Reponse

Bonjour,
Voila en esperant que ca a marché comme vous m avez indiquez j attend de vos nouvelles et encore merci de m aider
ComboFix 08-08-27.01 - Administrateur 2008-08-28 0:27:19.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.111 [GMT 2:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\combofix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrateur\Application Data\inst.exe
C:\Documents and Settings\Administrateur\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk
C:\Documents and Settings\Administrateur\Application Data\rhc72sj0e961
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Uninstall.lnk
C:\Program Files\rhc72sj0e961
C:\Program Files\RichVideoCodec
C:\WINDOWS\system32\blphc32sj0e961.scr
C:\WINDOWS\system32\C.tmp
C:\WINDOWS\system32\lphc32sj0e961.exe
C:\WINDOWS\system32\phc32sj0e961.bmp
C:\WINDOWS\system32\pphc32sj0e961.exe
C:\WINDOWS\system32\richvideocodec.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-27 to 2008-08-27 ))))))))))))))))))))))))))))))))))))
.

2008-08-27 23:37 . 2008-08-27 23:37 <REP> d-------- C:\Program Files\Trend Micro
2008-08-27 18:41 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-08-27 18:41 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-08-27 18:41 . 2008-08-26 20:19 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-08-27 18:41 . 2008-08-27 15:17 87,040 --a------ C:\WINDOWS\system32\VACFix.exe
2008-08-27 18:41 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-08-27 18:41 . 2008-08-14 21:52 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-08-27 18:41 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-08-27 18:41 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-08-27 18:41 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-08-27 18:41 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-08-27 18:37 . 2008-08-27 23:32 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-27 18:37 . 2008-08-27 18:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-27 18:37 . 2008-08-27 18:37 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-08-27 18:37 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-27 18:37 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-27 18:01 . 2008-08-27 18:04 106,496 --a------ C:\WINDOWS\system32\14.tmp
2008-08-27 18:01 . 2008-08-27 18:04 106,496 --a------ C:\WINDOWS\system32\13.tmp
2008-08-26 03:11 . 2008-08-26 03:11 <REP> d---s---- C:\Documents and Settings\Administrateur\UserData
2008-08-26 03:04 . 2004-08-04 00:54 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-08-26 02:46 . 2008-08-26 03:01 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\LimeWire
2008-08-26 02:33 . 2008-08-26 02:33 <REP> d-------- C:\Program Files\Fichiers communs\Autodesk Shared
2008-08-26 02:33 . 2008-08-26 02:33 <REP> d-------- C:\Program Files\Autodesk
2008-08-26 02:33 . 2008-08-26 02:33 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Autodesk
2008-08-26 02:26 . 2008-08-26 02:26 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Search Settings
2008-08-26 02:25 . 2008-08-26 02:25 <REP> d-------- C:\WINDOWS\Sun
2008-08-26 02:24 . 2008-08-26 02:24 <REP> d-------- C:\Program Files\Sun
2008-08-26 02:24 . 2008-08-26 02:24 <REP> d-------- C:\Program Files\Java
2008-08-26 02:24 . 2008-08-26 02:24 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-08-26 02:24 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-26 02:22 . 2008-08-26 02:23 <REP> d-------- C:\Program Files\LimeWire
2008-08-26 02:06 . 2008-08-26 02:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2008-08-25 00:27 . 2008-08-25 00:27 379 --a------ C:\WINDOWS\ODBC.INI
2008-08-25 00:26 . 2008-08-25 00:26 <REP> d-------- C:\WINDOWS\ShellNew
2008-08-25 00:25 . 2008-08-25 00:25 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Microsoft Web Folders
2008-08-25 00:04 . 2008-08-25 00:04 <REP> d-------- C:\$WIN_NT$.~BT
2008-08-25 00:04 . 2006-03-02 14:00 452,001 -ra------ C:\txtsetup.sif
2008-08-25 00:04 . 2006-03-02 14:00 263,488 -ra------ C:\$LDR$
2008-08-19 19:41 . 2008-08-19 19:54 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-11 02:29 . 2008-08-27 16:25 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-11 01:40 . 2008-08-26 00:31 <REP> d-------- C:\Program Files\EA GAMES
2008-08-11 00:42 . 2008-08-11 00:42 <REP> d-------- C:\Program Files\Search Settings
2008-08-11 00:42 . 2008-08-11 00:42 <REP> d-------- C:\Program Files\Free Audio Pack
2008-08-11 00:42 . 2008-08-11 00:42 <REP> d-------- C:\Program Files\Dealio
2008-08-11 00:42 . 2008-08-11 00:42 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Dealio
2008-08-11 00:02 . 2008-08-11 00:02 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2008-08-10 23:57 . 2008-08-10 23:57 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-08-10 23:48 . 2008-08-10 23:48 <REP> d-------- C:\Program Files\denouvel
2008-08-10 23:48 . 2008-08-10 23:48 796,672 --a------ C:\WINDOWS\GPInstall.exe
2008-08-10 23:48 . 2002-06-02 14:47 11,988 --a------ C:\WINDOWS\coloriage2.dkp
2008-08-10 23:48 . 2000-09-29 18:00 8,784 --a------ C:\WINDOWS\F_France.gpl
2008-08-10 23:22 . 2008-08-10 23:22 <REP> d-------- C:\Program Files\QuickTime
2008-08-10 23:21 . 2008-08-10 23:21 <REP> d-------- C:\Program Files\Apple Software Update
2008-08-10 23:21 . 2008-08-10 23:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-10 23:21 . 2008-08-10 23:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-08-10 23:20 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-08-10 23:20 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-10 23:19 . 2008-08-19 21:40 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-08-10 23:03 . 2008-08-10 23:04 <REP> d-------- C:\Program Files\PhotoFiltre
2008-08-10 23:00 . 2008-08-10 23:00 <REP> d-------- C:\Program Files\vso
2008-08-10 23:00 . 2008-08-10 23:01 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Vso
2008-08-10 23:00 . 2008-08-10 23:00 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-08-10 23:00 . 2008-08-10 23:00 47,360 --a------ C:\Documents and Settings\Administrateur\Application Data\pcouffin.sys
2008-08-10 22:52 . 2008-08-10 22:52 <REP> d-------- C:\Program Files\Alwil Software
2008-08-10 22:17 . 2008-08-10 22:17 <REP> d-------- C:\WINDOWS\system32\AlertModule
2008-08-10 22:17 . 2003-08-04 14:22 94,208 --a------ C:\WINDOWS\system32\W32n50.dll
2008-08-10 22:17 . 2004-08-23 14:49 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe
2008-08-10 22:17 . 2005-10-06 14:55 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
2008-08-10 22:17 . 2004-08-23 14:50 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2008-08-10 22:17 . 2003-08-04 14:22 16,128 --------- C:\WINDOWS\system32\PCANDIS5.SYS
2008-08-10 22:16 . 2008-08-28 00:30 <REP> d-------- C:\Program Files\Wanadoo
2008-08-10 22:14 . 2008-08-10 22:14 <REP> d-------- C:\Program Files\Securitoo
2008-08-09 16:49 . 2004-08-18 10:34 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-08-07 15:44 . 2008-08-07 15:44 <REP> d-------- C:\Program Files\Inventel
2008-08-07 02:02 . 2008-08-07 02:02 <REP> d-------- C:\SYSTEM.SAV
2008-08-07 01:50 . 2008-08-07 01:50 <REP> d-------- C:\Program Files\Common Files
2008-08-07 01:50 . 2002-10-23 01:00 131,072 -ra------ C:\WINDOWS\system32\Epcmlib.dll
2008-08-07 01:47 . 2008-08-07 01:47 <REP> d-------- C:\Program Files\Fichiers communs\EPSON
2008-08-07 01:47 . 2001-08-23 01:04 139,264 --a------ C:\WINDOWS\system32\EBAPI2.dll
2008-08-07 01:44 . 2008-08-07 01:50 <REP> d-------- C:\Program Files\EPSON
2008-08-07 01:44 . 2003-06-27 04:39 75,324 --a------ C:\WINDOWS\system32\EBPMON2.DLL
2008-08-07 01:44 . 2003-05-21 04:27 64,000 --a------ C:\WINDOWS\system32\ECBTEG.DLL
2008-08-07 01:44 . 2000-06-07 03:01 34,304 --a------ C:\WINDOWS\system32\EBPCHP.DLL
2008-08-07 01:44 . 2008-08-07 01:47 14,940 --a------ C:\WINDOWS\EPSTPLOG.BAK
2008-08-07 01:44 . 2001-09-04 04:04 182 --a------ C:\WINDOWS\system32\EBPPORT.DAT

