Vundo resiste

ok bonne suite!

Merci, c'est ok tout est bon.

pour le pare feu mets un de ceux indiqués . Zone alarm étant le plus facile .

desactive ta restauration
puis redemarre ton ordi
puis réactive la restauration:

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fdocid/20020830101856924
_____________

installe spywarblaster pour te proteger de vundo (logiciel qui immunise ton systeme contre vundo en partie notamment, a mettre a jour tous les mois et faire enable all ensuite et c'est tout!)

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/28872.html

_________________

vire ce qui est en quarantaine dans antivir, malwarebytes, AVG ....
__________________
lance tools cleaner pour virer ce que je t'ai fais utiliser

http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

voilà les rapports sont bon

si encore des soucis tu dira sinon c'est bon

pour protéger gratos ton ordi

https://www.commentcamarche.net/telecharger/ 4 securite

mettre un antivirus

AVAST en français ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MALWAREBYTES + SPYBOT
+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version
--------
un pare feu :
celui de Windows ou mieux KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
https://www.commentcamarche.net/telecharger/ 157 zonealarm

-----------

CCLEANER pour effacer les traces de surf

Le rapport hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:54:50, on 2008-05-22
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
D:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ezSP_Px.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
I:\iTunes\iTunesHelper.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
K:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 219.93.178.162:3128
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\adobe\acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [iTunesHelper] "I:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - http://www.photolab.ca/Upload/ImageUploader4.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: ScsiAccess - Unknown owner - D:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

J ai fait le Combofix avec tes commandes, ci dessous le rapport :

ComboFix 08-05-19.4 - Frank Neuman 2008-05-22 22:42:19.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.576 [GMT -4:00]
Running from: C:\Documents and Settings\Frank Neuman\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Frank Neuman\Desktop\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\WINDOWS\system32\ljJYSijK.dll
C:\WINDOWS\system32\rjapspfb.dll
C:\WINDOWS\system32\vtUnkKCU.dll
.

((((((((((((((((((((((((( Files Created from 2008-04-23 to 2008-05-23 )))))))))))))))))))))))))))))))
.

2008-05-21 22:09 . 2008-05-21 22:09 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\Malwarebytes
2008-05-21 22:09 . 2008-05-21 22:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-21 22:09 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-21 22:09 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-21 20:19 . 2008-05-21 20:19 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-05-21 20:19 . 2008-05-21 20:19 <DIR> d-------- C:\WINDOWS\system32\en
2008-05-21 20:19 . 2008-05-21 20:19 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-21 19:35 . 2008-04-13 20:12 848,384 --------- C:\WINDOWS\system32\ir41_32.ax
2008-05-21 19:34 . 2008-04-13 20:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-05-21 18:17 . 2008-05-21 18:17 <DIR> d-------- C:\Program Files\Avira
2008-05-21 06:18 . 2008-05-21 06:18 2,560 --a------ C:\WINDOWS\system32\onitrjmm.exe
2008-05-20 09:00 . 2008-05-20 09:00 2,560 --a------ C:\WINDOWS\system32\gjbcwhwh.exe
2008-05-19 22:21 . 2008-05-19 22:21 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\Grisoft
2008-05-19 22:21 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-05-19 21:46 . 2008-05-19 22:00 1,210 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-19 20:21 . 2008-05-19 20:21 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2008-05-19 12:36 . 2008-05-19 12:36 <DIR> d-------- C:\Documents and Settings\Jeesica Neuman\Application Data\Grisoft
2008-05-19 07:22 . 2008-05-21 18:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-18 07:25 . 2008-05-18 07:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-18 07:15 . 2008-05-18 07:15 <DIR> d-------- C:\VundoFix Backups
2008-05-17 20:54 . 2008-05-17 20:54 <DIR> d-------- C:\Documents and Settings\Jeesica Neuman\Application Data\TuneUp Software
2008-05-17 08:55 . 2008-05-17 08:55 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\PC Tools
2008-05-17 07:57 . 2008-05-17 07:57 32 --a------ C:\WINDOWS\go
2008-05-15 06:26 . 2008-05-17 07:56 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\Spyware Terminator
2008-05-15 06:04 . 2008-05-15 06:04 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-15 06:04 . 2008-04-04 14:51 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-15 05:58 . 2008-05-15 05:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-05-15 05:56 . 2008-05-15 05:56 <DIR> d-------- C:\Temp\tmpvc14
2008-05-15 05:56 . 2008-05-15 05:56 <DIR> d-------- C:\Temp
2008-05-15 05:56 . 2008-05-15 05:56 0 --a------ C:\WINDOWS\system32\MSINET.DEP
2008-05-15 05:55 . 2008-05-15 05:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-14 21:57 . 2008-05-14 21:57 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-05-14 19:36 . 2008-05-21 06:20 109,846 --a------ C:\WINDOWS\BM1faae334.xml
2008-05-06 07:37 . 2008-05-22 20:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-06 07:37 . 2008-05-06 07:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-05 19:36 . 2008-05-06 18:40 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\dvdcss

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-22 02:07 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-22 01:31 96,384 ----a-w C:\WINDOWS\system32\drivers\sptd5757.sys
2008-05-21 22:03 --------- d-----w C:\Program Files\Common Files\KAV Shared Files
2008-05-20 11:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-20 02:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-19 23:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-18 23:15 --------- d-----w C:\Program Files\Photodex Presenter
2008-05-17 13:10 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\uTorrent
2008-05-17 12:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-05-15 10:54 --------- d-----w C:\Documents and Settings\Jeesica Neuman\Application Data\AVG7
2008-05-15 10:54 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\AVG7
2008-05-15 10:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2008-05-10 12:04 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\Lavasoft
2008-05-10 11:52 --------- d-----w C:\Program Files\support.com
2008-05-06 11:36 --------- d-----w C:\Program Files\iPod
2008-04-26 12:57 --------- d-----w C:\Program Files\DivX
2008-04-23 10:23 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\Apple Computer
2008-04-14 09:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 09:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 09:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 40,840 ----a-w C:\WINDOWS\system32\drivers\termdd.sys
2008-04-14 00:13 21,896 ----a-w C:\WINDOWS\system32\drivers\tdtcp.sys
2008-04-14 00:13 139,656 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys
2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:13 12,040 ----a-w C:\WINDOWS\system32\drivers\tdpipe.sys
2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
2008-04-13 21:00 103,424 ----a-w C:\WINDOWS\system32\dpcdll.dll
2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:28 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
2008-04-13 19:27 2,188,928 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 19:21 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys
2008-04-13 19:20 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys
2008-04-13 19:20 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-04-13 19:20 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys
2008-04-13 19:19 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
2008-04-13 19:19 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
2008-04-13 19:19 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys
2008-04-13 19:19 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys
2008-04-13 19:19 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-04-13 19:18 52,480 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys
2008-04-13 19:17 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
2008-04-13 19:17 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
2008-04-13 19:17 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys
2008-04-13 19:16 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys
2008-04-13 19:16 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys
2008-04-13 19:15 64,512 ----a-w C:\WINDOWS\system32\drivers\serial.sys
2008-04-13 19:15 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys
2008-04-13 19:15 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
2008-04-13 19:15 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-04-13 19:14 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys
2008-04-13 19:14 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys
2008-04-13 19:00 30,080 ----a-w C:\WINDOWS\system32\drivers\modem.sys
2008-04-13 19:00 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-13 19:00 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys
2008-04-13 18:57 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys
2008-04-13 18:57 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys
2008-04-13 18:57 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys
2008-04-13 18:57 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys
2008-04-13 18:57 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys
2008-04-13 18:57 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys
2008-04-13 18:57 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys
2008-04-13 18:56 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys
2008-04-13 18:56 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys
2008-04-13 18:56 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys
2008-04-13 18:56 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys
2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismpx.sys
2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys
2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023x.sys
2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys
2008-04-13 18:56 12,288 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
2008-04-13 18:55 202,624 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-13 18:55 14,592 ----a-w C:\WINDOWS\system32\drivers\ndisuio.sys
2008-04-13 18:54 11,264 ----a-w C:\WINDOWS\system32\drivers\irenum.sys
2008-04-13 18:53 71,552 ----a-w C:\WINDOWS\system32\drivers\bridge.sys
2008-04-13 18:53 40,320 ----a-w C:\WINDOWS\system32\drivers\nmnt.sys
2008-04-13 18:53 36,608 ----a-w C:\WINDOWS\system32\drivers\ip6fw.sys
2008-04-13 18:53 264,832 ----a-w C:\WINDOWS\system32\drivers\http.sys
2008-04-13 18:51 61,824 ----a-w C:\WINDOWS\system32\drivers\nic1394.sys
2008-04-13 18:51 60,800 ----a-w C:\WINDOWS\system32\drivers\arp1394.sys
2008-04-13 18:51 59,904 ----a-w C:\WINDOWS\system32\drivers\atmarpc.sys
2008-04-13 18:51 55,808 ----a-w C:\WINDOWS\system32\drivers\atmlane.sys
2008-04-13 18:51 101,120 ----a-w C:\WINDOWS\system32\drivers\bthpan.sys
2008-04-13 18:47 25,856 ----a-w C:\WINDOWS\system32\drivers\usbprint.sys
2008-04-13 18:45 60,160 ----a-w C:\WINDOWS\system32\drivers\drmk.sys
2008-04-13 18:44 81,664 ----a-w C:\WINDOWS\system32\drivers\videoprt.sys
2008-04-13 18:44 799,744 ----a-w C:\WINDOWS\system32\drivers\dmboot.sys
2008-04-13 18:44 20,992 ----a-w C:\WINDOWS\system32\drivers\vga.sys
2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:44 153,344 ----a-w C:\WINDOWS\system32\drivers\dmio.sys
2008-04-13 18:43 14,208 ----a-w C:\WINDOWS\system32\drivers\wacompen.sys
2008-04-13 18:43 12,672 ----a-w C:\WINDOWS\system32\drivers\mutohpen.sys
2008-04-13 18:41 52,352 ----a-w C:\WINDOWS\system32\drivers\volsnap.sys
2008-04-13 18:39 7,552 ----a-w C:\WINDOWS\system32\drivers\mskssrv.sys
2007-08-21 22:59 56 --sha-r C:\WINDOWS\system32\17CE5413D5.sys
2005-11-12 12:36 56 --sha-r C:\WINDOWS\system32\3A0A16E22F.sys
2007-08-21 22:59 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot_2008-05-21_21.51.55,96 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-22 01:32:30 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-23 00:00:48 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 20:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32 53248]
"ezShieldProtector for Px"="C:\WINDOWS\system32\ezSP_Px.exe" [2002-08-20 11:29 40960]
"GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"iTunesHelper"="I:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"!AVG Anti-Spyware"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

