Infostealer

cdac -  
Bonjour,
question à qui saurait m'aider.
suis infecté par : SPYWARE.INFOSTEALER_BZUP.BF_0X0000001E
ce virus m'empèche de me mettre à jour ave mcafee
que dois je faire pour ne pas devoir booté mon ordi.
merci de tout vos conseils. ne pas oublier, EASY je suis novice
Configuration: Windows XP
Internet Explorer 7.0

33 réponses

Résumé de la discussion

Infection par SPYWARE.INFOSTEALER_BZUP.BF_0X0000001E empêche les mises à jour de McAfee sur Windows XP avec Internet Explorer 7, compliquant la situation d’un utilisateur novice. Plusieurs propositions consistent à désactiver temporairement l’antivirus, redémarrer le système et envisager une réinstallation, éventuellement après suppression des éléments Norton. D'autres conseils évoquent l'usage d'outils externes comme VirusTotal pour analyser un fichier suspect, ou l'examen de critères sensibles et de fichiers système. En complément, certaines suggestions recommandent des vérifications de points de restauration et la recherche de traces pertinentes, sans conclure sur une solution immédiate.

Bobot (l’IA à votre service)
  1. Regis59 Contributeur sécurité
    Ok, je me permet de te contacter en MP pour tenter de le retrouver. A tout'.
    1.  Regis59 Contributeur sécurité
      Ok si tu fais Entrée pour le mot de passe sans rien mettre, ça marche pas?
    2.  Regis59 Contributeur sécurité
      Fais 1. Entrée.
      1. cdac Auteur
        merci regis, c'est fait. mainteant il demande l'administrateur??
      2. noctambule28
        @cdacnous nous croisons, c'est plus rapide qu'unn chan

        valide à vide lemot de passe
      3. cdac
        @noctambule28bjr
        je rame au bureau avec cette machine qui n avance pas et qui reste en querty.

        Pour l autre ;achine j ai installer recovery et la il ;e demande la cle. je sais tout introduire comme lettre et chiffre sauf le A. j ai tout essaye.
        ;aintenant je reinstalle et on verra si meme erreur.

        pour cette machine que faire on va l4appeler M2
    3. noctambule28
      ok

      tu vas booter dessus ( si ce n''est pas le cas , verifie dans ton bios que tu as le cdrom en first dans l'ordre do boot "dans boot sequency")

      tu devrais avoir unn prompt _ pour pouvoir ecrire . Tapes

      chkdsk /r c:

      espace apres chkdsk et après /r
      1. cdac Auteur
        il'instal a demaré et me demande sur quelle installation de window xp je veux ouvrir une session
      2. noctambule28
        @cdactu dois avoir 1

        qui correspond à c:\windows

        tu tapes 1
      3. cdac Auteur
        voila on avance, mais mainteant il me demande le pass administrateur/
        quid??
        je n'en ai pas ou du moins ceux que je connais ne passent pas
    5. noctambule28
      Ok, alors plusieurs hypothèse:

      ça ressemnle à un probleme materiel! ( un secteur defectueux ) il faudrait pouvoir le reparer

      Il va falloir analysr le disque physique

      Suit ceci, c'est afin d'avoir la main sur le pc
      http://www.vista-xp.fr/forum/topic240.html
      dit moi, une fois que tu as gravé
      1. cdac Auteur
        voilaz il grave
      2. cdac Auteur
        c'est fait
    6. noctambule28
      Quand as tu rebooter pour le dernière fois et que tout à fonctionné ?
      Car je pige pas le probleme, ce que je t'ai fait faire en dernier, c'etait certainement ce qu'il y avait de moins dangeureux !

      Tu ne vas plus du tout sur windows si j'ai bien compris ?

      car le ctrl+alt.suppr, c'est sur le bureau windows

      1. cdac Auteur
        effectivement je ne sais plus aller sur window.
        Maintenant il tourne en boucle. Message sur ecran noir :
        BOOT FROM CD
        ensuite BIP et la fenetre bleue apparait avec F2 F3 F8.
        Quand je fais F8 et mode save, je reviens sur ecran noir avec bip et à nouveau fenetre bleu et ceci n'arrete pas.
    7. noctambule28
      c'est apres la dernière manip de ce matin ?( car en général infensif, ça supprime juste les logiciels de desinfection)

      c'est quoi cette histoire avec malware ?

      Tu n'as pas un cd dans ton lecteur ?
      au pire as-tu un cd de windows( pas pour reinstaller )

      1. cdac Auteur
        pas de disque window pour cette becane ici
        malware c'est juste une partie d'un programme que tu m'a demandé de charger et puis de détruire. Le message après destruction etaiit de devoir redemarer le pc.
        n'y a t'il pas moyen de revenir sur le bureau par manipulationavec F5 ou F8 et ensuite choisir qlque chose
      2. cdac Auteur
        voila ce que j'ai fait :

        Ça dit egalement que norton a disparu

        tu vas supprimer les anciens points de restauration
        Pour ca tu fais
        demarrer ,clic droit sur poste de travail ,onglet propriiété, onglet restauration systeme ,
        Supprime tous les logiciels que je t'ai fait passer
        coche : Desactiver la restauration système, et appliquer , puis redecoche.

        puis rien. pas eu le temps d'aller sur le lien
      3. cdac Auteur
        quid???
        je ne sais pas demarer en mode sans echec ou derniere configurationconnue.
        que faire???
    8. cdac
      urgent!!!
      dis moi si tu dois chercher, car je reste posté là??
      1. noctambule28
        fait ctrl+alt+suppr ( les trois touche en meme temps)

        dans "nouvelle tache " tape explorer
      2. cdac Auteur
        @noctambule28il ne se passe rien.
        2ième essai avec les trois touche au démarage.: rien
        3ième essai avec insistance sur les 3 tlouches en même temp :
        fenetre noir bloqué avec message milieu : IDEChannel 0 Master : _NEC DVD_RW ND-3550A1
      3. cdac Auteur
        @noctambule28idem
        je redemare, appuie ctrl+alt+delete et ensuite message IDEChannel 0 Master : _NEC DVD_RW ND
    9. noctambule28
      Salut

      Ça disait que les cracks et les keygens chopés en P2P, ça met un beau bordel dans les machines.
      Je t'ai signalé un site , VIrus_Total,, quand tu en auras d'autre envoie les dessus avant de t'en servir et de les executer, ça risque de te refroidir plus d'une fois

      Ça dit egalement que norton a disparu

      tu vas supprimer les anciens points de restauration
      Pour ca tu fais
      demarrer ,clic droit sur poste de travail ,onglet propriiété, onglet restauration systeme ,
      Supprime tous les logiciels que je t'ai fait passer
      coche : Desactiver la restauration système, et appliquer , puis redecoche.

      Pour compléter leur suppression
      · Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.
      http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner

      http://pc-system.fr/

      · Clique sur Recherche et laisse le scan se terminer.
      · Clique, sur Suppression pour finaliser.
      · Tu peux te servir des Options facultatives.( netttoyage des temporaires et vidage de la corbeille
      · Clique sur Quitter, pour que le rapport puisse se créer.
      · Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

      Dit moi ou ça en est du pc:

      Pour celui du boulot; comme tu doiy etre , et en esperant que tu es tous les droits dessus ainsi qu'un acces au bet illimité , il faudrait quetu refasse un post pour eviter de tout melanger et tu me contacte en MP pour me le signaler ou tu mets le lien ici.

      @
      1. cdac
        ,
        j'ai effacer les prorammes et ce que j'avais sur mon bureau en executable.
        j'ai également fait un restore comme demandé
        Pour en finir avec malware, j'ai du redemerer le pc. Maintenant il bip sans Le message sur fond noir est Boot from cd.
        que faire.??
        merci
    10. noctambule28
      tres bien, tout ça

      le dernier scan et ensuite nettoyage des outils et pi voila ;)

      - > Ouvre ce lien pour scanner ton PC avec un BitDefender en ligne (uniquement sous Internet Explorer) :

      https://www.bitdefender.com/toolbox/

      Utilisation :
      Cliquer sur "J'accepte" puis accepter également l'ActiveX bloqué par la barre anti-popup du SP2 qui clignotera en haut et l'installer.
      Ensuite, cliquer sur "Cliquez ici pour scanner".
      Patienter jusqu'à la fin du scan qui peut durer assez longtemps...

      Copier/coller le rapport entier sur le forum.

      Tutoriel en images ici : http://pageperso.aol.fr/rginformatique/mapage/defender.htm (merci à Balltrap34 pour cette réalisation)

      Relance Hijackthis et copie/colle un nouveau rapport sur le forum.

      Et dis moi ou en sont tes problèmes s’il t’en reste.

      Il ne devrait plus rester grand chose.
      1. cdac Auteur
        ok pour l'instant il scan. on verra si des problème subsiste.
        Au bureau j'ai une autre bécanne qui est infectée. D'ailleur je pense que c'est elle qui a infecté celle-ci par le reseau.
        Le probleme, si c'en est un est que j'ai effacé des fichier dll suite au rapport que mcafee me faisait sur les fichier infecté.
        on verra ça ultérieurement si cela ne te dérange pas.
        Et encore un tout grand merci pour ton aide.
      2. cdac Auteur
        BitDefender Online Scanner

        Scan report generated at: Sun, Dec 07, 2008 - 22:32:55

        Scan path: D:\Documents and Settings\sda\My Documents;D:\Documents and Settings\All Users\Documents;C:\;D:\;E:\;J:\;X:\;Y:\;Z:\;

        Statistics

        Time
        02:28:18

        Files
        650140

        Folders
        14895

        Boot Sectors
        0

        Archives
        13163

        Packed Files
        43355

        Results

        Identified Viruses
        6

        Infected Files
        7

        Suspect Files
        0

        Warnings
        0

        Disinfected
        0

        Deleted Files
        7

        Engines Info

        Virus Definitions
        2335645

        Engine build
        AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)

        Scan plugins
        17

        Archive plugins
        44

        Unpack plugins
        7

        E-mail plugins
        6

        System plugins
        4

        Scan Settings

        First Action
        Disinfect

        Second Action
        Delete

        Heuristics
        Yes

        Enable Warnings
        Yes

        Scanned Extensions
        *;

        Exclude Extensions

        Scan Emails
        Yes

        Scan Archives
        Yes

        Scan Packed
        Yes

        Scan Files
        Yes

        Scan Boot
        Yes

        Scanned File
        Status

        C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\qtoprtuq.sys.vir
        Infected with: Rootkit.Agent.AIXB

        C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\qtoprtuq.sys.vir
        Deleted

        C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP557\A0074132.dll
        Infected with: Win32.Adware.LTM

        C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP557\A0074132.dll
        Deleted

