft III 1.21
                              2008-04-19 22:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
                              2008-04-13 16:56 --------- d-----w C:\Documents and Settings\DaMien\Application Data\uTorrent
                              2008-04-08 16:53 --------- d-----w C:\Program Files\Windows Live
                              2008-04-05 15:04 --------- d-----w C:\Program Files\Everest Poker
                              2008-03-31 20:15 --------- d-----w C:\Program Files\Messenger Plus! Live
                              2008-03-29 11:46 --------- d-----w C:\Documents and Settings\DaMien\Application Data\BSplayer PRO
                              2008-03-21 10:54 --------- d-----w C:\Documents and Settings\DaMien\Application Data\U3
                              2008-03-17 18:04 --------- d-----w C:\Documents and Settings\DaMien\Application Data\Sports Interactive
                              2008-03-17 17:58 --------- d-----w C:\Program Files\D-Tools
                              2008-03-17 17:51 --------- d--h--w C:\Program Files\Zero G Registry
                              2008-03-17 17:47 --------- d-----w C:\Program Files\Sports Interactive
                              2008-02-27 12:59 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
                              2008-02-27 12:58 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
                              2008-02-20 22:06 --------- d-----w C:\Program Files\Microsoft Games
                              2008-02-12 14:53 691,545 ----a-w C:\WINDOWS\unins000.exe
                              2001-11-23 06:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
                              .

                              ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              .
                              REGEDIT4
                              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
                              "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]
                              "Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\DaMien\OctoshapeClient.exe" [ ]
                              "TheTurtle"="C:\Program Files\TheTurtle\TheTurtle.exe" [ ]
                              "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 18:45 1052672]
                              "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
                              "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
                              "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
                              "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
                              "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
                              "NWEReboot"="" []
                              "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
                              "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
                              "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-01-14 01:07 185896]
                              "C-Media Mixer"="Mixer.exe" [2003-03-20 10:21 1855488 C:\WINDOWS\mixer.exe]
                              "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
                              "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
                              "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 12:45 579584]

                              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                              "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]
                              "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-08 16:00 219136]

                              C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                              Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
                              Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-04-20 20:21:07 124400]

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                              "msacm.scg726"= scg726.acm
                              "msacm.alf2cd"= alf2cd.acm
                              "vidc.dvsd"= mcdvd_32.dll
                              "msacm.ivimp3en"= ivimp3en.acm
                              "VIDC.YV12"= yv12vfw.dll
                              "msacm.ac3acm"= ac3acm.acm
                              "msacm.lameacm"= lameACM.acm

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                              "EnableFirewall"= 0 (0x0)

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                              "%windir%\\system32\\sessmgr.exe"=
                              "C:\\Program Files\\uTorrent\\utorrent.exe"=
                              "C:\\Program Files\\eMule\\emule.exe"=
                              "C:\\Program Files\\Hamachi\\hamachi.exe"=
                              "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                              "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                              "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
                              "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
                              "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
                              "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
                              "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                              "C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
                              "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

                              R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
                              R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
                              S3 AdWatchDrv;AW Realtime Driver;C:\WINDOWS\system32\drivers\AWRTPD.sys [2007-06-04 16:14]
                              S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-10-19 17:21]
                              S3 cm102u32;C-Media CM6501 Like Sound Interface;C:\WINDOWS\system32\drivers\c6501.sys []

                              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
                              \Shell\AutoRun\command - F:\install.exe

                              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{07ab1e9e-d25d-11dc-8a8a-00138fd549fc}]
                              \Shell\AutoRun\command - H:\u.bat
                              \Shell\explore\Command - H:\u.bat
                              \Shell\open\Command - H:\u.bat

                              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1de49188-12d5-11dc-897b-806d6172696f}]
                              \Shell\AutoRun\command - F:\install.exe

                              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d6ac0c8-c506-11dc-8a7f-00138fd549fc}]
                              \Shell\AutoRun\command - H:\juok3st.bat
                              \Shell\explore\Command - H:\juok3st.bat
                              \Shell\open\Command - H:\juok3st.bat

                              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6197fb43-0dee-11dc-8a56-806d6172696f}]
                              \Shell\AutoRun\command - D:\Bin\assetup.exe

                              *Newly Created Service* - CATCHME
                              .
                              **************************************************************************

                              catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                              Rootkit scan 2008-04-21 00:51:11
                              Windows 5.1.2600 Service Pack 2 NTFS

                              Balayage processus cachés ...

                              Balayage caché autostart entries ...

                              Balayage des fichiers cachés ...

                              Scan terminé avec succès
                              Les fichiers cachés: 0

                              **************************************************************************
                              .
                              Temps d'accomplissement: 2008-04-21 0:52:32
                              ComboFix-quarantined-files.txt 2008-04-20 22:52:18

                              Pre-Run: 28,470,317,056 octets libres
                              Post-Run: 28,737,548,288 octets libres

                              158 --- E O F --- 2008-01-11 11:30:12

                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 00:59:44, on 21/04/2008
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\csrss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\WINDOWS\system32\RUNDLL32.EXE
                              C:\Program Files\Logitech\Video\LogiTray.exe
                              C:\WINDOWS\system32\LVCOMSX.EXE
                              C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
                              C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                              C:\WINDOWS\Mixer.exe
                              C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
                              C:\Program Files\SuperCopier2\SuperCopier2.exe
                              C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                              C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
                              C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                              C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
                              C:\Program Files\Logitech\Video\FxSvr2.exe
                              C:\PROGRA~1\Wanadoo\ComComp.exe
                              C:\PROGRA~1\Wanadoo\Toaster.exe
                              C:\PROGRA~1\Wanadoo\Inactivity.exe
                              C:\PROGRA~1\Wanadoo\PollingModule.exe
                              C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
                              C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                              C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                              C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
                              C:\WINDOWS\System32\FTRTSVC.exe
                              C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              C:\WINDOWS\system32\nvsvc32.exe
                              C:\WINDOWS\system32\HPZipm12.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\system32\wdfmgr.exe
                              C:\WINDOWS\system32\wscntfy.exe
                              C:\WINDOWS\System32\alg.exe
                              C:\PROGRA~1\Wanadoo\Watch.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\Program Files\Mozilla Firefox\firefox.exe
                              C:\WINDOWS\system32\NOTEPAD.EXE
                              C:\Program Files\Windows Media Player\wmplayer.exe
                              C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                              C:\WINDOWS\system32\wbem\wmiprvse.exe

                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                              O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                              O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
                              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                              O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                              O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
                              O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
                              O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                              O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                              O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                              O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                              O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
                              O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                              O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
                              O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
                              O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
                              O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
                              O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\DaMien\OctoshapeClient.exe" -inv:bootrun
                              O4 - HKCU\..\Run: [TheTurtle] C:\Program Files\TheTurtle\TheTurtle.exe
                              O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
                              O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                              O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                              O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                              O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                              O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
                              O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                              O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://www.pplive.com/zh-cn/other/live/install.cab
                              O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                              O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                              O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                              O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                              O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
                              O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                              O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                              O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                              • 1
                              • 2

                              Discussions similaires

                              symboles et écritures pour nick msn
                              Pando

                              20 réponses
                              Softonic,est-ce un virus ?
                              techmel1

                              6 réponses
                              Chrome://newtab
                              Nova

                              14 réponses
                              Désinstaller Softonic
                              Diguimette

                              5 réponses
                              msn + &#9786;(symbole)
                              m0ii

                              19 réponses