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-24 22:25 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-06 23:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-06 23:49 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-07-10 10:15 --------- d-----w C:\Program Files\Realtek
2008-07-10 10:14 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-07-10 10:14 --------- d-----w C:\Program Files\Intel
2008-07-10 10:06 --------- d-----w C:\Program Files\Services en ligne
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:40 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"EPSON Stylus C44 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2002-12-10 05:06 75776]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-10-12 10:33 141848]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-10-12 10:33 166424]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-10-12 10:33 137752]
"EPSON Stylus C44 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2002-12-10 05:06 75776]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"au"="C:\Program Files\Dealio\DealioAU.exe" [2008-05-26 19:50 595296]
"SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2008-06-12 16:57 991584]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-27 08:20 16844800 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:54 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Wanadoo\\installer-73668-33fr-kaspersky-anti-virus-complete-update-french.exe.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Documents and Settings\\Administrateur\\Mes documents\\Aurelie BOULOCHE\\smitfraudfix.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2718e2c3-4e77-11dd-a48c-806d6172696f}]
\shell\Rip\Command - "C:\Program Files\Windows Media Player\wmplayer.exe" /prefetch:3 /RipAudioCD "%L"
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2008-08-10 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
HKLM-Run-lphc32sj0e961 - C:\WINDOWS\system32\lphc32sj0e961.exe
HKLM-Run-SMrhc72sj0e961 - C:\Program Files\rhc72sj0e961\rhc72sj0e961.exe

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.orange.fr/
O8 -: Compare Prices with &Dealio - C:\Documents and Settings\Administrateur\Application Data\Dealio\kb127\res\DealioSearch.html
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 00:29:47
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\FTRTSVC.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-28 0:31:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-27 22:31:16

Pre-Run: 148,620,951,552 octets libres
Post-Run: 148,907,319,296 octets libres

207 --- E O F --- 2008-08-19 19:40:24

Configuration: Windows XP
Internet Explorer 6.0