C:\Documents and Settings\Frank Neuman\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [11/9/2005 10:16:12 AM 113664]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.JPGL"= jpgl.dll
"VIDC.ACDV"= ACDV.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Frank Neuman^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Frank Neuman\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ppmate]
K:\Program Files\PPMate\PPMate\ppmate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload]
K:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"K:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"K:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"D:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"I:\\iTunes\\iTunes.exe"=

R2 GDTdiInterceptor;GDTdiInterceptor;C:\WINDOWS\system32\drivers\GDTdiIcpt.sys [2007-02-01 06:46]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-04-13 20:12]
R3 DCamUSBNW800;TwinkleCam USB Camera;C:\WINDOWS\system32\DRIVERS\pcam800.sys [2002-04-19 17:44]
R3 Dot4Usb HPH09;Dot4Usb HPH09;C:\WINDOWS\system32\drivers\hphius09.sys [2003-01-30 18:55]
R3 LucentSoftModem;Lucent Technologies Soft Modem;C:\WINDOWS\system32\DRIVERS\LTSM.sys [2002-03-29 19:34]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2002-03-28 16:08]
S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys []
S3 SMBE;Sony MPEG2 Encoder Board (WDM);C:\WINDOWS\system32\Drivers\SMBE.SYS [2002-04-16 19:32]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-15 06:04]
S3 uac4pdt;PDT USB Composite Class Filter Driver;C:\WINDOWS\system32\DRIVERS\uac4pdt.sys [2005-02-24 14:35]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{109ff2ad-db4c-11dc-bb2e-00e0187e7c4c}]
\Shell\AutoRun\command - M:\InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28252f7e-a5db-11dc-babc-00e0187e7c4c}]
\Shell\AutoRun\command - M:\DigitalPhotoKeychain.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f437577a-bb94-11dc-baf7-00e0187e7c4c}]
\Shell\AutoRun\command - M:\InstallTomTomHOME.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-05-16 22:09:23 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- K:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-05-20 11:31:40 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-22 22:47:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-22 22:51:24
ComboFix-quarantined-files.txt 2008-05-23 02:50:33
ComboFix2.txt 2008-05-22 01:52:56
ComboFix3.txt 2008-05-21 11:09:19
ComboFix4.txt 2008-05-20 11:41:46
ComboFix5.txt 2008-05-20 00:54:28

Pre-Run: 1,524,494,336 bytes free
Post-Run: 1,506,418,688 bytes free

253 --- E O F --- 2008-05-20 11:43:01

[05/22/2008, 22:37:42] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Frank Neuman\Desktop\VirtumundoBeGone.exe" )
[05/22/2008, 22:37:46] - Detected System Information:
[05/22/2008, 22:37:46] - Windows Version: 5.1.2600, Service Pack 3
[05/22/2008, 22:37:46] - Current Username: Frank Neuman (Admin)
[05/22/2008, 22:37:46] - Windows is in NORMAL mode.
[05/22/2008, 22:37:46] - Searching for Browser Helper Objects:
[05/22/2008, 22:37:46] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[05/22/2008, 22:37:46] - BHO 2: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} (Groove GFS Browser Helper)
[05/22/2008, 22:37:46] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/22/2008, 22:37:46] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[05/22/2008, 22:37:46] - Finished Searching Browser Helper Objects
[05/22/2008, 22:37:46] - Finishing up...
[05/22/2008, 22:37:46] - Nothing found! Exiting...

ok il en reste!

virtumondebegone (colle le rapport)

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

_______________

scan avec
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

_______________

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

File::
C:\WINDOWS\system32\ljJYSijK.dll
C:\WINDOWS\system32\ljJYSijK.dll
C:\WINDOWS\system32\rjapspfb.dll
C:\WINDOWS\system32\vtUnkKCU.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0043CD30-8D39-4D12-B4F7-0F5E2B369F5B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{03F7AC6D-E3FB-4FE8-8907-19ACF8185B20}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{247CD1E2-A3B9-464E-B24A-9A9C44A02173}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E707216F-6AFF-4BD4-962D-EC5CDBA812A1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BM1faae334"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E707216F-6AFF-4BD4-962D-EC5CDBA812A1}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljJYSijK]

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

pour fusionner:

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

Bonjour,
Jaai refait la meme procedure avec depôse le script das combofix voila le rapport :
ComboFix 08-05-19.4 - Administrator 2008-05-19 20:32:30.2 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.760 [GMT -4:00]
Running from: J:\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\avdxtnoh.ini
C:\WINDOWS\system32\IjRAIRqr.ini
C:\WINDOWS\system32\IjRAIRqr.ini2
C:\WINDOWS\system32\JihgPqru.ini
C:\WINDOWS\system32\JihgPqru.ini2
C:\WINDOWS\system32\JkUFOqss.ini
C:\WINDOWS\system32\JkUFOqss.ini2
C:\WINDOWS\system32\mpdljctb.ini
C:\WINDOWS\system32\ppyrlvpw.ini
C:\WINDOWS\system32\UCKknUtv.ini
C:\WINDOWS\system32\UCKknUtv.ini2
.
---- Previous Run -------
.
C:\Program Files\Common Files\{1C99D~1
C:\Program Files\Common Files\{3C99D~1
C:\WINDOWS\cookies.ini
C:\WINDOWS\pack.epk
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\BbedgMoq.ini
C:\WINDOWS\system32\BbedgMoq.ini2
C:\WINDOWS\system32\drfqubdf.ini
C:\WINDOWS\system32\esmrrlqs.ini
C:\WINDOWS\system32\fuedlece.ini
C:\WINDOWS\system32\gewltcve.ini
C:\WINDOWS\system32\grhmqbkf.ini
C:\WINDOWS\system32\hgvjarav.ini
C:\WINDOWS\system32\ihiSYJjl.ini
C:\WINDOWS\system32\ihiSYJjl.ini2
C:\WINDOWS\system32\ijllm.bak1
C:\WINDOWS\system32\ijllm.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\obdybiyk.ini
C:\WINDOWS\system32\xwipfeav.ini
C:\WINDOWS\system32\XxGjQqss.ini
C:\WINDOWS\system32\XxGjQqss.ini2
C:\WINDOWS\system32\yctpmifa.ini

.
((((((((((((((((((((((((( Files Created from 2008-04-20 to 2008-05-20 )))))))))))))))))))))))))))))))
.