        C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP558\A0075288.sys
        Infected with: Rootkit.Agent.AIXB

        C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP558\A0075288.sys
        Deleted

        C:\WINDOWS\system32\HPI4.dll
        Detected with: Adware.BHO

        C:\WINDOWS\system32\HPI4.dll
        Deleted

        D:\film a graver\limewire telechargement\traceo ip_Crack.zip=>Crack.exe
        Infected with: Trojan.Buzus.CH

        D:\film a graver\limewire telechargement\traceo ip_Crack.zip=>Crack.exe
        Deleted

        D:\film a graver\limewire telechargement\traceo ip_Crack.zip
        Updated

        D:\film a graver\Nero.v8.2.8.0.PATENT.AUTH.CRACK.ONLY.MERRY.XMAS-PHiL8900.rar.rar=>Nero8Keygen.exe
        Infected with: Trojan.Packed.28063

        D:\film a graver\Nero.v8.2.8.0.PATENT.AUTH.CRACK.ONLY.MERRY.XMAS-PHiL8900.rar.rar=>Nero8Keygen.exe
        Deleted

        D:\film a graver\Nero.v8.2.8.0.PATENT.AUTH.CRACK.ONLY.MERRY.XMAS-PHiL8900.rar.rar
        Update failed

        D:\Software\Isobuster 1.9.1+serial+crack.rar=>Isobuster 1.9.1+serial+crack\Smart[1].Projects.IsoBuster.Pro.v1.9.1.1.Multilingual.Incl.KeyMaker-DVT.rar=>Smart.Projects.IsoBuster.Pro.v1.9.1.1.Multilingual.Incl.KeyMaker-DVT\DVT\KeyMaker.exe
        Infected with: Trojan.Packed.31356

        D:\Software\Isobuster 1.9.1+serial+crack.rar=>Isobuster 1.9.1+serial+crack\Smart[1].Projects.IsoBuster.Pro.v1.9.1.1.Multilingual.Incl.KeyMaker-DVT.rar=>Smart.Projects.IsoBuster.Pro.v1.9.1.1.Multilingual.Incl.KeyMaker-DVT\DVT\KeyMaker.exe
        Deleted

        D:\Software\Isobuster 1.9.1+serial+crack.rar=>Isobuster 1.9.1+serial+crack\Smart[1].Projects.IsoBuster.Pro.v1.9.1.1.Multilingual.Incl.KeyMaker-DVT.rar
        Update failed

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 23:29:29, on 7/12/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16735)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\WINDOWS\system32\drivers\CDAC11BA.EXE
        c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
        c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
        C:\WINDOWS\System32\GEARSec.exe
        C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
        C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
        C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
        c:\program files\common files\mcafee\mna\mcnasvc.exe
        c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
        C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
        C:\Program Files\McAfee\MPF\MPFSrv.exe
        C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Apps\Softex\OmniPass\Omniserv.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
        C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
        C:\Program Files\RealVNC\WinVNC\WinVNC.exe
        C:\WINDOWS\system32\SearchIndexer.exe
        c:\APPS\Powercinema\Kernel\TV\CLSched.exe
        C:\Apps\Softex\OmniPass\OPXPApp.exe
        C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
        c:\PROGRA~1\mcafee.com\agent\mcagent.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
        C:\Apps\Softex\OmniPass\scureapp.exe
        C:\APPS\Powercinema\PCMService.exe
        C:\Program Files\QuickTime\qttask.exe
        C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Microsoft ActiveSync\wcescomm.exe
        C:\PROGRA~1\MICROS~4\rapimgr.exe
        C:\APPS\skype\Phone\Skype.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
        C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
        C:\Program Files\Windows Desktop Search\WindowsSearch.exe
        C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
        C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
        C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
        C:\APPS\SKYPE\Plugin Manager\skypePM.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\WINDOWS\explorer.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
        C:\HiJackThis.exe

        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
        R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        R3 - URLSearchHook: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyBa.dll
        O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyBa.dll
        O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
        O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
        O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O3 - Toolbar: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyBa.dll
        O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
        O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
        O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
        O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
        O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
        O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe
        O4 - HKLM\..\Run: [PCMService] "c:\APPS\Powercinema\PCMService.exe"
        O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
        O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
        O4 - HKLM\..\Run: [IdiomaX Office] C:\Program Files\IdiomaX\Office Translator 4.0\IdxOffice.exe
        O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
        O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
        O4 - HKCU\..\Run: [Skype] "C:\APPS\skype\Phone\Skype.exe" /nosplash /minimized
        O4 - HKCU\..\Run: [feedreader.exe] "C:\Program Files\FeedReader30\feedreader.exe"
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
        O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
        O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
        O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
        O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
        O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
        O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
        O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\beuk.htm
        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
        O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
        O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
        O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
        O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
        O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
        O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
        O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
        O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
        O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
        O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
        O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
        O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
        O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
        O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
        O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
        O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
        O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
        O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
        O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
        O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
        O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
        O23 - Service: RemotelyAnywhere Maintenance Service (RAMaint) - Unknown owner - C:\Program Files\RemotelyAnywhere\RAMaint.exe (file missing)
        O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
        O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
        O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
        O23 - Service: VNC Server (winvnc) - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe
    11. noctambule28
      OK, c'est tres bien, ça avance

      1) Imprime ces instructions ou mets les dans un fichier texte sur ton bureau)car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.
      Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau à partir de ce lien :

      https://www.malwarebytes.com/

      A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

      Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

      Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

      MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

      Dans l'onglet analyse, vérifie que "Exécuter un examen rapide" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

      MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

      A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

      Si des malwares ont été détectés, leur liste s'affiche.
      En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

      MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)
      Ferme MBAM en cliquant sur Quitter.
      Poste le rapport dans ta réponse
      1. cdac Auteur
        Malwarebytes' Anti-Malware 1.31
        Version de la base de données: 1471
        Windows 5.1.2600 Service Pack 2

        7/12/2008 19:41:09
        mbam-log-2008-12-07 (19-41-09).txt

        Type de recherche: Examen rapide
        Eléments examinés: 68886
        Temps écoulé: 6 minute(s), 7 second(s)

        Processus mémoire infecté(s): 0
        Module(s) mémoire infecté(s): 0
        Clé(s) du Registre infectée(s): 5
        Valeur(s) du Registre infectée(s): 0
        Elément(s) de données du Registre infecté(s): 0
        Dossier(s) infecté(s): 0
        Fichier(s) infecté(s): 0

        Processus mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Module(s) mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Clé(s) du Registre infectée(s):
        HKEY_CLASSES_ROOT\hpi4.hpi2 (Adware.BHO) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\iehelper3.iehelperop (Spyware-Logger.Unknown) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{49e0e0f0-5c30-11d4-945d-000000000000} (Spyware-Logger.Unknown) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Rapid Antivirus (Rogue.RapidAntivirus) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\homeview (Trojan.DNSChanger) -> Quarantined and deleted successfully.

        Valeur(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Elément(s) de données du Registre infecté(s):
        (Aucun élément nuisible détecté)

        Dossier(s) infecté(s):
        (Aucun élément nuisible détecté)

        Fichier(s) infecté(s):
        (Aucun élément nuisible détecté)
    12. noctambule28
      Non, ça n'a pas fonctionné !!
      Tu peux le refaire , mais pense à desactiver ton antivirus avant
      1. cdac Auteur
        en glissant CFScript sur combo, il me dit que le nom du fichier est incorecte.
        quid?
      2. noctambule28
        @cdaccomment s'appelle t'il ( avec l'extension)

        il doit etre CFScipt.txt ' enregister dans le format "tous les fichiers"
      3. cdac Auteur
        @noctambule28sorry, je^pense que c'est bon. voir. j'avias oublié le r..;de script . par contre il ne me demande aucune option lors du glisser sur combo. il scan tout de suite.
        ComboFix 08-12-05.06 - sda 2008-12-07 19:01:43.3 - NTFSx86
        Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1314 [GMT 1:00]
        Running from: d:\documents and settings\sda\Desktop\ComboFix.exe
        Command switches used :: d:\documents and settings\sda\Desktop\CFScript.txt
        * Created a new restore point

        FILE ::
        c:\program files\setup.exe
        c:\windows\JJACRBNV.exe
        c:\windows\system32\uwrqdspa.tmp
        .

        ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
        .

        c:\1815657427\
        c:\program files\setup.exe
        c:\windows\JJACRBNV.exe
        c:\windows\system32\uwrqdspa.tmp

        .
        ((((((((((((((((((((((((( Files Created from 2008-11-07 to 2008-12-07 )))))))))))))))))))))))))))))))
        .

        2008-12-06 10:06 . 2008-12-06 13:47 <DIR> d-------- C:\SDFix
        2008-12-05 17:57 . 2008-12-05 18:10 <DIR> d-------- c:\program files\UsbFix
        2008-12-05 15:33 . 2008-12-05 21:16 <DIR> d-------- C:\ToolBar SD
        2008-12-05 15:20 . 2008-12-05 15:20 2,404,352 --a------ C:\Norton_Removal_Tool.exe
        2008-12-05 15:16 . 2008-12-05 15:16 <DIR> d-------- c:\windows\system32\Temp
        2008-12-05 13:53 . 2008-12-05 13:54 1,226,248 --a------ C:\DMSetup.exe
        2008-12-05 13:14 . 2008-12-05 13:14 552 --a------ c:\windows\system32\d3d8caps.dat
        2008-12-05 12:52 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
        2008-12-05 12:52 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
        2008-12-05 12:52 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe
        2008-12-05 12:52 . 2008-12-05 12:29 53,248 --a------ c:\windows\system32\Process.exe
        2008-12-05 12:52 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
        2008-12-05 12:52 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
        2008-12-05 12:29 . 2008-12-05 13:39 <DIR> d-------- C:\SmitfraudFix
        2008-12-05 12:19 . 2008-12-06 13:53 1,435,761 --a------ C:\SmitfraudFix.zip
        2008-12-04 20:00 . 2008-12-04 20:01 401,720 --a------ C:\HiJackThis.exe
        2008-12-01 19:41 . 2008-12-01 19:41 30,601 --a------ d:\documents and settings\sda\x.exe
        2008-12-01 18:43 . 2008-12-01 18:43 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
        2008-12-01 18:05 . 2008-12-01 18:05 <DIR> d-------- d:\documents and settings\sda\dsc
        2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\vw
        2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\VisualRoute
        2008-12-01 18:01 . 2008-12-01 20:07 <DIR> d-------- c:\program files\VisualRoute 2008
        2008-11-27 17:20 . 2008-12-06 16:16 0 --a------ c:\windows\system32\drivers\3672251a.sys
        2008-11-27 17:19 . 2008-11-27 17:19 2 --a------ C:\1815657427

        .
        (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-12-07 18:04 --------- d-----w d:\documents and settings\sda\Application Data\Skype
        2008-12-07 15:02 --------- d-----w d:\documents and settings\sda\Application Data\skypePM
        2008-12-07 11:36 --------- d-----w c:\program files\Common Files\Symantec Shared
        2008-12-01 19:07 --------- d-----w c:\program files\SUPERAntiSpyware
        2008-12-01 18:40 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
        2008-12-01 18:03 --------- d-----w d:\documents and settings\sda\Application Data\LimeWire
        2008-12-01 11:06 --------- d-----w c:\program files\ZikiTranslator
        2008-11-28 10:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.001\Application Data\SACore
        2008-11-27 13:27 --------- d-----w c:\program files\e-bat
        2008-11-17 12:59 --------- d-----w c:\program files\McAfee
        2008-11-12 02:07 --------- d-----w d:\documents and settings\All Users\Application Data\Microsoft Help
        2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
        2008-10-24 11:10 453,632 ----a-w c:\windows\system32\dllcache\mrxsmb.sys
        2008-10-20 16:25 --------- d-----w d:\documents and settings\sda\Application Data\Ulead Systems
        2008-10-20 10:41 --------- d-----w d:\documents and settings\sda\Application Data\Sprite Software
        2008-10-20 10:40 --------- d--h--w c:\program files\InstallShield Installation Information
        2008-10-20 10:40 --------- d-----w c:\program files\Sprite Software
        2008-10-20 10:34 --------- d-----w c:\program files\Microsoft ActiveSync
        2008-10-20 10:12 --------- d-----w c:\program files\Ressources Windows Mobile
        2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
        2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
        2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
        2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
        2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
        2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
        2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
        2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
        2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
        2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
        2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
        2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
        2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
        2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
        2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
        2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
        2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
        2008-10-15 16:57 332,800 ----a-w c:\windows\system32\dllcache\netapi32.dll
        2008-10-10 18:06 --------- d-----w c:\program files\Common Files\HP
        2008-10-10 16:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.000\Application Data\SACore
        2008-10-09 16:34 --------- d-----w c:\program files\HP
        2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
        2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
        2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
        2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\dllcache\win32k.sys
        2008-04-04 09:49 32 ----a-w d:\documents and settings\All Users\Application Data\ezsid.dat
        2007-10-30 08:54 100,680 ----a-w d:\documents and settings\sda\Application Data\GDIPFONTCACHEV1.DAT
        2007-08-01 14:48 9,644 ----a-w c:\program files\uninstal.log
        2007-06-07 10:46 81,920 ----a-w d:\documents and settings\sda\Application Data\ezpinst.exe
        2007-06-07 10:46 47,360 ----a-w d:\documents and settings\sda\Application Data\pcouffin.sys
        2005-09-09 17:55 7,155,864 ----a-w c:\program files\NGhost10.msi
        2005-09-09 17:55 37,766,164 ----a-w c:\program files\Data1.cab
        2005-09-09 17:55 35 ----a-w c:\program files\SCSSDist.ini
        .

        ((((((((((((((((((((((((((((( snapshot@2008-12-06_18.58.59.67 )))))))))))))))))))))))))))))))))))))))))
        .
        - 2008-12-06 16:35:03 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
        + 2008-12-07 16:36:23 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
        - 2008-12-06 16:35:03 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
        + 2008-12-07 16:36:23 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
        - 2008-12-06 16:35:03 49,152 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
        + 2008-12-07 16:36:23 49,152 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
        .
        ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* empty entries & legit default entries are not shown
        REGEDIT4

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
        "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

        [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

        [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]
        2008-08-05 01:13 1610264 --a------ c:\program files\myBabylon\tbmyBa.dll

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
        "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
        "{34EA1C70-42CC-42C5-AA29-EC58B95A343E}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

        [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
        "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
        "Skype"="c:\apps\skype\Phone\Skype.exe" [2008-02-01 21974824]
        "feedreader.exe"="c:\program files\FeedReader30\feedreader.exe" [2007-03-16 1186304]
        "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-31 68856]
        "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
        "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
        "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
        "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
        "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
        "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-28 7573504]
        "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-04-28 86016]
        "Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]
        "DetectorApp"="c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
        "OmniPass"="c:\apps\Softex\OmniPass\scureapp.exe" [2006-01-30 1978368]
        "PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-02-23 147456]
        "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2008-06-13 1176808]
        "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-06 98304]
        "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
        "Adobe Photo Downloader"="c:\program files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]
        "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
        "IdiomaX Office"="c:\program files\IdiomaX\Office Translator 4.0\IdxOffice.exe" [2007-01-18 397872]
        "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
        "nwiz"="nwiz.exe" [2006-04-28 c:\windows\system32\nwiz.exe]
        "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
        "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 c:\windows\RTHDCPL.exe]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

        d:\documents and settings\sda\Start Menu\Programs\Startup\
        OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

        d:\documents and settings\All Users\Start Menu\Programs\Startup\
        Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2007-06-06 49254]
        Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
        HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
        HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
        Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
        SnagIt 8.lnk - c:\program files\TechSmith\SnagIt 8\SnagIt32.exe [2007-02-06 6379080]
        Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784]

        [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
        "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
        2006-01-30 08:53 49152 c:\apps\Softex\OmniPass\OPXPGina.dll

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
        "vidc.I420"= vdrcodec.dll
        "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
        "msacm.mpegacm"= mpegacm.acm
        "msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm
        "msacm.mpegacm "= c:\progra~1\COMMON~1\ULEADS~1\MPEG\mpegacm.acm
        "VIDC.MJPG"= Pvmjpg30.dll

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
        "DisableMonitoring"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
        "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
        "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
        "c:\\Program Files\\Messenger\\msmsgs.exe"=
        "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
        "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
        "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "c:\\Program Files\\eMule\\emule.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
        "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
        "c:\\Program Files\\RealVNC\\vncviewer.exe"=
        "c:\\Program Files\\RealVNC\\WinVNC\\winvnc.exe"=
        "c:\\Program Files\\McAfee\\MBK\\McAfeeDataBackup.exe"=
        "c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
        "d:\\film a graver\\emule.exe"=
        "c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
        "c:\\Program Files\\LimeWire\\LimeWire.exe"=
        "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
        "c:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
        "c:\\WINDOWS\\system32\\java.exe"=
        "d:\\Documents and Settings\\sda\\Desktop\\SymNRT.exe"=
        "c:\\APPS\\skype\\Phone\\Skype.exe"=

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
        "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
        "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
        "500:UDP"= 500:UDP:@xpsp2res.dll,-22017

        R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-10-01 203280]
        S1 3672251a;3672251a;c:\windows\system32\drivers\3672251a.sys [2008-11-27 0]
        S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2008-03-18 1527900]
        S3 ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-12-01 27904]
        S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2008-03-18 544768]

        *Newly Created Service* - CATCHME
        .
        Contents of the 'Scheduled Tasks' folder

        2008-11-15 c:\windows\Tasks\McDefragTask.job
        - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

        2008-11-01 c:\windows\Tasks\McQcTask.job
        - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]
        .
        - - - - ORPHANS REMOVED - - - -

        WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

        **************************************************************************

        catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-12-07 19:04:18
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        --------------------- DLLs Loaded Under Running Processes ---------------------

        - - - - - - - > 'winlogon.exe'(576)
        c:\apps\Softex\OmniPass\opxpgina.dll
        .
        Completion time: 2008-12-07 19:05:32
        ComboFix-quarantined-files.txt 2008-12-07 18:05:29
        ComboFix2.txt 2008-12-07 12:57:04
        ComboFix3.txt 2008-12-06 18:00:10

        Pre-Run: 12.091.551.744 bytes free
        Post-Run: 12,066,054,144 bytes free

        251 --- E O F --- 2008-12-01 18:53:21
    13. noctambule28
      re,

      Lance le desintallateur de symentec, ton norton ghost ne sera pas touché

      Puis fait ceci:

      * Ouvre le bloc notes. Copie colle ceci dedans :

      File::
      c:\windows\system32\uwrqdspa.tmp
      c:\windows\JJACRBNV.exe
      c:\program files\setup.exe
      Driver::
      c:\windows\system32\drivers\3672251a
      Folder::
      c:\1815657427

      * Sauvegarde cela comme fichier texte nommé CFScript, sur le bureau.
      * Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe

      * Une fenêtre bleue va apparaître: au message qui apparaît (Type 1 to continue, or 2 to abort) , tape 1 puis valide.
      * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
      * Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
      * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
      1. cdac Auteur
        ceci n'est pas apparu,: "Une fenêtre bleue va apparaître: au message qui apparaît (Type 1 to continue, or 2 to abort) , tape 1 puis valide."
        cependant j'ai placé le fichier directement sur combofix sur le bureau et il m'a demandé de l'exécuté. celà fait j'ai un rapport. est ce bon?? voir...
        ComboFix 08-12-05.06 - sda 2008-12-07 13:52:01.2 - NTFSx86
        Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1364 [GMT 1:00]
        Running from: d:\documents and settings\sda\Desktop\ComboFix.exe
        * Resident AV is active

        .

        ((((((((((((((((((((((((( Files Created from 2008-11-07 to 2008-12-07 )))))))))))))))))))))))))))))))
        .