2008-05-19 20:21 . 2008-05-19 20:21 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2008-05-19 20:16 . 2008-05-19 20:16 2,560 --a------ C:\WINDOWS\system32\pxjfopfw.exe
2008-05-19 20:14 . 2008-05-19 20:14 124,928 --a------ C:\WINDOWS\system32\rjapspfb.dll
2008-05-19 20:13 . 2008-05-19 20:13 371,712 --a------ C:\WINDOWS\system32\vtUnkKCU.dll
2008-05-19 19:50 . 2008-05-19 19:50 2,560 --a------ C:\WINDOWS\system32\fiswrvil.exe
2008-05-19 19:47 . 2008-05-19 19:47 114,688 --a------ C:\WINDOWS\system32\btcjldpm.dll
2008-05-19 19:42 . 2008-05-19 19:42 124,928 --a------ C:\WINDOWS\system32\syjooqnd.dll
2008-05-19 18:50 . 2008-05-19 18:50 371,712 --a------ C:\WINDOWS\system32\urqPghiJ.dll_old
2008-05-19 18:38 . 2008-05-19 18:38 2,560 --a------ C:\WINDOWS\system32\wisivlac.exe
2008-05-19 18:32 . 2008-05-19 18:32 124,928 --a------ C:\WINDOWS\system32\kvyvsbwd.dll
2008-05-19 14:27 . 2008-05-19 14:27 2,560 --a------ C:\WINDOWS\system32\dnuqhxuu.exe
2008-05-19 14:20 . 2008-05-19 14:20 124,928 --a------ C:\WINDOWS\system32\ssjkyvbn.dll
2008-05-19 12:36 . 2008-05-19 12:36 <DIR> d-------- C:\Documents and Settings\Jeesica Neuman\Application Data\Grisoft
2008-05-19 07:22 . 2008-05-19 07:22 <DIR> d-------- C:\Program Files\Avira
2008-05-19 07:22 . 2008-05-19 07:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-18 20:09 . 2008-05-18 20:09 <DIR> d-------- C:\Program Files\Panda Security
2008-05-18 07:25 . 2008-05-18 07:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-18 07:15 . 2008-05-18 07:15 <DIR> d-------- C:\VundoFix Backups
2008-05-18 07:07 . 2008-05-18 07:07 124,928 --a------ C:\WINDOWS\system32\hjinfyon.dll
2008-05-17 20:54 . 2008-05-17 20:54 <DIR> d-------- C:\Documents and Settings\Jeesica Neuman\Application Data\TuneUp Software
2008-05-17 08:55 . 2008-05-17 08:55 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\PC Tools
2008-05-17 07:57 . 2008-05-17 08:00 <DIR> d-------- C:\WINDOWS\vf_hip
2008-05-17 07:57 . 2008-05-17 07:57 58,368 --a------ C:\WINDOWS\system32\xxywVoOf.dll
2008-05-17 07:57 . 2008-05-17 07:57 32 --a------ C:\WINDOWS\go
2008-05-17 07:56 . 2008-05-17 07:56 58,368 --a------ C:\WINDOWS\system32\byXOffFV.dll
2008-05-16 12:19 . 2008-05-16 12:23 354 --ahs---- C:\WINDOWS\system32\ccvehjmw.ini
2008-05-16 12:13 . 2008-05-16 12:13 116,736 --a------ C:\WINDOWS\system32\varajvgh.dll
2008-05-16 12:05 . 2008-05-16 12:05 125,952 --a------ C:\WINDOWS\system32\agjcudnx.dll
2008-05-15 06:26 . 2008-05-17 07:56 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\Spyware Terminator
2008-05-15 06:26 . 2008-05-15 06:26 58,368 --a------ C:\WINDOWS\system32\awtsQKBT.dll
2008-05-15 06:04 . 2008-05-15 06:04 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-15 06:04 . 2008-04-04 14:51 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-15 06:02 . 2008-05-15 06:02 58,368 --a------ C:\WINDOWS\system32\qoMeDTmK.dll
2008-05-15 06:00 . 2008-05-15 06:01 58,368 --a------ C:\WINDOWS\system32\nnnliGWp.dll
2008-05-15 05:58 . 2008-05-15 05:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-05-15 05:56 . 2008-05-15 05:56 <DIR> d-------- C:\Temp\tmpvc14
2008-05-15 05:56 . 2008-05-15 05:56 <DIR> d-------- C:\Temp
2008-05-15 05:56 . 2008-05-15 05:56 0 --a------ C:\WINDOWS\system32\MSINET.DEP
2008-05-15 05:55 . 2008-05-15 05:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-15 05:55 . 2008-05-15 05:55 58,368 --a------ C:\WINDOWS\system32\nnnooNHa.dll
2008-05-14 21:57 . 2008-05-14 21:57 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-05-14 19:36 . 2008-05-19 20:41 109,807 --a------ C:\WINDOWS\BM1faae334.xml
2008-05-13 18:58 . 2008-05-13 18:58 58,368 --a------ C:\WINDOWS\system32\nnnOFUMF.dll
2008-05-13 18:55 . 2008-05-13 18:55 58,368 --a------ C:\WINDOWS\system32\ljJYSijK.dll
2008-05-06 07:37 . 2008-05-19 20:41 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-06 07:37 . 2008-05-06 07:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-05 19:36 . 2008-05-06 18:40 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\dvdcss

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-20 00:03 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd5757.sys
2008-05-19 23:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-18 23:15 --------- d-----w C:\Program Files\Photodex Presenter
2008-05-18 11:28 --------- d-----w C:\Program Files\AIDA32 - Personal System Information
2008-05-18 00:52 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-17 13:10 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\uTorrent
2008-05-17 12:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-05-15 10:54 --------- d-----w C:\Documents and Settings\Jeesica Neuman\Application Data\AVG7
2008-05-15 10:54 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\AVG7
2008-05-15 10:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2008-05-10 12:04 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\Lavasoft
2008-05-10 11:52 --------- d-----w C:\Program Files\support.com
2008-05-10 11:33 --------- d-----w C:\Program Files\Yahoo!
2008-05-06 11:36 --------- d-----w C:\Program Files\iPod
2008-04-26 12:57 --------- d-----w C:\Program Files\DivX
2008-04-23 10:23 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\Apple Computer
2008-04-14 11:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-31 21:25 831,488 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-03-31 21:25 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-30 19:26 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\Sports Interactive
2008-03-30 15:16 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\DivX
2008-03-30 12:03 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\TuneUp Software
2008-03-28 13:30 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-03-28 13:30 --------- d-----w C:\Program Files\Microsoft Expression
2008-03-28 12:30 --------- d-----w C:\Program Files\Microsoft Works
2008-03-28 12:29 --------- d-----w C:\Program Files\MSBuild
2008-03-28 12:23 --------- d-----w C:\Program Files\Microsoft.NET
2008-03-28 12:21 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-03-21 20:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2007-12-16 02:47 93,304 ----a-w C:\Documents and Settings\Jeesica Neuman\Application Data\GDIPFONTCACHEV1.DAT
2007-10-20 13:32 92,064 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmmdm.sys
2007-10-20 13:32 9,232 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmmdfl.sys
2007-10-20 13:32 79,328 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmserd.sys
2007-10-20 13:32 66,656 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmbus.sys
2007-10-20 13:32 6,208 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmcmnt.sys
2007-10-20 13:32 5,936 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmwhnt.sys
2007-10-20 13:32 4,048 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmcr.sys
2007-10-20 13:32 25,600 ----a-w C:\Documents and Settings\Jeesica Neuman\usbsermptxp.sys
2007-10-20 13:32 22,768 ----a-w C:\Documents and Settings\Jeesica Neuman\usbsermpt.sys
2007-08-21 22:59 56 --sha-r C:\WINDOWS\system32\17CE5413D5.sys
2005-11-12 12:36 56 --sha-r C:\WINDOWS\system32\3A0A16E22F.sys
2007-08-21 22:59 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0043CD30-8D39-4D12-B4F7-0F5E2B369F5B}]
2008-05-19 20:13 371712 --a------ C:\WINDOWS\system32\vtUnkKCU.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{03F7AC6D-E3FB-4FE8-8907-19ACF8185B20}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{247CD1E2-A3B9-464E-B24A-9A9C44A02173}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E707216F-6AFF-4BD4-962D-EC5CDBA812A1}]
2008-05-13 18:55 58368 --a------ C:\WINDOWS\system32\ljJYSijK.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32 53248]
"ezShieldProtector for Px"="C:\WINDOWS\system32\ezSP_Px.exe" [2002-08-20 11:29 40960]
"GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"iTunesHelper"="I:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-02-12 10:06 262401]
"BM1faae334"="C:\WINDOWS\system32\rjapspfb.dll" [2008-05-19 20:14 124928]

C:\Documents and Settings\Frank Neuman\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-11-09 10:16:12 113664]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E707216F-6AFF-4BD4-962D-EC5CDBA812A1}"= C:\WINDOWS\system32\ljJYSijK.dll [2008-05-13 18:55 58368]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljJYSijK]
ljJYSijK.dll 2008-05-13 18:55 58368 C:\WINDOWS\system32\ljJYSijK.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.JPGL"= jpgl.dll
"VIDC.ACDV"= ACDV.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Frank Neuman^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Frank Neuman\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ppmate]
K:\Program Files\PPMate\PPMate\ppmate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload]
K:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"K:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"K:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"D:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"I:\\iTunes\\iTunes.exe"=