        2008-12-06 10:06 . 2008-12-06 13:47 <DIR> d-------- C:\SDFix
        2008-12-05 17:57 . 2008-12-05 18:10 <DIR> d-------- c:\program files\UsbFix
        2008-12-05 15:33 . 2008-12-05 21:16 <DIR> d-------- C:\ToolBar SD
        2008-12-05 15:20 . 2008-12-05 15:20 2,404,352 --a------ C:\Norton_Removal_Tool.exe
        2008-12-05 15:16 . 2008-12-05 15:16 <DIR> d-------- c:\windows\system32\Temp
        2008-12-05 13:53 . 2008-12-05 13:54 1,226,248 --a------ C:\DMSetup.exe
        2008-12-05 13:14 . 2008-12-05 13:14 552 --a------ c:\windows\system32\d3d8caps.dat
        2008-12-05 12:52 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
        2008-12-05 12:52 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
        2008-12-05 12:52 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe
        2008-12-05 12:52 . 2008-12-05 12:29 53,248 --a------ c:\windows\system32\Process.exe
        2008-12-05 12:52 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
        2008-12-05 12:52 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
        2008-12-05 12:29 . 2008-12-05 13:39 <DIR> d-------- C:\SmitfraudFix
        2008-12-05 12:19 . 2008-12-06 13:53 1,435,761 --a------ C:\SmitfraudFix.zip
        2008-12-04 20:00 . 2008-12-04 20:01 401,720 --a------ C:\HiJackThis.exe
        2008-12-01 19:41 . 2008-12-01 19:41 30,601 --a------ d:\documents and settings\sda\x.exe
        2008-12-01 18:43 . 2008-12-01 18:43 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
        2008-12-01 18:05 . 2008-12-01 18:05 <DIR> d-------- d:\documents and settings\sda\dsc
        2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\vw
        2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\VisualRoute
        2008-12-01 18:01 . 2008-12-01 20:07 <DIR> d-------- c:\program files\VisualRoute 2008
        2008-11-27 17:23 . 2008-11-27 17:23 29 --a------ c:\windows\system32\uwrqdspa.tmp
        2008-11-27 17:20 . 2008-11-27 17:20 188,416 --a------ c:\windows\JJACRBNV.exe
        2008-11-27 17:20 . 2008-12-06 16:16 0 --a------ c:\windows\system32\drivers\3672251a.sys
        2008-11-27 17:19 . 2008-11-27 17:19 2 --a------ C:\1815657427

        .
        (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-12-07 12:54 --------- d-----w d:\documents and settings\sda\Application Data\Skype
        2008-12-07 12:48 --------- d-----w d:\documents and settings\sda\Application Data\skypePM
        2008-12-07 11:36 --------- d-----w c:\program files\Common Files\Symantec Shared
        2008-12-01 19:07 --------- d-----w c:\program files\SUPERAntiSpyware
        2008-12-01 18:40 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
        2008-12-01 18:03 --------- d-----w d:\documents and settings\sda\Application Data\LimeWire
        2008-12-01 11:06 --------- d-----w c:\program files\ZikiTranslator
        2008-11-28 10:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.001\Application Data\SACore
        2008-11-27 13:27 --------- d-----w c:\program files\e-bat
        2008-11-17 12:59 --------- d-----w c:\program files\McAfee
        2008-11-12 02:07 --------- d-----w d:\documents and settings\All Users\Application Data\Microsoft Help
        2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
        2008-10-24 11:10 453,632 ----a-w c:\windows\system32\dllcache\mrxsmb.sys
        2008-10-20 16:25 --------- d-----w d:\documents and settings\sda\Application Data\Ulead Systems
        2008-10-20 10:41 --------- d-----w d:\documents and settings\sda\Application Data\Sprite Software
        2008-10-20 10:40 --------- d--h--w c:\program files\InstallShield Installation Information
        2008-10-20 10:40 --------- d-----w c:\program files\Sprite Software
        2008-10-20 10:34 --------- d-----w c:\program files\Microsoft ActiveSync
        2008-10-20 10:12 --------- d-----w c:\program files\Ressources Windows Mobile
        2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
        2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
        2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
        2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
        2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
        2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
        2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
        2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
        2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
        2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
        2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
        2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
        2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
        2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
        2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
        2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
        2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
        2008-10-15 16:57 332,800 ----a-w c:\windows\system32\dllcache\netapi32.dll
        2008-10-10 18:06 --------- d-----w c:\program files\Common Files\HP
        2008-10-10 16:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.000\Application Data\SACore
        2008-10-09 16:34 --------- d-----w c:\program files\HP
        2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
        2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
        2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
        2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\dllcache\win32k.sys
        2008-04-04 09:49 32 ----a-w d:\documents and settings\All Users\Application Data\ezsid.dat
        2007-10-30 08:54 100,680 ----a-w d:\documents and settings\sda\Application Data\GDIPFONTCACHEV1.DAT
        2007-08-01 14:48 9,644 ----a-w c:\program files\uninstal.log
        2007-06-07 10:46 81,920 ----a-w d:\documents and settings\sda\Application Data\ezpinst.exe
        2007-06-07 10:46 47,360 ----a-w d:\documents and settings\sda\Application Data\pcouffin.sys
        2005-09-09 17:55 7,155,864 ----a-w c:\program files\NGhost10.msi
        2005-09-09 17:55 4,588,454 ----a-w c:\program files\setup.exe
        2005-09-09 17:55 37,766,164 ----a-w c:\program files\Data1.cab
        2005-09-09 17:55 35 ----a-w c:\program files\SCSSDist.ini
        .

        ((((((((((((((((((((((((((((( snapshot@2008-12-06_18.58.59.67 )))))))))))))))))))))))))))))))))))))))))
        .
        - 2008-12-06 16:35:03 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
        + 2008-12-07 12:43:42 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
        - 2008-12-06 16:35:03 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
        + 2008-12-07 12:43:42 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
        - 2008-12-06 16:35:03 49,152 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
        + 2008-12-07 12:43:42 49,152 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
        .
        ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* empty entries & legit default entries are not shown
        REGEDIT4

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
        "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

        [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

        [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]
        2008-08-05 01:13 1610264 --a------ c:\program files\myBabylon\tbmyBa.dll

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
        "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
        "{34EA1C70-42CC-42C5-AA29-EC58B95A343E}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

        [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
        "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
        "Skype"="c:\apps\skype\Phone\Skype.exe" [2008-02-01 21974824]
        "feedreader.exe"="c:\program files\FeedReader30\feedreader.exe" [2007-03-16 1186304]
        "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-31 68856]
        "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
        "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
        "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
        "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
        "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
        "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-28 7573504]
        "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-04-28 86016]
        "Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]
        "DetectorApp"="c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
        "OmniPass"="c:\apps\Softex\OmniPass\scureapp.exe" [2006-01-30 1978368]
        "PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-02-23 147456]
        "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2008-06-13 1176808]
        "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-06 98304]
        "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
        "Adobe Photo Downloader"="c:\program files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]
        "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
        "IdiomaX Office"="c:\program files\IdiomaX\Office Translator 4.0\IdxOffice.exe" [2007-01-18 397872]
        "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
        "McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [2008-07-10 5129504]
        "nwiz"="nwiz.exe" [2006-04-28 c:\windows\system32\nwiz.exe]
        "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
        "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 c:\windows\RTHDCPL.exe]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

        d:\documents and settings\sda\Start Menu\Programs\Startup\
        OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

        d:\documents and settings\All Users\Start Menu\Programs\Startup\
        Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2007-06-06 49254]
        Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
        HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
        HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
        Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
        SnagIt 8.lnk - c:\program files\TechSmith\SnagIt 8\SnagIt32.exe [2007-02-06 6379080]
        Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784]

        [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
        "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
        2006-01-30 08:53 49152 c:\apps\Softex\OmniPass\OPXPGina.dll

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
        "DisableMonitoring"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
        "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
        "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
        "c:\\Program Files\\Messenger\\msmsgs.exe"=
        "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
        "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
        "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "c:\\Program Files\\eMule\\emule.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
        "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
        "c:\\Program Files\\RealVNC\\vncviewer.exe"=
        "c:\\Program Files\\RealVNC\\WinVNC\\winvnc.exe"=
        "c:\\Program Files\\McAfee\\MBK\\McAfeeDataBackup.exe"=
        "c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
        "d:\\film a graver\\emule.exe"=
        "c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
        "c:\\Program Files\\LimeWire\\LimeWire.exe"=
        "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
        "c:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
        "c:\\WINDOWS\\system32\\java.exe"=
        "d:\\Documents and Settings\\sda\\Desktop\\SymNRT.exe"=
        "c:\\APPS\\skype\\Phone\\Skype.exe"=

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
        "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
        "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
        "500:UDP"= 500:UDP:@xpsp2res.dll,-22017

        R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-10-01 203280]
        S1 3672251a;3672251a;c:\windows\system32\drivers\3672251a.sys [2008-11-27 0]
        S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2008-03-18 1527900]
        S3 ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-12-01 27904]
        S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2008-03-18 544768]
        .
        Contents of the 'Scheduled Tasks' folder

        2008-11-15 c:\windows\Tasks\McDefragTask.job
        - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

        2008-11-01 c:\windows\Tasks\McQcTask.job
        - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]
        .
        - - - - ORPHANS REMOVED - - - -

        WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

        **************************************************************************

        catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-12-07 13:54:51
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        --------------------- DLLs Loaded Under Running Processes ---------------------

        - - - - - - - > 'winlogon.exe'(576)
        c:\apps\Softex\OmniPass\opxpgina.dll
        .
        Completion time: 2008-12-07 13:57:01
        ComboFix-quarantined-files.txt 2008-12-07 12:56:37
        ComboFix2.txt 2008-12-06 18:00:10

        Pre-Run: 12.135.178.240 bytes free
        Post-Run: 12,112,945,152 bytes free

        234 --- E O F --- 2008-12-01 18:53:21
      2. cdac Auteur
        ceci n'est pas apparu,: "Une fenêtre bleue va apparaître: au message qui apparaît (Type 1 to continue, or 2 to abort) , tape 1 puis valide."
        cependant j'ai placé le fichier directement sur combofix sur le bureau et il m'a demandé de l'exécuté. celà fait j'ai un rapport. est ce bon?? voir...
        ComboFix 08-12-05.06 - sda 2008-12-07 13:52:01.2 - NTFSx86
        Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1364 [GMT 1:00]
        Running from: d:\documents and settings\sda\Desktop\ComboFix.exe
        * Resident AV is active

        .

        ((((((((((((((((((((((((( Files Created from 2008-11-07 to 2008-12-07 )))))))))))))))))))))))))))))))
        .