R2 AVEService;Avira AntiVir Premium MailGuard helper service;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-02-07 10:06]
R2 GDTdiInterceptor;GDTdiInterceptor;C:\WINDOWS\system32\drivers\GDTdiIcpt.sys [2007-02-01 06:46]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 03:56]
R3 DCamUSBNW800;TwinkleCam USB Camera;C:\WINDOWS\system32\DRIVERS\pcam800.sys [2002-04-19 17:44]
R3 Dot4Usb HPH09;Dot4Usb HPH09;C:\WINDOWS\system32\drivers\hphius09.sys [2003-01-30 18:55]
R3 LucentSoftModem;Lucent Technologies Soft Modem;C:\WINDOWS\system32\DRIVERS\LTSM.sys [2002-03-29 19:34]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2002-03-28 16:08]
S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys []
S2 AntiVirMailService;Avira AntiVir Premium MailGuard;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-03-26 15:35]
S2 antivirwebservice;Avira AntiVir Premium WebGuard;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE" [2008-04-09 15:57]
S3 SMBE;Sony MPEG2 Encoder Board (WDM);C:\WINDOWS\system32\Drivers\SMBE.SYS [2002-04-16 19:32]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-15 06:04]
S3 uac4pdt;PDT USB Composite Class Filter Driver;C:\WINDOWS\system32\DRIVERS\uac4pdt.sys [2005-02-24 14:35]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{109ff2ad-db4c-11dc-bb2e-00e0187e7c4c}]
\Shell\AutoRun\command - M:\InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28252f7e-a5db-11dc-babc-00e0187e7c4c}]
\Shell\AutoRun\command - M:\DigitalPhotoKeychain.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f437577a-bb94-11dc-baf7-00e0187e7c4c}]
\Shell\AutoRun\command - M:\InstallTomTomHOME.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-05-16 22:09:23 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- K:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-05-06 11:30:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-19 20:41:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\ljJYSijK.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\rjapspfb.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
D:\Program Files\Photodex\ProShowProducer\scsiaccess.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-05-19 20:54:22 - machine was rebooted [Frank Neuman]
ComboFix-quarantined-files.txt 2008-05-20 00:53:09

Pre-Run: 3,969,650,688 bytes free
Post-Run: 2,915,184,640 bytes free

284 --- E O F --- 2008-04-10 00:07:23

colle le rapport antivir pour voir les fichiers inféctés

il ne faut avoir qu'un seul antivir sur ton ordi! si tu paye vire antivir sinon vire kaspersky

le parefeu est conseillé fortement pour etre bien protegé (au minimum activer celui de windows)

_________

scan avec
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

______________

encore des soucis? si oui avecc internet explorer repare windows:
https://www.pcastuces.com/pratique/windows/xp/default.htm

Merci beaucoup ca a l'air de marche...firefox marche mais pas explorer : Bad Gateway
The following error occurred:
[code=DNS_HOST_NOT_FOUND] The host name was not found during the DNS lookup. Contact your system administrator if the problem is not found by retrying the URL.

--------------------------------------------------------------------------------
Please contact the administrator.
Dois-je faire un scan par un antivirus pour le reste et quel antivirus tu me conseille1 Dois-je vraiemnt avoir un pare feu.
Merci de ta precieuse aide et de ton professionnalisme.
J'avais une sacré infection non ? ou plusieurs.
a tres bientot.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:13:38, on 2008-05-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
D:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ezSP_Px.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
I:\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
K:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.frd=60327&q=www.ocom/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 219.93.178.162:3128
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\adobe\acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [iTunesHelper] "I:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - http://www.photolab.ca/Upload/ImageUploader4.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: ljJYSijK - ljJYSijK.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVP Control Centre Service (AVPCC) - Kaspersky Labs. - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Kaspersky Labs. - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: ScsiAccess - Unknown owner - D:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

ComboFix 08-05-19.4 - Frank Neuman 2008-05-21 6:27:40.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.597 [GMT -4:00]
Running from: C:\Documents and Settings\Frank Neuman\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Frank Neuman\Desktop\CFscript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\WINDOWS\system32\agjcudnx.dll
C:\WINDOWS\system32\btcjldpm.dll
C:\WINDOWS\system32\byXOffFV.dll
C:\WINDOWS\system32\ccvehjmw.ini
C:\WINDOWS\system32\dnuqhxuu.exe
C:\WINDOWS\system32\eymhqhhq.dll
C:\WINDOWS\system32\fiswrvil.exe
C:\WINDOWS\system32\gmqedgnp.dl
C:\WINDOWS\system32\gmqedgnp.dll
C:\WINDOWS\system32\hjinfyon.dll
C:\WINDOWS\system32\kvyvsbwd.dll
C:\WINDOWS\system32\ljJYSijK.dll
C:\WINDOWS\system32\nnnliGWp.dll
C:\WINDOWS\system32\nnnOFUMF.dll
C:\WINDOWS\system32\nnnooNHa.dll
C:\WINDOWS\system32\nqlqbbhd.exe
C:\WINDOWS\system32\pxjfopfw.exe
C:\WINDOWS\system32\qoMeDTmK.dll
C:\WINDOWS\system32\rjapspfb.dll
C:\WINDOWS\system32\ssjkyvbn.dll
C:\WINDOWS\system32\syjooqnd.dll
C:\WINDOWS\system32\urqPghiJ.dll_old
C:\WINDOWS\system32\varajvgh.dll
C:\WINDOWS\system32\vtUnkKCU.dll
C:\WINDOWS\system32\wisivlac.exe
C:\WINDOWS\system32\xxywVoOf.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\agjcudnx.dll
C:\WINDOWS\system32\btcjldpm.dll
C:\WINDOWS\system32\byXOffFV.dll
C:\WINDOWS\system32\ccvehjmw.ini
C:\WINDOWS\system32\dnuqhxuu.exe
C:\WINDOWS\system32\eymhqhhq.dll
C:\WINDOWS\system32\fiswrvil.exe
C:\WINDOWS\system32\gmqedgnp.dll
C:\WINDOWS\system32\hjinfyon.dll
C:\WINDOWS\system32\kvyvsbwd.dll
C:\WINDOWS\system32\ljJYSijK.dll
C:\WINDOWS\system32\mrajhhxe.ini
C:\WINDOWS\system32\nnnliGWp.dll
C:\WINDOWS\system32\nnnOFUMF.dll
C:\WINDOWS\system32\nnnooNHa.dll
C:\WINDOWS\system32\nqlqbbhd.exe
C:\WINDOWS\system32\pxjfopfw.exe
C:\WINDOWS\system32\qhhqhmye.ini
C:\WINDOWS\system32\qoMeDTmK.dll
C:\WINDOWS\system32\rjapspfb.dll
C:\WINDOWS\system32\ssjkyvbn.dll
C:\WINDOWS\system32\syjooqnd.dll
C:\WINDOWS\system32\UCKknUtv.ini
C:\WINDOWS\system32\UCKknUtv.ini2
C:\WINDOWS\system32\urqPghiJ.dll_old
C:\WINDOWS\system32\varajvgh.dll
C:\WINDOWS\system32\vtUnkKCU.dll
C:\WINDOWS\system32\wisivlac.exe
C:\WINDOWS\system32\xxywVoOf.dll

.
((((((((((((((((((((((((( Files Created from 2008-04-21 to 2008-05-21 )))))))))))))))))))))))))))))))
.

2008-05-21 06:24 . 2008-05-21 07:00 <DIR> d-------- C:\ComboFix
2008-05-21 06:23 . 2008-05-21 06:23 115,200 --a------ C:\WINDOWS\system32\exhhjarm.dll
2008-05-21 06:18 . 2008-05-21 06:18 126,464 --a------ C:\WINDOWS\system32\ldwfcxvf.dll
2008-05-21 06:18 . 2008-05-21 06:18 2,560 --a------ C:\WINDOWS\system32\onitrjmm.exe
2008-05-20 20:34 . 2008-05-20 20:34 <DIR> d--hs---- C:\RECYCLER
2008-05-20 09:00 . 2008-05-20 09:00 2,560 --a------ C:\WINDOWS\system32\gjbcwhwh.exe
2008-05-20 08:52 . 2008-05-20 08:52 126,976 --a------ C:\WINDOWS\system32\ltggbnmq.dll
2008-05-19 22:21 . 2008-05-19 22:21 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\Grisoft
2008-05-19 22:21 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-05-19 22:13 . 1,039,765,504 C:\hiberfil.sys
2008-05-19 21:46 . 2008-05-19 22:00 1,210 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-19 21:45 . 2008-05-19 21:45 <DIR> d-------- C:\Program Files\Chaos Shredder2.3FR
2008-05-19 20:21 . 2008-05-19 20:21 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2008-05-19 13:55 . 2008-05-21 06:29 <DIR> d-------- C:\QooBox
2008-05-19 12:36 . 2008-05-19 12:36 <DIR> d-------- C:\Documents and Settings\Jeesica Neuman\Application Data\Grisoft
2008-05-19 07:22 . 2008-05-19 07:22 <DIR> d-------- C:\Program Files\Avira
2008-05-19 07:22 . 2008-05-19 07:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-18 07:25 . 2008-05-18 07:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-18 07:15 . 2008-05-18 07:15 <DIR> d-------- C:\VundoFix Backups
2008-05-18 07:15 . 2008-05-18 07:15 <DIR> d-------- C:\VundoFix Backups
2008-05-17 20:54 . 2008-05-17 20:54 <DIR> d-------- C:\Documents and Settings\Jeesica Neuman\Application Data\TuneUp Software
2008-05-17 08:55 . 2008-05-17 08:55 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\PC Tools
2008-05-17 07:57 . 2008-05-17 07:57 32 --a------ C:\WINDOWS\go
2008-05-15 06:26 . 2008-05-17 07:56 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\Spyware Terminator
2008-05-15 06:26 . 2008-05-15 06:26 58,368 --a------ C:\WINDOWS\system32\awtsQKBT.dll
2008-05-15 06:04 . 2008-05-15 06:04 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-05-15 06:04 . 2008-04-04 14:51 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-05-15 05:58 . 2008-05-15 05:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-05-15 05:56 . 2008-05-15 05:56 <DIR> d-------- C:\Temp\tmpvc14
2008-05-15 05:56 . 2008-05-15 05:56 <DIR> d-------- C:\Temp
2008-05-15 05:56 . 2008-05-15 05:56 <DIR> d-------- C:\Temp
2008-05-15 05:56 . 2008-05-15 05:56 0 --a------ C:\WINDOWS\system32\MSINET.DEP
2008-05-15 05:55 . 2008-05-15 05:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-14 21:57 . 2008-05-14 21:57 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-05-14 19:36 . 2008-05-21 06:20 109,846 --a------ C:\WINDOWS\BM1faae334.xml
2008-05-06 07:37 . 2008-05-21 06:57 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-06 07:37 . 2008-05-06 07:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-05 19:36 . 2008-05-06 18:40 <DIR> d-------- C:\Documents and Settings\Frank Neuman\Application Data\dvdcss