        2008-12-06 10:06 . 2008-12-06 13:47 <DIR> d-------- C:\SDFix
        2008-12-05 17:57 . 2008-12-05 18:10 <DIR> d-------- c:\program files\UsbFix
        2008-12-05 15:33 . 2008-12-05 21:16 <DIR> d-------- C:\ToolBar SD
        2008-12-05 15:20 . 2008-12-05 15:20 2,404,352 --a------ C:\Norton_Removal_Tool.exe
        2008-12-05 15:16 . 2008-12-05 15:16 <DIR> d-------- c:\windows\system32\Temp
        2008-12-05 13:53 . 2008-12-05 13:54 1,226,248 --a------ C:\DMSetup.exe
        2008-12-05 13:14 . 2008-12-05 13:14 552 --a------ c:\windows\system32\d3d8caps.dat
        2008-12-05 12:52 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
        2008-12-05 12:52 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
        2008-12-05 12:52 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe
        2008-12-05 12:52 . 2008-12-05 12:29 53,248 --a------ c:\windows\system32\Process.exe
        2008-12-05 12:52 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
        2008-12-05 12:52 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
        2008-12-05 12:29 . 2008-12-05 13:39 <DIR> d-------- C:\SmitfraudFix
        2008-12-05 12:19 . 2008-12-06 13:53 1,435,761 --a------ C:\SmitfraudFix.zip
        2008-12-04 20:00 . 2008-12-04 20:01 401,720 --a------ C:\HiJackThis.exe
        2008-12-01 19:41 . 2008-12-01 19:41 30,601 --a------ d:\documents and settings\sda\x.exe
        2008-12-01 18:43 . 2008-12-01 18:43 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
        2008-12-01 18:05 . 2008-12-01 18:05 <DIR> d-------- d:\documents and settings\sda\dsc
        2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\vw
        2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\VisualRoute
        2008-12-01 18:01 . 2008-12-01 20:07 <DIR> d-------- c:\program files\VisualRoute 2008
        2008-11-27 17:23 . 2008-11-27 17:23 29 --a------ c:\windows\system32\uwrqdspa.tmp
        2008-11-27 17:20 . 2008-11-27 17:20 188,416 --a------ c:\windows\JJACRBNV.exe
        2008-11-27 17:20 . 2008-12-06 16:16 0 --a------ c:\windows\system32\drivers\3672251a.sys
        2008-11-27 17:19 . 2008-11-27 17:19 2 --a------ C:\1815657427

        .
        (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-12-07 12:54 --------- d-----w d:\documents and settings\sda\Application Data\Skype
        2008-12-07 12:48 --------- d-----w d:\documents and settings\sda\Application Data\skypePM
        2008-12-07 11:36 --------- d-----w c:\program files\Common Files\Symantec Shared
        2008-12-01 19:07 --------- d-----w c:\program files\SUPERAntiSpyware
        2008-12-01 18:40 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
        2008-12-01 18:03 --------- d-----w d:\documents and settings\sda\Application Data\LimeWire
        2008-12-01 11:06 --------- d-----w c:\program files\ZikiTranslator
        2008-11-28 10:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.001\Application Data\SACore
        2008-11-27 13:27 --------- d-----w c:\program files\e-bat
        2008-11-17 12:59 --------- d-----w c:\program files\McAfee
        2008-11-12 02:07 --------- d-----w d:\documents and settings\All Users\Application Data\Microsoft Help
        2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
        2008-10-24 11:10 453,632 ----a-w c:\windows\system32\dllcache\mrxsmb.sys
        2008-10-20 16:25 --------- d-----w d:\documents and settings\sda\Application Data\Ulead Systems
        2008-10-20 10:41 --------- d-----w d:\documents and settings\sda\Application Data\Sprite Software
        2008-10-20 10:40 --------- d--h--w c:\program files\InstallShield Installation Information
        2008-10-20 10:40 --------- d-----w c:\program files\Sprite Software
        2008-10-20 10:34 --------- d-----w c:\program files\Microsoft ActiveSync
        2008-10-20 10:12 --------- d-----w c:\program files\Ressources Windows Mobile
        2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
        2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
        2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
        2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
        2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
        2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
        2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
        2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
        2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
        2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
        2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
        2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
        2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
        2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
        2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
        2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
        2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
        2008-10-15 16:57 332,800 ----a-w c:\windows\system32\dllcache\netapi32.dll
        2008-10-10 18:06 --------- d-----w c:\program files\Common Files\HP
        2008-10-10 16:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.000\Application Data\SACore
        2008-10-09 16:34 --------- d-----w c:\program files\HP
        2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
        2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
        2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
        2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\dllcache\win32k.sys
        2008-04-04 09:49 32 ----a-w d:\documents and settings\All Users\Application Data\ezsid.dat
        2007-10-30 08:54 100,680 ----a-w d:\documents and settings\sda\Application Data\GDIPFONTCACHEV1.DAT
        2007-08-01 14:48 9,644 ----a-w c:\program files\uninstal.log
        2007-06-07 10:46 81,920 ----a-w d:\documents and settings\sda\Application Data\ezpinst.exe
        2007-06-07 10:46 47,360 ----a-w d:\documents and settings\sda\Application Data\pcouffin.sys
        2005-09-09 17:55 7,155,864 ----a-w c:\program files\NGhost10.msi
        2005-09-09 17:55 4,588,454 ----a-w c:\program files\setup.exe
        2005-09-09 17:55 37,766,164 ----a-w c:\program files\Data1.cab
        2005-09-09 17:55 35 ----a-w c:\program files\SCSSDist.ini
        .

        ((((((((((((((((((((((((((((( snapshot@2008-12-06_18.58.59.67 )))))))))))))))))))))))))))))))))))))))))
        .
        - 2008-12-06 16:35:03 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
        + 2008-12-07 12:43:42 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
        - 2008-12-06 16:35:03 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
        + 2008-12-07 12:43:42 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
        - 2008-12-06 16:35:03 49,152 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
        + 2008-12-07 12:43:42 49,152 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
        .
        ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* empty entries & legit default entries are not shown
        REGEDIT4

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
        "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

        [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

        [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]
        2008-08-05 01:13 1610264 --a------ c:\program files\myBabylon\tbmyBa.dll

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
        "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
        "{34EA1C70-42CC-42C5-AA29-EC58B95A343E}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

        [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
        "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
        "Skype"="c:\apps\skype\Phone\Skype.exe" [2008-02-01 21974824]
        "feedreader.exe"="c:\program files\FeedReader30\feedreader.exe" [2007-03-16 1186304]
        "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-31 68856]
        "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
        "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
        "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
        "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
        "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
        "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-28 7573504]
        "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-04-28 86016]
        "Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]
        "DetectorApp"="c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
        "OmniPass"="c:\apps\Softex\OmniPass\scureapp.exe" [2006-01-30 1978368]
        "PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-02-23 147456]
        "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2008-06-13 1176808]
        "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-06 98304]
        "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
        "Adobe Photo Downloader"="c:\program files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]
        "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
        "IdiomaX Office"="c:\program files\IdiomaX\Office Translator 4.0\IdxOffice.exe" [2007-01-18 397872]
        "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
        "McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [2008-07-10 5129504]
        "nwiz"="nwiz.exe" [2006-04-28 c:\windows\system32\nwiz.exe]
        "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
        "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 c:\windows\RTHDCPL.exe]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

        d:\documents and settings\sda\Start Menu\Programs\Startup\
        OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

        d:\documents and settings\All Users\Start Menu\Programs\Startup\
        Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2007-06-06 49254]
        Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
        HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
        HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
        Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
        SnagIt 8.lnk - c:\program files\TechSmith\SnagIt 8\SnagIt32.exe [2007-02-06 6379080]
        Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784]

        [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
        "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
        2006-01-30 08:53 49152 c:\apps\Softex\OmniPass\OPXPGina.dll

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
        "DisableMonitoring"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
        "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
        "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
        "c:\\Program Files\\Messenger\\msmsgs.exe"=
        "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
        "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
        "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
        "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "c:\\Program Files\\eMule\\emule.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
        "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
        "c:\\Program Files\\RealVNC\\vncviewer.exe"=
        "c:\\Program Files\\RealVNC\\WinVNC\\winvnc.exe"=
        "c:\\Program Files\\McAfee\\MBK\\McAfeeDataBackup.exe"=
        "c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
        "d:\\film a graver\\emule.exe"=
        "c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
        "c:\\Program Files\\LimeWire\\LimeWire.exe"=
        "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
        "c:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
        "c:\\WINDOWS\\system32\\java.exe"=
        "d:\\Documents and Settings\\sda\\Desktop\\SymNRT.exe"=
        "c:\\APPS\\skype\\Phone\\Skype.exe"=

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
        "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
        "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
        "500:UDP"= 500:UDP:@xpsp2res.dll,-22017

        R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-10-01 203280]
        S1 3672251a;3672251a;c:\windows\system32\drivers\3672251a.sys [2008-11-27 0]
        S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2008-03-18 1527900]
        S3 ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-12-01 27904]
        S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2008-03-18 544768]
        .
        Contents of the 'Scheduled Tasks' folder

        2008-11-15 c:\windows\Tasks\McDefragTask.job
        - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

        2008-11-01 c:\windows\Tasks\McQcTask.job
        - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]
        .
        - - - - ORPHANS REMOVED - - - -

        WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

        **************************************************************************

        catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-12-07 13:54:51
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        --------------------- DLLs Loaded Under Running Processes ---------------------

        - - - - - - - > 'winlogon.exe'(576)
        c:\apps\Softex\OmniPass\opxpgina.dll
        .
        Completion time: 2008-12-07 13:57:01
        ComboFix-quarantined-files.txt 2008-12-07 12:56:37
        ComboFix2.txt 2008-12-06 18:00:10

        Pre-Run: 12.135.178.240 bytes free
        Post-Run: 12,112,945,152 bytes free

        234 --- E O F --- 2008-12-01 18:53:21
    14. Utilisateur anonyme
      Re,

      j'ai fait ce que tu m'as demandé. cependant je ne trouve pas ce fichier ,

      C'est parce qu'il ne reste que la clé alors.

      Suis les conseils de noctambule stp.

      Bon chasse :)
      1. Utilisateur anonyme
        Salut vous deux,

        cdac, peux tu faire ceci stp :

        > Rend toi sur ce site : http://secubox.gateweb.fr/mad.php
        - Clic sur parcourir et dépose ce fichier :

        C:\WINDOWS\system32\kdwzh.exe

        - Poste en temps que commentaire dans Veuillez indiquer ci-dessous le message destiné à notre équipe: le texte en italique suivant (fais un copier/coller) :

        Bonjour,
        Sur la discussion suivante : http://www.commentcamarche.net/forum/affich 9748094 infostealer des informations sont susceptibles de vous intéresser (notamment S!Ri).
        J'espère qu'elles vous seront utiles dans votre lutte antimalwares.
        Merci
        DllD

        Dis le nous quand tu l'auras fait stp.

        Bon courage pour la suite.

        Merci.
        1. cdac Auteur
          j'ai fait ce que tu m'as demandé. cependant je ne trouve pas ce fichier
          C:\WINDOWS\system32\kdwzh.exe
          suivant conseil de noctembule voici le dernier rapport
          ComboFix 08-12-05.06 - sda 2008-12-06 17:28:09.1 - NTFSx86
          Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1238 [GMT 1:00]
          Running from: d:\documents and settings\sda\Desktop\ComboFix.exe
          * Created a new restore point
          * Resident AV is active

          .

          ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
          .

          c:\windows\system32\drivers\qtoprtuq.sys

          .
          ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
          .

          -------\Legacy_qtoprtuq
          -------\Service_qtoprtuq

          ((((((((((((((((((((((((( Files Created from 2008-11-06 to 2008-12-06 )))))))))))))))))))))))))))))))
          .