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-21 10:50 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd5757.sys
2008-05-20 11:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-20 02:23 --------- d-----w C:\Program Files\Common Files\KAV Shared Files
2008-05-20 02:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-20 01:13 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-19 23:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-18 23:15 --------- d-----w C:\Program Files\Photodex Presenter
2008-05-17 13:10 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\uTorrent
2008-05-17 12:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-05-15 10:54 --------- d-----w C:\Documents and Settings\Jeesica Neuman\Application Data\AVG7
2008-05-15 10:54 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\AVG7
2008-05-15 10:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2008-05-10 12:04 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\Lavasoft
2008-05-10 11:52 --------- d-----w C:\Program Files\support.com
2008-05-06 11:36 --------- d-----w C:\Program Files\iPod
2008-04-26 12:57 --------- d-----w C:\Program Files\DivX
2008-04-23 10:23 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\Apple Computer
2008-03-30 19:26 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\Sports Interactive
2008-03-30 15:16 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\DivX
2008-03-30 12:03 --------- d-----w C:\Documents and Settings\Frank Neuman\Application Data\TuneUp Software
2008-03-28 13:30 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-03-28 13:30 --------- d-----w C:\Program Files\Microsoft Expression
2008-03-28 12:30 --------- d-----w C:\Program Files\Microsoft Works
2008-03-28 12:29 --------- d-----w C:\Program Files\MSBuild
2008-03-28 12:23 --------- d-----w C:\Program Files\Microsoft.NET
2008-03-28 12:21 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-12-16 02:47 93,304 ----a-w C:\Documents and Settings\Jeesica Neuman\Application Data\GDIPFONTCACHEV1.DAT
2007-10-20 13:32 92,064 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmmdm.sys
2007-10-20 13:32 9,232 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmmdfl.sys
2007-10-20 13:32 79,328 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmserd.sys
2007-10-20 13:32 66,656 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmbus.sys
2007-10-20 13:32 6,208 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmcmnt.sys
2007-10-20 13:32 5,936 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmwhnt.sys
2007-10-20 13:32 4,048 ----a-w C:\Documents and Settings\Jeesica Neuman\mqdmcr.sys
2007-10-20 13:32 25,600 ----a-w C:\Documents and Settings\Jeesica Neuman\usbsermptxp.sys
2007-10-20 13:32 22,768 ----a-w C:\Documents and Settings\Jeesica Neuman\usbsermpt.sys
2007-08-21 22:59 56 --sha-r C:\WINDOWS\system32\17CE5413D5.sys
2005-11-12 12:36 56 --sha-r C:\WINDOWS\system32\3A0A16E22F.sys
2007-08-21 22:59 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot_2008-05-20_ 7.38.54.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-23 04:56:21 554,008 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\dao360.dll
+ 2007-12-10 12:41:11 518,944 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexch40.dll
+ 2007-12-10 12:41:11 326,432 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexcl40.dll
+ 2007-12-10 12:41:11 1,516,568 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjet40.dll
+ 2007-12-10 12:41:11 355,112 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjetol1.dll
+ 2008-03-27 07:39:13 151,583 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjint40.dll
+ 2007-12-10 12:41:12 60,192 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjter40.dll
+ 2007-12-10 12:41:12 248,608 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjtes40.dll
+ 2007-12-10 12:41:12 219,936 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msltus40.dll
+ 2007-12-10 12:41:12 355,104 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mspbde40.dll
+ 2007-12-10 12:41:13 432,928 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd2x40.dll
+ 2007-12-10 12:41:13 322,336 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd3x40.dll
+ 2007-12-10 12:41:13 559,904 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrepl40.dll
+ 2007-12-10 12:41:13 264,992 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mstext40.dll
+ 2007-12-10 12:41:13 838,432 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswdat10.dll
+ 2007-12-10 12:41:14 621,344 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswstr10.dll
+ 2007-12-10 12:41:14 355,104 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msxbde40.dll
+ 2007-03-06 01:22:36 14,048 ----a-w C:\WINDOWS\$hf_mig$\KB950749\spmsg.dll
+ 2007-03-06 01:22:41 213,216 ----a-w C:\WINDOWS\$hf_mig$\KB950749\spuninst.exe
+ 2007-03-06 01:22:34 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\update.exe
+ 2007-03-06 01:23:51 371,424 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\updspapi.dll
- 2008-05-20 11:17:10 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-21 10:51:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2006-10-27 19:04:08 497,504 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109030000000000000000F01FEC\12.0.4518\MORPH9.DLL
+ 2006-10-27 19:04:10 9,581,360 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109030000000000000000F01FEC\12.0.4518\MSPUB.EXE
+ 2006-10-27 00:09:36 136,008 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109030000000000000000F01FEC\12.0.4518\PRTF9.DLL
+ 2006-10-27 19:04:06 624,456 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109030000000000000000F01FEC\12.0.4518\PTXT9.DLL
+ 2006-10-27 00:09:44 590,144 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109030000000000000000F01FEC\12.0.4518\PUBCONV.DLL
+ 2006-10-27 19:23:04 347,432 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109030000000000000000F01FEC\12.0.4518\WINWORD.EXE
+ 2006-10-27 19:23:08 17,483,560 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109030000000000000000F01FEC\12.0.4518\WWLIB.DLL
- 2008-05-20 11:25:50 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2008-05-20 11:42:38 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
- 2008-05-20 11:25:51 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2008-05-20 11:42:40 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2008-05-20 11:25:50 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2008-05-20 11:42:39 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
- 2008-05-20 11:25:50 184,080 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2008-05-20 11:42:39 184,080 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2008-05-20 11:25:51 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2008-05-20 11:42:40 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2008-05-20 11:25:51 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2008-05-20 11:42:40 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-05-20 11:25:52 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2008-05-20 11:42:40 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-05-20 11:25:51 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2008-05-20 11:42:39 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2008-05-20 11:25:51 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2008-05-20 11:42:40 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2008-05-20 11:25:51 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2008-05-20 11:42:40 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2008-05-20 11:25:51 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2008-05-20 11:42:40 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
- 2008-05-20 11:25:50 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2008-05-20 11:42:39 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
- 2004-08-04 07:56:42 561,179 -c--a-w C:\WINDOWS\system32\dllcache\dao360.dll
+ 2008-03-25 04:50:25 554,008 -c--a-w C:\WINDOWS\system32\dllcache\dao360.dll
- 2004-08-04 07:56:43 512,029 -c--a-w C:\WINDOWS\system32\dllcache\msexch40.dll
+ 2008-03-25 04:50:28 518,944 -c--a-w C:\WINDOWS\system32\dllcache\msexch40.dll
- 2004-08-04 07:56:43 319,517 -c--a-w C:\WINDOWS\system32\dllcache\msexcl40.dll
+ 2008-03-25 04:50:30 326,432 -c--a-w C:\WINDOWS\system32\dllcache\msexcl40.dll
- 2004-08-04 07:56:43 1,507,356 -c--a-w C:\WINDOWS\system32\dllcache\msjet40.dll
+ 2008-03-25 04:50:34 1,516,568 -c--a-w C:\WINDOWS\system32\dllcache\msjet40.dll
+ 2008-03-25 04:50:40 355,112 -c----w C:\WINDOWS\system32\dllcache\msjetol1.dll
- 2004-08-04 07:56:43 151,583 -c--a-w C:\WINDOWS\system32\dllcache\msjint40.dll
+ 2008-03-27 08:12:54 151,583 -c--a-w C:\WINDOWS\system32\dllcache\msjint40.dll
- 2004-08-04 07:56:43 53,279 -c--a-w C:\WINDOWS\system32\dllcache\msjter40.dll
+ 2008-03-25 04:50:42 60,192 -c--a-w C:\WINDOWS\system32\dllcache\msjter40.dll
- 2004-08-04 07:56:43 241,693 -c--a-w C:\WINDOWS\system32\dllcache\msjtes40.dll
+ 2008-03-25 04:50:42 248,608 -c--a-w C:\WINDOWS\system32\dllcache\msjtes40.dll
- 2004-08-04 07:56:43 213,023 -c--a-w C:\WINDOWS\system32\dllcache\msltus40.dll
+ 2008-03-25 04:50:44 219,936 -c--a-w C:\WINDOWS\system32\dllcache\msltus40.dll
- 2004-08-04 07:56:43 348,189 -c--a-w C:\WINDOWS\system32\dllcache\mspbde40.dll
+ 2008-03-25 04:50:45 355,104 -c--a-w C:\WINDOWS\system32\dllcache\mspbde40.dll
- 2004-08-04 07:56:43 421,919 -c--a-w C:\WINDOWS\system32\dllcache\msrd2x40.dll
+ 2008-03-25 04:50:47 432,928 -c--a-w C:\WINDOWS\system32\dllcache\msrd2x40.dll
- 2004-08-04 07:56:43 315,423 -c--a-w C:\WINDOWS\system32\dllcache\msrd3x40.dll
+ 2008-03-25 04:50:49 322,336 -c--a-w C:\WINDOWS\system32\dllcache\msrd3x40.dll
- 2004-08-04 07:56:43 552,989 -c--a-w C:\WINDOWS\system32\dllcache\msrepl40.dll
+ 2008-03-25 04:50:52 559,904 -c--a-w C:\WINDOWS\system32\dllcache\msrepl40.dll
- 2004-08-04 07:56:43 258,077 -c--a-w C:\WINDOWS\system32\dllcache\mstext40.dll
+ 2008-03-25 04:50:55 264,992 -c--a-w C:\WINDOWS\system32\dllcache\mstext40.dll
- 2004-08-04 07:56:44 831,519 -c--a-w C:\WINDOWS\system32\dllcache\mswdat10.dll
+ 2008-03-25 04:50:57 838,432 -c--a-w C:\WINDOWS\system32\dllcache\mswdat10.dll
- 2004-08-04 07:56:44 614,429 -c--a-w C:\WINDOWS\system32\dllcache\mswstr10.dll
+ 2008-03-25 04:50:58 621,344 -c--a-w C:\WINDOWS\system32\dllcache\mswstr10.dll
- 2004-08-04 07:56:44 348,189 -c--a-w C:\WINDOWS\system32\dllcache\msxbde40.dll
+ 2008-03-25 04:50:58 355,104 -c--a-w C:\WINDOWS\system32\dllcache\msxbde40.dll
- 2004-08-04 07:56:43 512,029 ----a-w C:\WINDOWS\system32\msexch40.dll
+ 2008-03-25 04:50:28 518,944 ----a-w C:\WINDOWS\system32\msexch40.dll
- 2004-08-04 07:56:43 319,517 ----a-w C:\WINDOWS\system32\msexcl40.dll
+ 2008-03-25 04:50:30 326,432 ----a-w C:\WINDOWS\system32\msexcl40.dll
- 2004-08-04 07:56:43 1,507,356 ----a-w C:\WINDOWS\system32\msjet40.dll
+ 2008-03-25 04:50:34 1,516,568 ----a-w C:\WINDOWS\system32\msjet40.dll
- 2004-07-17 18:34:46 358,976 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
+ 2008-03-25 04:50:40 355,112 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
- 2004-08-04 07:56:43 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
+ 2008-03-27 08:12:54 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
- 2004-08-04 07:56:43 53,279 ----a-w C:\WINDOWS\system32\msjter40.dll
+ 2008-03-25 04:50:42 60,192 ----a-w C:\WINDOWS\system32\msjter40.dll
- 2004-08-04 07:56:43 241,693 ----a-w C:\WINDOWS\system32\msjtes40.dll
+ 2008-03-25 04:50:42 248,608 ----a-w C:\WINDOWS\system32\msjtes40.dll
- 2004-08-04 07:56:43 213,023 ----a-w C:\WINDOWS\system32\msltus40.dll
+ 2008-03-25 04:50:44 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll
- 2004-08-04 07:56:43 348,189 ----a-w C:\WINDOWS\system32\mspbde40.dll
+ 2008-03-25 04:50:45 355,104 ----a-w C:\WINDOWS\system32\mspbde40.dll
- 2004-08-04 07:56:43 421,919 ----a-w C:\WINDOWS\system32\msrd2x40.dll
+ 2008-03-25 04:50:47 432,928 ----a-w C:\WINDOWS\system32\msrd2x40.dll
- 2004-08-04 07:56:43 315,423 ----a-w C:\WINDOWS\system32\msrd3x40.dll
+ 2008-03-25 04:50:49 322,336 ----a-w C:\WINDOWS\system32\msrd3x40.dll
- 2004-08-04 07:56:43 552,989 ----a-w C:\WINDOWS\system32\msrepl40.dll
+ 2008-03-25 04:50:52 559,904 ----a-w C:\WINDOWS\system32\msrepl40.dll
- 2004-08-04 07:56:43 258,077 ----a-w C:\WINDOWS\system32\mstext40.dll
+ 2008-03-25 04:50:55 264,992 ----a-w C:\WINDOWS\system32\mstext40.dll
- 2004-08-04 07:56:44 831,519 ----a-w C:\WINDOWS\system32\mswdat10.dll
+ 2008-03-25 04:50:57 838,432 ----a-w C:\WINDOWS\system32\mswdat10.dll
- 2004-08-04 07:56:44 614,429 ----a-w C:\WINDOWS\system32\mswstr10.dll
+ 2008-03-25 04:50:58 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
- 2004-08-04 07:56:44 348,189 ----a-w C:\WINDOWS\system32\msxbde40.dll
+ 2008-03-25 04:50:58 355,104 ----a-w C:\WINDOWS\system32\msxbde40.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32 53248]
"ezShieldProtector for Px"="C:\WINDOWS\system32\ezSP_Px.exe" [2002-08-20 11:29 40960]
"GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"iTunesHelper"="I:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-02-12 10:06 262401]
"!AVG Anti-Spyware"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25 6731312]
"OfficeGuard RegChecker"="D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe" [2001-09-12 15:33 24576]
"AVPCC"="D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" [2003-09-08 13:53 479296]

C:\Documents and Settings\Frank Neuman\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-11-09 10:16:12 113664]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljJYSijK]
ljJYSijK.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.JPGL"= jpgl.dll
"VIDC.ACDV"= ACDV.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Frank Neuman^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Frank Neuman\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ppmate]
K:\Program Files\PPMate\PPMate\ppmate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload]
K:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"K:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"K:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"D:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"I:\\iTunes\\iTunes.exe"=