          2008-12-06 10:06 . 2008-12-06 13:47 <DIR> d-------- C:\SDFix
          2008-12-05 17:57 . 2008-12-05 18:10 <DIR> d-------- c:\program files\UsbFix
          2008-12-05 15:33 . 2008-12-05 21:16 <DIR> d-------- C:\ToolBar SD
          2008-12-05 15:20 . 2008-12-05 15:20 2,404,352 --a------ C:\Norton_Removal_Tool.exe
          2008-12-05 15:16 . 2008-12-05 15:16 <DIR> d-------- c:\windows\system32\Temp
          2008-12-05 13:53 . 2008-12-05 13:54 1,226,248 --a------ C:\DMSetup.exe
          2008-12-05 13:14 . 2008-12-05 13:14 552 --a------ c:\windows\system32\d3d8caps.dat
          2008-12-05 12:52 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
          2008-12-05 12:52 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
          2008-12-05 12:52 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe
          2008-12-05 12:52 . 2008-12-05 12:29 53,248 --a------ c:\windows\system32\Process.exe
          2008-12-05 12:52 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
          2008-12-05 12:52 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
          2008-12-05 12:29 . 2008-12-05 13:39 <DIR> d-------- C:\SmitfraudFix
          2008-12-05 12:19 . 2008-12-06 13:53 1,435,761 --a------ C:\SmitfraudFix.zip
          2008-12-04 20:00 . 2008-12-04 20:01 401,720 --a------ C:\HiJackThis.exe
          2008-12-01 19:41 . 2008-12-01 19:41 30,601 --a------ d:\documents and settings\sda\x.exe
          2008-12-01 18:43 . 2008-12-01 18:43 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
          2008-12-01 18:05 . 2008-12-01 18:05 <DIR> d-------- d:\documents and settings\sda\dsc
          2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\vw
          2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\VisualRoute
          2008-12-01 18:01 . 2008-12-01 20:07 <DIR> d-------- c:\program files\VisualRoute 2008
          2008-11-27 17:23 . 2008-11-27 17:23 29 --a------ c:\windows\system32\uwrqdspa.tmp
          2008-11-27 17:20 . 2008-11-27 17:20 188,416 --a------ c:\windows\JJACRBNV.exe
          2008-11-27 17:20 . 2008-12-06 16:16 0 --a------ c:\windows\system32\drivers\3672251a.sys
          2008-11-27 17:19 . 2008-11-27 17:19 2 --a------ C:\1815657427

          .
          (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-12-06 17:56 --------- d-----w d:\documents and settings\sda\Application Data\Skype
          2008-12-06 17:55 --------- d-----w d:\documents and settings\sda\Application Data\skypePM
          2008-12-01 19:07 --------- d-----w c:\program files\SUPERAntiSpyware
          2008-12-01 18:40 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
          2008-12-01 18:03 --------- d-----w d:\documents and settings\sda\Application Data\LimeWire
          2008-12-01 11:06 --------- d-----w c:\program files\ZikiTranslator
          2008-11-28 10:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.001\Application Data\SACore
          2008-11-27 13:27 --------- d-----w c:\program files\e-bat
          2008-11-17 12:59 --------- d-----w c:\program files\McAfee
          2008-11-12 02:07 --------- d-----w d:\documents and settings\All Users\Application Data\Microsoft Help
          2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
          2008-10-24 11:10 453,632 ----a-w c:\windows\system32\dllcache\mrxsmb.sys
          2008-10-20 16:25 --------- d-----w d:\documents and settings\sda\Application Data\Ulead Systems
          2008-10-20 10:41 --------- d-----w d:\documents and settings\sda\Application Data\Sprite Software
          2008-10-20 10:40 --------- d--h--w c:\program files\InstallShield Installation Information
          2008-10-20 10:40 --------- d-----w c:\program files\Sprite Software
          2008-10-20 10:34 --------- d-----w c:\program files\Microsoft ActiveSync
          2008-10-20 10:12 --------- d-----w c:\program files\Ressources Windows Mobile
          2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
          2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
          2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
          2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
          2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
          2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
          2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
          2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
          2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
          2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
          2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
          2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
          2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
          2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
          2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
          2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
          2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
          2008-10-15 16:57 332,800 ----a-w c:\windows\system32\dllcache\netapi32.dll
          2008-10-10 18:06 --------- d-----w c:\program files\Common Files\HP
          2008-10-10 18:04 --------- d-----w c:\program files\Common Files\Symantec Shared
          2008-10-10 16:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.000\Application Data\SACore
          2008-10-09 16:34 --------- d-----w c:\program files\HP
          2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
          2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
          2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
          2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\dllcache\win32k.sys
          2008-04-04 09:49 32 ----a-w d:\documents and settings\All Users\Application Data\ezsid.dat
          2007-10-30 08:54 100,680 ----a-w d:\documents and settings\sda\Application Data\GDIPFONTCACHEV1.DAT
          2007-08-01 14:48 9,644 ----a-w c:\program files\uninstal.log
          2007-06-07 10:46 81,920 ----a-w d:\documents and settings\sda\Application Data\ezpinst.exe
          2007-06-07 10:46 47,360 ----a-w d:\documents and settings\sda\Application Data\pcouffin.sys
          2005-09-09 17:55 7,155,864 ----a-w c:\program files\NGhost10.msi
          2005-09-09 17:55 4,588,454 ----a-w c:\program files\setup.exe
          2005-09-09 17:55 37,766,164 ----a-w c:\program files\Data1.cab
          2005-09-09 17:55 35 ----a-w c:\program files\SCSSDist.ini
          .

          ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          *Note* empty entries & legit default entries are not shown
          REGEDIT4

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
          "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

          [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]
          2008-08-05 01:13 1610264 --a------ c:\program files\myBabylon\tbmyBa.dll

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
          "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
          "{34EA1C70-42CC-42C5-AA29-EC58B95A343E}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

          [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
          "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
          "Skype"="c:\apps\skype\Phone\Skype.exe" [2008-02-01 21974824]
          "feedreader.exe"="c:\program files\FeedReader30\feedreader.exe" [2007-03-16 1186304]
          "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-31 68856]
          "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
          "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
          "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
          "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
          "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
          "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-28 7573504]
          "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-04-28 86016]
          "Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]
          "DetectorApp"="c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
          "OmniPass"="c:\apps\Softex\OmniPass\scureapp.exe" [2006-01-30 1978368]
          "PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-02-23 147456]
          "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2008-06-13 1176808]
          "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-06 98304]
          "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
          "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 58992]
          "Norton Ghost 10.0"="c:\program files\Norton Ghost\Agent\GhostTray.exe" [2005-09-09 1537648]
          "Adobe Photo Downloader"="c:\program files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]
          "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
          "IdiomaX Office"="c:\program files\IdiomaX\Office Translator 4.0\IdxOffice.exe" [2007-01-18 397872]
          "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
          "McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [2008-07-10 5129504]
          "nwiz"="nwiz.exe" [2006-04-28 c:\windows\system32\nwiz.exe]
          "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
          "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 c:\windows\RTHDCPL.exe]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

          d:\documents and settings\sda\Start Menu\Programs\Startup\
          OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

          d:\documents and settings\All Users\Start Menu\Programs\Startup\
          Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2007-06-06 49254]
          Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
          HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
          HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
          Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
          SnagIt 8.lnk - c:\program files\TechSmith\SnagIt 8\SnagIt32.exe [2007-02-06 6379080]
          Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784]

          [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
          "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
          2006-01-30 08:53 49152 c:\apps\Softex\OmniPass\OPXPGina.dll

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
          "vidc.I420"= vdrcodec.dll
          "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
          "msacm.mpegacm"= mpegacm.acm
          "msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm
          "msacm.mpegacm "= c:\progra~1\COMMON~1\ULEADS~1\MPEG\mpegacm.acm
          "VIDC.MJPG"= Pvmjpg30.dll

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
          "DisableMonitoring"=dword:00000001

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
          "%windir%\\system32\\sessmgr.exe"=
          "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
          "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
          "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
          "c:\\Program Files\\Messenger\\msmsgs.exe"=
          "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
          "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
          "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
          "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
          "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
          "c:\\Program Files\\eMule\\emule.exe"=
          "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
          "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
          "c:\\Program Files\\RealVNC\\vncviewer.exe"=
          "c:\\Program Files\\RealVNC\\WinVNC\\winvnc.exe"=
          "c:\\Program Files\\McAfee\\MBK\\McAfeeDataBackup.exe"=
          "c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
          "d:\\film a graver\\emule.exe"=
          "c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
          "c:\\Program Files\\LimeWire\\LimeWire.exe"=
          "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
          "c:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
          "c:\\WINDOWS\\system32\\java.exe"=
          "d:\\Documents and Settings\\sda\\Desktop\\SymNRT.exe"=
          "c:\\APPS\\skype\\Phone\\Skype.exe"=

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
          "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
          "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
          "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
          "500:UDP"= 500:UDP:@xpsp2res.dll,-22017

          R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-10-01 203280]
          S1 3672251a;3672251a;c:\windows\system32\drivers\3672251a.sys [2008-11-27 0]
          S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2008-03-18 1527900]
          S3 ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-12-01 27904]
          S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2008-03-18 544768]
          .
          Contents of the 'Scheduled Tasks' folder

          2008-11-15 c:\windows\Tasks\McDefragTask.job
          - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

          2008-11-01 c:\windows\Tasks\McQcTask.job
          - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]
          .
          - - - - ORPHANS REMOVED - - - -

          WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
          HKCU-Run-msiexec.exe - msiconf.exe
          HKLM-Run-ISUSPM Startup - c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
          HKLM-Run-ISUSScheduler - c:\program files\Common Files\InstallShield\UpdateService\issch.exe
          HKLM-Run-HP Update Assistant - c:\windows\system32\HPAware.exe
          HKLM-Run-c:\windows\system32\kdwzh.exe - c:\windows\system32\kdwzh.exe
          Notify-dimsntfy - (no file)

          **************************************************************************

          catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-12-06 18:54:01
          Windows 5.1.2600 Service Pack 2 NTFS

          scanning hidden processes ...

          scanning hidden autostart entries ...

          scanning hidden files ...

          scan completed successfully
          hidden files: 0

          **************************************************************************
          .
          --------------------- DLLs Loaded Under Running Processes ---------------------