R2 AVEService;Avira AntiVir Premium MailGuard helper service;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-02-07 10:06]
R2 AVPCC;AVP Control Centre Service;"D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service []
R2 GDTdiInterceptor;GDTdiInterceptor;C:\WINDOWS\system32\drivers\GDTdiIcpt.sys [2007-02-01 06:46]
R2 KAVMonitorService;KAV Monitor Service;"D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /service []
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 03:56]
R3 DCamUSBNW800;TwinkleCam USB Camera;C:\WINDOWS\system32\DRIVERS\pcam800.sys [2002-04-19 17:44]
R3 Dot4Usb HPH09;Dot4Usb HPH09;C:\WINDOWS\system32\drivers\hphius09.sys [2003-01-30 18:55]
R3 LucentSoftModem;Lucent Technologies Soft Modem;C:\WINDOWS\system32\DRIVERS\LTSM.sys [2002-03-29 19:34]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2002-03-28 16:08]
S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys []
S2 AntiVirMailService;Avira AntiVir Premium MailGuard;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-03-26 15:35]
S2 antivirwebservice;Avira AntiVir Premium WebGuard;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE" [2008-04-09 15:57]
S3 SMBE;Sony MPEG2 Encoder Board (WDM);C:\WINDOWS\system32\Drivers\SMBE.SYS [2002-04-16 19:32]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-05-15 06:04]
S3 uac4pdt;PDT USB Composite Class Filter Driver;C:\WINDOWS\system32\DRIVERS\uac4pdt.sys [2005-02-24 14:35]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{109ff2ad-db4c-11dc-bb2e-00e0187e7c4c}]
\Shell\AutoRun\command - M:\InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28252f7e-a5db-11dc-babc-00e0187e7c4c}]
\Shell\AutoRun\command - M:\DigitalPhotoKeychain.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f437577a-bb94-11dc-baf7-00e0187e7c4c}]
\Shell\AutoRun\command - M:\InstallTomTomHOME.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-05-16 22:09:23 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- K:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-05-20 11:31:40 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-21 06:57:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
D:\Program Files\Photodex\ProShowProducer\scsiaccess.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-05-21 7:09:18 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-21 11:08:56
ComboFix2.txt 2008-05-20 11:41:46
ComboFix3.txt 2008-05-20 00:54:28

Pre-Run: 2,697,428,992 bytes free
Post-Run: 2,674,364,416 bytes free

389 --- E O F --- 2008-05-20 11:43:01

pour fusionner: regarde ici

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

________________

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

File::
C:\WINDOWS\system32\vtUnkKCU.dll
C:\WINDOWS\system32\eymhqhhq.dll
C:\WINDOWS\system32\ljJYSijK.dll
C:\WINDOWS\system32\gmqedgnp.dl
C:\WINDOWS\system32\nqlqbbhd.exe
C:\WINDOWS\system32\gmqedgnp.dll
C:\WINDOWS\system32\pxjfopfw.exe
C:\WINDOWS\system32\rjapspfb.dll
C:\WINDOWS\system32\fiswrvil.exe
C:\WINDOWS\system32\btcjldpm.dll
C:\WINDOWS\system32\syjooqnd.dll
C:\WINDOWS\system32\urqPghiJ.dll_old
C:\WINDOWS\system32\wisivlac.exe
C:\WINDOWS\system32\kvyvsbwd.dll
C:\WINDOWS\system32\dnuqhxuu.exe
C:\WINDOWS\system32\ssjkyvbn.dll
C:\WINDOWS\system32\hjinfyon.dll
C:\WINDOWS\system32\xxywVoOf.dll
C:\WINDOWS\system32\byXOffFV.dll
C:\WINDOWS\system32\ccvehjmw.ini
C:\WINDOWS\system32\varajvgh.dll
C:\WINDOWS\system32\agjcudnx.dll
C:\WINDOWS\system32\qoMeDTmK.dll
C:\WINDOWS\system32\nnnliGWp.dll
C:\WINDOWS\system32\nnnooNHa.dll
C:\WINDOWS\system32\nnnOFUMF.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{03F7AC6D-E3FB-4FE8-8907-19ACF8185B20}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{247CD1E2-A3B9-464E-B24A-9A9C44A02173}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{663044EA-CCC3-4037-9C03-E816B843341C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E707216F-6AFF-4BD4-962D-EC5CDBA812A1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"1c99d0a8"=-
"BM1faae334"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E707216F-6AFF-4BD4-962D-EC5CDBA812A1}"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljJYSijK]

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

_______________

installe spywareblaster pour eviter d'attraper a nouveau vundo ( facile a utiliser il suffit de mettre a jour tous les mois via update et d'immuniser le système via enable all)

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/28872.html

Pour la ligne dessous je ne trouve rien, il n'est pas le dossier :
C:\WINDOWS\system32\ccvehjmw.ini

Sinon je pense que tous les fichiers sont analysés.
J'attends tes conseils.
Bonne nuit.

Fichier nqlqbbhd.exe reçu le 2008.05.21 02:28:33 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 3/32 (9.38%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: ___.
L'heure estimée de démarrage est entre ___ et ___ .
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.5.20.0 2008.05.20 -
AntiVir 7.8.0.19 2008.05.20 -
Authentium 5.1.0.4 2008.05.20 -
Avast 4.8.1195.0 2008.05.21 -
AVG 7.5.0.516 2008.05.20 -
BitDefender 7.2 2008.05.21 -
CAT-QuickHeal 9.50 2008.05.19 -
ClamAV 0.92.1 2008.05.20 -
DrWeb 4.44.0.09170 2008.05.20 -
eSafe 7.0.15.0 2008.05.20 -
eTrust-Vet 31.4.5808 2008.05.21 -
Ewido 4.0 2008.05.20 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.21 -
Fortinet 3.14.0.0 2008.05.21 -
GData 2.0.7306.1023 2008.05.21 -
Ikarus T3.1.1.26.0 2008.05.20 -
Kaspersky 7.0.0.125 2008.05.21 -
McAfee 5299 2008.05.20 -
Microsoft 1.3520 2008.05.20 -
NOD32v2 3115 2008.05.20 Win32/PrivacySet.B
Norman 5.80.02 2008.05.20 -
Panda 9.0.0.4 2008.05.21 -
Prevx1 V2 2008.05.21 Malicious Software
Rising 20.45.12.00 2008.05.20 -
Sophos 4.29.0 2008.05.20 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.20 -
TheHacker 6.2.92.314 2008.05.20 -
VBA32 3.12.6.6 2008.05.20 -
VirusBuster 4.3.26:9 2008.05.20 -
Webwasher-Gateway 6.6.2 2008.05.21 BlockReason.0
Information additionnelle
File size: 2560 bytes
MD5...: 43d29843431b3ff90e287657f6547439
SHA1..: 6ad73e320ac892ed6c487db9841a874ba1501e9c
SHA256: c6c1a620d3037132f0189f45e470cfe15709b99d6a83fe68af3b8ce536c3bf4f
SHA512: d9565773fccae6c070a5e98fb2eee27eabff4153e6e6093c116ee800f9bca2c8
3a7cce0b6bccfdc87525ba426d00954bb5483d46619f1d1777b8e9229217f5ef
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401100
timedatestamp.....: 0x48318a41 (Mon May 19 14:10:09 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x14b 0x200 4.13 208d53983e9de116e9a301be70c6f748
.rdata 0x2000 0xf2 0x200 2.50 a104b64dc408963a97668d0f1a71a72f
.data 0x3000 0x4 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x4000 0xb0 0x200 4.10 71c2c438ed4ad8369e72dab794a8c6d5

( 1 imports )
> KERNEL32.dll: LoadLibraryA, GetProcAddress, ExitProcess, GetModuleHandleA

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=38A28D6F00DB60050AB900CE0B5B4C00B79BCD14