          - - - - - - - > 'winlogon.exe'(660)
          c:\apps\Softex\OmniPass\opxpgina.dll
          .
          ------------------------ Other Running Processes ------------------------
          .
          c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
          c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
          c:\program files\Bonjour\mDNSResponder.exe
          c:\windows\system32\drivers\CDAC11BA.EXE
          c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe
          c:\apps\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
          c:\windows\system32\gearsec.exe
          c:\program files\Nero\Nero8\InCD\InCDsrv.exe
          c:\progra~1\McAfee\MSC\mcmscsvc.exe
          c:\program files\Common Files\McAfee\MNA\McNASvc.exe
          c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
          c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
          c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
          c:\program files\McAfee\MPF\MpfSrv.exe
          c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
          c:\program files\Norton Ghost\Agent\VProSvc.exe
          c:\windows\system32\nvsvc32.exe
          c:\apps\Softex\OmniPass\OmniServ.exe
          c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
          c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
          c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
          c:\program files\RealVNC\WinVNC\winvnc.exe
          c:\windows\system32\searchindexer.exe
          c:\apps\Powercinema\Kernel\TV\CLSched.exe
          c:\apps\Softex\OmniPass\OPXPApp.exe
          c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
          c:\progra~1\McAfee.com\Agent\mcagent.exe
          c:\progra~1\McAfee\VIRUSS~1\mcvsshld.exe
          c:\windows\system32\rundll32.exe
          c:\progra~1\MICROS~4\rapimgr.exe
          c:\apps\skype\Plugin Manager\skypePM.exe
          c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
          c:\program files\TechSmith\SnagIt 8\TscHelp.exe
          c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
          c:\program files\TechSmith\SnagIt 8\SnagPriv.exe
          c:\windows\system32\searchprotocolhost.exe
          c:\windows\system32\searchfilterhost.exe
          .
          **************************************************************************
          .
          Completion time: 2008-12-06 19:00:04 - machine was rebooted [sda]
          ComboFix-quarantined-files.txt 2008-12-06 17:59:53

          Pre-Run: 12.217.450.496 bytes free
          Post-Run: 12,111,077,376 bytes free

          290 --- E O F --- 2008-12-01 18:53:21
        2. cdac Auteur
          j'ai fait ce que tu m'as demandé. cependant je ne trouve pas ce fichier
          C:\WINDOWS\system32\kdwzh.exe
          suivant conseil de noctembule voici le dernier rapport
          ComboFix 08-12-05.06 - sda 2008-12-06 17:28:09.1 - NTFSx86
          Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1238 [GMT 1:00]
          Running from: d:\documents and settings\sda\Desktop\ComboFix.exe
          * Created a new restore point
          * Resident AV is active

          .

          ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
          .

          c:\windows\system32\drivers\qtoprtuq.sys

          .
          ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
          .

          -------\Legacy_qtoprtuq
          -------\Service_qtoprtuq

          ((((((((((((((((((((((((( Files Created from 2008-11-06 to 2008-12-06 )))))))))))))))))))))))))))))))
          .

          2008-12-06 10:06 . 2008-12-06 13:47 <DIR> d-------- C:\SDFix
          2008-12-05 17:57 . 2008-12-05 18:10 <DIR> d-------- c:\program files\UsbFix
          2008-12-05 15:33 . 2008-12-05 21:16 <DIR> d-------- C:\ToolBar SD
          2008-12-05 15:20 . 2008-12-05 15:20 2,404,352 --a------ C:\Norton_Removal_Tool.exe
          2008-12-05 15:16 . 2008-12-05 15:16 <DIR> d-------- c:\windows\system32\Temp
          2008-12-05 13:53 . 2008-12-05 13:54 1,226,248 --a------ C:\DMSetup.exe
          2008-12-05 13:14 . 2008-12-05 13:14 552 --a------ c:\windows\system32\d3d8caps.dat
          2008-12-05 12:52 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
          2008-12-05 12:52 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
          2008-12-05 12:52 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe
          2008-12-05 12:52 . 2008-12-05 12:29 53,248 --a------ c:\windows\system32\Process.exe
          2008-12-05 12:52 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
          2008-12-05 12:52 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
          2008-12-05 12:29 . 2008-12-05 13:39 <DIR> d-------- C:\SmitfraudFix
          2008-12-05 12:19 . 2008-12-06 13:53 1,435,761 --a------ C:\SmitfraudFix.zip
          2008-12-04 20:00 . 2008-12-04 20:01 401,720 --a------ C:\HiJackThis.exe
          2008-12-01 19:41 . 2008-12-01 19:41 30,601 --a------ d:\documents and settings\sda\x.exe
          2008-12-01 18:43 . 2008-12-01 18:43 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
          2008-12-01 18:05 . 2008-12-01 18:05 <DIR> d-------- d:\documents and settings\sda\dsc
          2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\vw
          2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\VisualRoute
          2008-12-01 18:01 . 2008-12-01 20:07 <DIR> d-------- c:\program files\VisualRoute 2008
          2008-11-27 17:23 . 2008-11-27 17:23 29 --a------ c:\windows\system32\uwrqdspa.tmp
          2008-11-27 17:20 . 2008-11-27 17:20 188,416 --a------ c:\windows\JJACRBNV.exe
          2008-11-27 17:20 . 2008-12-06 16:16 0 --a------ c:\windows\system32\drivers\3672251a.sys
          2008-11-27 17:19 . 2008-11-27 17:19 2 --a------ C:\1815657427

          .
          (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-12-06 17:56 --------- d-----w d:\documents and settings\sda\Application Data\Skype
          2008-12-06 17:55 --------- d-----w d:\documents and settings\sda\Application Data\skypePM
          2008-12-01 19:07 --------- d-----w c:\program files\SUPERAntiSpyware
          2008-12-01 18:40 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
          2008-12-01 18:03 --------- d-----w d:\documents and settings\sda\Application Data\LimeWire
          2008-12-01 11:06 --------- d-----w c:\program files\ZikiTranslator
          2008-11-28 10:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.001\Application Data\SACore
          2008-11-27 13:27 --------- d-----w c:\program files\e-bat
          2008-11-17 12:59 --------- d-----w c:\program files\McAfee
          2008-11-12 02:07 --------- d-----w d:\documents and settings\All Users\Application Data\Microsoft Help
          2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
          2008-10-24 11:10 453,632 ----a-w c:\windows\system32\dllcache\mrxsmb.sys
          2008-10-20 16:25 --------- d-----w d:\documents and settings\sda\Application Data\Ulead Systems
          2008-10-20 10:41 --------- d-----w d:\documents and settings\sda\Application Data\Sprite Software
          2008-10-20 10:40 --------- d--h--w c:\program files\InstallShield Installation Information
          2008-10-20 10:40 --------- d-----w c:\program files\Sprite Software
          2008-10-20 10:34 --------- d-----w c:\program files\Microsoft ActiveSync
          2008-10-20 10:12 --------- d-----w c:\program files\Ressources Windows Mobile
          2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
          2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
          2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
          2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
          2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
          2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
          2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
          2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
          2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
          2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
          2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
          2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
          2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
          2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
          2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
          2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
          2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
          2008-10-15 16:57 332,800 ----a-w c:\windows\system32\dllcache\netapi32.dll
          2008-10-10 18:06 --------- d-----w c:\program files\Common Files\HP
          2008-10-10 18:04 --------- d-----w c:\program files\Common Files\Symantec Shared
          2008-10-10 16:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.000\Application Data\SACore
          2008-10-09 16:34 --------- d-----w c:\program files\HP
          2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
          2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
          2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
          2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\dllcache\win32k.sys
          2008-04-04 09:49 32 ----a-w d:\documents and settings\All Users\Application Data\ezsid.dat
          2007-10-30 08:54 100,680 ----a-w d:\documents and settings\sda\Application Data\GDIPFONTCACHEV1.DAT
          2007-08-01 14:48 9,644 ----a-w c:\program files\uninstal.log
          2007-06-07 10:46 81,920 ----a-w d:\documents and settings\sda\Application Data\ezpinst.exe
          2007-06-07 10:46 47,360 ----a-w d:\documents and settings\sda\Application Data\pcouffin.sys
          2005-09-09 17:55 7,155,864 ----a-w c:\program files\NGhost10.msi
          2005-09-09 17:55 4,588,454 ----a-w c:\program files\setup.exe
          2005-09-09 17:55 37,766,164 ----a-w c:\program files\Data1.cab
          2005-09-09 17:55 35 ----a-w c:\program files\SCSSDist.ini
          .

          ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          *Note* empty entries & legit default entries are not shown
          REGEDIT4

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
          "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

          [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]
          2008-08-05 01:13 1610264 --a------ c:\program files\myBabylon\tbmyBa.dll

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
          "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
          "{34EA1C70-42CC-42C5-AA29-EC58B95A343E}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

          [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
          "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
          "Skype"="c:\apps\skype\Phone\Skype.exe" [2008-02-01 21974824]
          "feedreader.exe"="c:\program files\FeedReader30\feedreader.exe" [2007-03-16 1186304]
          "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-31 68856]
          "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
          "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
          "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
          "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
          "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
          "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-28 7573504]
          "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-04-28 86016]
          "Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]
          "DetectorApp"="c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
          "OmniPass"="c:\apps\Softex\OmniPass\scureapp.exe" [2006-01-30 1978368]
          "PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-02-23 147456]
          "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2008-06-13 1176808]
          "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-06 98304]
          "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
          "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 58992]
          "Norton Ghost 10.0"="c:\program files\Norton Ghost\Agent\GhostTray.exe" [2005-09-09 1537648]
          "Adobe Photo Downloader"="c:\program files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]
          "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
          "IdiomaX Office"="c:\program files\IdiomaX\Office Translator 4.0\IdxOffice.exe" [2007-01-18 397872]
          "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
          "McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [2008-07-10 5129504]
          "nwiz"="nwiz.exe" [2006-04-28 c:\windows\system32\nwiz.exe]
          "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
          "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 c:\windows\RTHDCPL.exe]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

          d:\documents and settings\sda\Start Menu\Programs\Startup\
          OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

          d:\documents and settings\All Users\Start Menu\Programs\Startup\
          Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2007-06-06 49254]
          Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
          HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
          HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
          Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
          SnagIt 8.lnk - c:\program files\TechSmith\SnagIt 8\SnagIt32.exe [2007-02-06 6379080]
          Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784]

          [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
          "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
          2006-01-30 08:53 49152 c:\apps\Softex\OmniPass\OPXPGina.dll

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
          "vidc.I420"= vdrcodec.dll
          "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
          "msacm.mpegacm"= mpegacm.acm
          "msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm
          "msacm.mpegacm "= c:\progra~1\COMMON~1\ULEADS~1\MPEG\mpegacm.acm
          "VIDC.MJPG"= Pvmjpg30.dll

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
          "DisableMonitoring"=dword:00000001

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
          "%windir%\\system32\\sessmgr.exe"=
          "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
          "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
          "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
          "c:\\Program Files\\Messenger\\msmsgs.exe"=
          "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
          "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
          "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
          "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
          "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
          "c:\\Program Files\\eMule\\emule.exe"=
          "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
          "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
          "c:\\Program Files\\RealVNC\\vncviewer.exe"=
          "c:\\Program Files\\RealVNC\\WinVNC\\winvnc.exe"=
          "c:\\Program Files\\McAfee\\MBK\\McAfeeDataBackup.exe"=
          "c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
          "d:\\film a graver\\emule.exe"=
          "c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
          "c:\\Program Files\\LimeWire\\LimeWire.exe"=
          "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
          "c:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
          "c:\\WINDOWS\\system32\\java.exe"=
          "d:\\Documents and Settings\\sda\\Desktop\\SymNRT.exe"=
          "c:\\APPS\\skype\\Phone\\Skype.exe"=