Fichier gmqedgnp.dll reçu le 2008.05.21 02:27:04 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 10/32 (31.25%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: ___.
L'heure estimée de démarrage est entre ___ et ___ .
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.5.20.0 2008.05.20 -
AntiVir 7.8.0.19 2008.05.20 -
Authentium 5.1.0.4 2008.05.20 -
Avast 4.8.1195.0 2008.05.21 Win32:Vundo@dll
AVG 7.5.0.516 2008.05.20 -
BitDefender 7.2 2008.05.21 -
CAT-QuickHeal 9.50 2008.05.19 -
ClamAV 0.92.1 2008.05.20 -
DrWeb 4.44.0.09170 2008.05.20 -
eSafe 7.0.15.0 2008.05.20 -
eTrust-Vet 31.4.5808 2008.05.21 -
Ewido 4.0 2008.05.20 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.21 Vundo.gen179
Fortinet 3.14.0.0 2008.05.21 -
GData 2.0.7306.1023 2008.05.21 Win32:Vundo
Ikarus T3.1.1.26.0 2008.05.20 Trojan.Win32.Vundo.H
Kaspersky 7.0.0.125 2008.05.21 -
McAfee 5299 2008.05.20 -
Microsoft 1.3520 2008.05.20 Trojan:Win32/Vundo.gen!H
NOD32v2 3115 2008.05.20 Win32/Adware.AdMedia
Norman 5.80.02 2008.05.20 W32/Virtumonde.VUI
Panda 9.0.0.4 2008.05.21 Spyware/Virtumonde
Prevx1 V2 2008.05.21 Cloaked Malware
Rising 20.45.12.00 2008.05.20 -
Sophos 4.29.0 2008.05.20 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.20 -
TheHacker 6.2.92.314 2008.05.20 -
VBA32 3.12.6.6 2008.05.20 -
VirusBuster 4.3.26:9 2008.05.20 -
Webwasher-Gateway 6.6.2 2008.05.21 Win32.Malware.gen!80
Information additionnelle
File size: 124928 bytes
MD5...: 1db5b1f28444f4c2456bb55c487eb643
SHA1..: 522896774ef6e559b0757d00c68bba1c4ff6f4d2
SHA256: bd81df5d883bc07422f563986c761ba0af510afb0a7b64e027a6f40b213cccc9
SHA512: a4c7c7d11021299c76524331636c002b30473d18bbcb873fe37a997b6ebaad6a
e8686df6a890a0ffb7d4fcbad659563d3bae7fdfdfffd9eaecd62cc76bd45f54
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x100010e4
timedatestamp.....: 0x478a2fee (Sun Jan 13 15:36:14 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x8595 0x8600 7.23 d7dc01ca88ff2b5d763cdfb86ecb1a48
.rdata 0xa000 0xbb43 0xbc00 7.98 45ed7020c4817e65d4ffabbe2884bbb0
.data 0x16000 0x148d9 0xa200 7.96 4f27c70ee8255c1fbdb3ca53cc37ad9b

( 2 imports )
> user32.dll: EnableMenuItem, EmptyClipboard, DrawTextA, DestroyIcon, DestroyCursor, CreateMDIWindowA, CreateDialogParamA, CreateDesktopW, CreateAcceleratorTableA, CopyImage, CloseWindow, CharLowerA, ChangeMenuA, BeginPaint
> kernel32.dll: TlsFree, TlsAlloc, ReadFile, OpenFile, LeaveCriticalSection, GetCommandLineA, FindResourceA, ExitProcess, EnumResourceNamesA, EnumResourceLanguagesW, EnterCriticalSection, CloseHandle, lstrcatA

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=496E1B3600163F2AE8F701749574EE0030C0653D

Fichier pxjfopfw.exe reçu le 2008.05.21 02:25:43 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 3/32 (9.38%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 37 et 52 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.5.20.0 2008.05.20 -
AntiVir 7.8.0.19 2008.05.20 -
Authentium 5.1.0.4 2008.05.20 -
Avast 4.8.1195.0 2008.05.21 -
AVG 7.5.0.516 2008.05.20 -
BitDefender 7.2 2008.05.21 -
CAT-QuickHeal 9.50 2008.05.19 -
ClamAV 0.92.1 2008.05.20 -
DrWeb 4.44.0.09170 2008.05.20 -
eSafe 7.0.15.0 2008.05.20 -
eTrust-Vet 31.4.5808 2008.05.21 -
Ewido 4.0 2008.05.20 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.21 -
Fortinet 3.14.0.0 2008.05.21 -
GData 2.0.7306.1023 2008.05.21 -
Ikarus T3.1.1.26.0 2008.05.20 -
Kaspersky 7.0.0.125 2008.05.21 -
McAfee 5299 2008.05.20 -
Microsoft 1.3520 2008.05.20 -
NOD32v2 3115 2008.05.20 Win32/PrivacySet.B
Norman 5.80.02 2008.05.20 -
Panda 9.0.0.4 2008.05.21 -
Prevx1 V2 2008.05.21 Malicious Software
Rising 20.45.12.00 2008.05.20 -
Sophos 4.29.0 2008.05.20 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.20 -
TheHacker 6.2.92.314 2008.05.20 -
VBA32 3.12.6.6 2008.05.20 -
VirusBuster 4.3.26:9 2008.05.20 -
Webwasher-Gateway 6.6.2 2008.05.21 BlockReason.0
Information additionnelle
File size: 2560 bytes
MD5...: 43d29843431b3ff90e287657f6547439
SHA1..: 6ad73e320ac892ed6c487db9841a874ba1501e9c
SHA256: c6c1a620d3037132f0189f45e470cfe15709b99d6a83fe68af3b8ce536c3bf4f
SHA512: d9565773fccae6c070a5e98fb2eee27eabff4153e6e6093c116ee800f9bca2c8
3a7cce0b6bccfdc87525ba426d00954bb5483d46619f1d1777b8e9229217f5ef
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401100
timedatestamp.....: 0x48318a41 (Mon May 19 14:10:09 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x14b 0x200 4.13 208d53983e9de116e9a301be70c6f748
.rdata 0x2000 0xf2 0x200 2.50 a104b64dc408963a97668d0f1a71a72f
.data 0x3000 0x4 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x4000 0xb0 0x200 4.10 71c2c438ed4ad8369e72dab794a8c6d5

( 1 imports )
> KERNEL32.dll: LoadLibraryA, GetProcAddress, ExitProcess, GetModuleHandleA

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=38A28D6F00DB60050AB900CE0B5B4C00B79BCD14

Fichier rjapspfb.dll reçu le 2008.05.21 02:24:02 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 10/32 (31.25%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: ___.
L'heure estimée de démarrage est entre ___ et ___ .
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.5.20.0 2008.05.20 -
AntiVir 7.8.0.19 2008.05.20 -
Authentium 5.1.0.4 2008.05.20 -
Avast 4.8.1195.0 2008.05.21 Win32:Vundo@dll
AVG 7.5.0.516 2008.05.20 -
BitDefender 7.2 2008.05.21 -
CAT-QuickHeal 9.50 2008.05.19 -
ClamAV 0.92.1 2008.05.20 -
DrWeb 4.44.0.09170 2008.05.20 -
eSafe 7.0.15.0 2008.05.20 -
eTrust-Vet 31.4.5808 2008.05.21 -
Ewido 4.0 2008.05.20 -
F-Prot 4.4.2.54 2008.05.16 -
F-Secure 6.70.13260.0 2008.05.21 Vundo.gen179
Fortinet 3.14.0.0 2008.05.21 -
GData 2.0.7306.1023 2008.05.21 Win32:Vundo
Ikarus T3.1.1.26.0 2008.05.20 Trojan.Win32.Vundo.H
Kaspersky 7.0.0.125 2008.05.21 -
McAfee 5299 2008.05.20 -
Microsoft 1.3520 2008.05.20 Trojan:Win32/Vundo.gen!H
NOD32v2 3115 2008.05.20 Win32/Adware.AdMedia
Norman 5.80.02 2008.05.20 W32/Virtumonde.VUI
Panda 9.0.0.4 2008.05.21 Spyware/Virtumonde
Prevx1 V2 2008.05.21 Cloaked Malware
Rising 20.45.12.00 2008.05.20 -
Sophos 4.29.0 2008.05.20 -
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.20 -
TheHacker 6.2.92.314 2008.05.20 -
VBA32 3.12.6.6 2008.05.20 -
VirusBuster 4.3.26:9 2008.05.20 -
Webwasher-Gateway 6.6.2 2008.05.21 Win32.Malware.gen!80
Information additionnelle
File size: 124928 bytes
MD5...: 1db5b1f28444f4c2456bb55c487eb643
SHA1..: 522896774ef6e559b0757d00c68bba1c4ff6f4d2
SHA256: bd81df5d883bc07422f563986c761ba0af510afb0a7b64e027a6f40b213cccc9
SHA512: a4c7c7d11021299c76524331636c002b30473d18bbcb873fe37a997b6ebaad6a
e8686df6a890a0ffb7d4fcbad659563d3bae7fdfdfffd9eaecd62cc76bd45f54
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x100010e4
timedatestamp.....: 0x478a2fee (Sun Jan 13 15:36:14 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x8595 0x8600 7.23 d7dc01ca88ff2b5d763cdfb86ecb1a48
.rdata 0xa000 0xbb43 0xbc00 7.98 45ed7020c4817e65d4ffabbe2884bbb0
.data 0x16000 0x148d9 0xa200 7.96 4f27c70ee8255c1fbdb3ca53cc37ad9b

( 2 imports )
> user32.dll: EnableMenuItem, EmptyClipboard, DrawTextA, DestroyIcon, DestroyCursor, CreateMDIWindowA, CreateDialogParamA, CreateDesktopW, CreateAcceleratorTableA, CopyImage, CloseWindow, CharLowerA, ChangeMenuA, BeginPaint
> kernel32.dll: TlsFree, TlsAlloc, ReadFile, OpenFile, LeaveCriticalSection, GetCommandLineA, FindResourceA, ExitProcess, EnumResourceNamesA, EnumResourceLanguagesW, EnterCriticalSection, CloseHandle, lstrcatA

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=496E1B3600163F2AE8F701749574EE0030C0653D