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
          "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
          "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
          "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
          "500:UDP"= 500:UDP:@xpsp2res.dll,-22017

          R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-10-01 203280]
          S1 3672251a;3672251a;c:\windows\system32\drivers\3672251a.sys [2008-11-27 0]
          S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2008-03-18 1527900]
          S3 ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-12-01 27904]
          S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2008-03-18 544768]
          .
          Contents of the 'Scheduled Tasks' folder

          2008-11-15 c:\windows\Tasks\McDefragTask.job
          - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

          2008-11-01 c:\windows\Tasks\McQcTask.job
          - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]
          .
          - - - - ORPHANS REMOVED - - - -

          WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
          HKCU-Run-msiexec.exe - msiconf.exe
          HKLM-Run-ISUSPM Startup - c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
          HKLM-Run-ISUSScheduler - c:\program files\Common Files\InstallShield\UpdateService\issch.exe
          HKLM-Run-HP Update Assistant - c:\windows\system32\HPAware.exe
          HKLM-Run-c:\windows\system32\kdwzh.exe - c:\windows\system32\kdwzh.exe
          Notify-dimsntfy - (no file)

          **************************************************************************

          catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-12-06 18:54:01
          Windows 5.1.2600 Service Pack 2 NTFS

          scanning hidden processes ...

          scanning hidden autostart entries ...

          scanning hidden files ...

          scan completed successfully
          hidden files: 0

          **************************************************************************
          .
          --------------------- DLLs Loaded Under Running Processes ---------------------

          - - - - - - - > 'winlogon.exe'(660)
          c:\apps\Softex\OmniPass\opxpgina.dll
          .
          ------------------------ Other Running Processes ------------------------
          .
          c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
          c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
          c:\program files\Bonjour\mDNSResponder.exe
          c:\windows\system32\drivers\CDAC11BA.EXE
          c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe
          c:\apps\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
          c:\windows\system32\gearsec.exe
          c:\program files\Nero\Nero8\InCD\InCDsrv.exe
          c:\progra~1\McAfee\MSC\mcmscsvc.exe
          c:\program files\Common Files\McAfee\MNA\McNASvc.exe
          c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
          c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
          c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
          c:\program files\McAfee\MPF\MpfSrv.exe
          c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
          c:\program files\Norton Ghost\Agent\VProSvc.exe
          c:\windows\system32\nvsvc32.exe
          c:\apps\Softex\OmniPass\OmniServ.exe
          c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
          c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
          c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
          c:\program files\RealVNC\WinVNC\winvnc.exe
          c:\windows\system32\searchindexer.exe
          c:\apps\Powercinema\Kernel\TV\CLSched.exe
          c:\apps\Softex\OmniPass\OPXPApp.exe
          c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
          c:\progra~1\McAfee.com\Agent\mcagent.exe
          c:\progra~1\McAfee\VIRUSS~1\mcvsshld.exe
          c:\windows\system32\rundll32.exe
          c:\progra~1\MICROS~4\rapimgr.exe
          c:\apps\skype\Plugin Manager\skypePM.exe
          c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
          c:\program files\TechSmith\SnagIt 8\TscHelp.exe
          c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
          c:\program files\TechSmith\SnagIt 8\SnagPriv.exe
          c:\windows\system32\searchprotocolhost.exe
          c:\windows\system32\searchfilterhost.exe
          .
          **************************************************************************
          .
          Completion time: 2008-12-06 19:00:04 - machine was rebooted [sda]
          ComboFix-quarantined-files.txt 2008-12-06 17:59:53

          Pre-Run: 12.217.450.496 bytes free
          Post-Run: 12,111,077,376 bytes free

          290 --- E O F --- 2008-12-01 18:53:21
        3. cdac
          crois pas que noctambule est branché...
          Peux tu m'aider en retournant en arrière et voir ce qui cloche.
          J'ai redemearer mon pc pour conclure l'effacement d'un prog malware et mainteant mon pc ne revient pas sur le bureau. je sais faire F5 ou F8, mais là je ne sais quoi choisir.
      2. noctambule28
        tu peux afficher le fichier cachés , et reverifie si tu trouve ce fichier

        C:\WINDOWS\system32\kdwzh.exe
        et si tu le trouve depose le ici

        https://www.broadcom.com/

        1. cdac Auteur
          tjr pas trouve le fichier dans systeme 32. voici le rapport demande. merci encore

          ComboFix 08-12-05.06 - sda 2008-12-06 17:28:09.1 - NTFSx86
          Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1238 [GMT 1:00]
          Running from: d:\documents and settings\sda\Desktop\ComboFix.exe
          * Created a new restore point
          * Resident AV is active

          .

          ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
          .

          c:\windows\system32\drivers\qtoprtuq.sys

          .
          ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
          .

          -------\Legacy_qtoprtuq
          -------\Service_qtoprtuq

          ((((((((((((((((((((((((( Files Created from 2008-11-06 to 2008-12-06 )))))))))))))))))))))))))))))))
          .

          2008-12-06 10:06 . 2008-12-06 13:47 <DIR> d-------- C:\SDFix
          2008-12-05 17:57 . 2008-12-05 18:10 <DIR> d-------- c:\program files\UsbFix
          2008-12-05 15:33 . 2008-12-05 21:16 <DIR> d-------- C:\ToolBar SD
          2008-12-05 15:20 . 2008-12-05 15:20 2,404,352 --a------ C:\Norton_Removal_Tool.exe
          2008-12-05 15:16 . 2008-12-05 15:16 <DIR> d-------- c:\windows\system32\Temp
          2008-12-05 13:53 . 2008-12-05 13:54 1,226,248 --a------ C:\DMSetup.exe
          2008-12-05 13:14 . 2008-12-05 13:14 552 --a------ c:\windows\system32\d3d8caps.dat
          2008-12-05 12:52 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
          2008-12-05 12:52 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
          2008-12-05 12:52 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe
          2008-12-05 12:52 . 2008-12-05 12:29 53,248 --a------ c:\windows\system32\Process.exe
          2008-12-05 12:52 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
          2008-12-05 12:52 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
          2008-12-05 12:29 . 2008-12-05 13:39 <DIR> d-------- C:\SmitfraudFix
          2008-12-05 12:19 . 2008-12-06 13:53 1,435,761 --a------ C:\SmitfraudFix.zip
          2008-12-04 20:00 . 2008-12-04 20:01 401,720 --a------ C:\HiJackThis.exe
          2008-12-01 19:41 . 2008-12-01 19:41 30,601 --a------ d:\documents and settings\sda\x.exe
          2008-12-01 18:43 . 2008-12-01 18:43 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
          2008-12-01 18:05 . 2008-12-01 18:05 <DIR> d-------- d:\documents and settings\sda\dsc
          2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\vw
          2008-12-01 18:02 . 2008-12-01 18:02 <DIR> d-------- d:\documents and settings\sda\VisualRoute
          2008-12-01 18:01 . 2008-12-01 20:07 <DIR> d-------- c:\program files\VisualRoute 2008
          2008-11-27 17:23 . 2008-11-27 17:23 29 --a------ c:\windows\system32\uwrqdspa.tmp
          2008-11-27 17:20 . 2008-11-27 17:20 188,416 --a------ c:\windows\JJACRBNV.exe
          2008-11-27 17:20 . 2008-12-06 16:16 0 --a------ c:\windows\system32\drivers\3672251a.sys
          2008-11-27 17:19 . 2008-11-27 17:19 2 --a------ C:\1815657427

          .
          (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-12-06 17:56 --------- d-----w d:\documents and settings\sda\Application Data\Skype
          2008-12-06 17:55 --------- d-----w d:\documents and settings\sda\Application Data\skypePM
          2008-12-01 19:07 --------- d-----w c:\program files\SUPERAntiSpyware
          2008-12-01 18:40 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
          2008-12-01 18:03 --------- d-----w d:\documents and settings\sda\Application Data\LimeWire
          2008-12-01 11:06 --------- d-----w c:\program files\ZikiTranslator
          2008-11-28 10:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.001\Application Data\SACore
          2008-11-27 13:27 --------- d-----w c:\program files\e-bat
          2008-11-17 12:59 --------- d-----w c:\program files\McAfee
          2008-11-12 02:07 --------- d-----w d:\documents and settings\All Users\Application Data\Microsoft Help
          2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
          2008-10-24 11:10 453,632 ----a-w c:\windows\system32\dllcache\mrxsmb.sys
          2008-10-20 16:25 --------- d-----w d:\documents and settings\sda\Application Data\Ulead Systems
          2008-10-20 10:41 --------- d-----w d:\documents and settings\sda\Application Data\Sprite Software
          2008-10-20 10:40 --------- d--h--w c:\program files\InstallShield Installation Information
          2008-10-20 10:40 --------- d-----w c:\program files\Sprite Software
          2008-10-20 10:34 --------- d-----w c:\program files\Microsoft ActiveSync
          2008-10-20 10:12 --------- d-----w c:\program files\Ressources Windows Mobile
          2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
          2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
          2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
          2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
          2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
          2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
          2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
          2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
          2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
          2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
          2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
          2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
          2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
          2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
          2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
          2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
          2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
          2008-10-15 16:57 332,800 ----a-w c:\windows\system32\dllcache\netapi32.dll
          2008-10-10 18:06 --------- d-----w c:\program files\Common Files\HP
          2008-10-10 18:04 --------- d-----w c:\program files\Common Files\Symantec Shared
          2008-10-10 16:14 --------- d-----w d:\documents and settings\LocalService.NT AUTHORITY.000\Application Data\SACore
          2008-10-09 16:34 --------- d-----w c:\program files\HP
          2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
          2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
          2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
          2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\dllcache\win32k.sys
          2008-04-04 09:49 32 ----a-w d:\documents and settings\All Users\Application Data\ezsid.dat
          2007-10-30 08:54 100,680 ----a-w d:\documents and settings\sda\Application Data\GDIPFONTCACHEV1.DAT
          2007-08-01 14:48 9,644 ----a-w c:\program files\uninstal.log
          2007-06-07 10:46 81,920 ----a-w d:\documents and settings\sda\Application Data\ezpinst.exe
          2007-06-07 10:46 47,360 ----a-w d:\documents and settings\sda\Application Data\pcouffin.sys
          2005-09-09 17:55 7,155,864 ----a-w c:\program files\NGhost10.msi
          2005-09-09 17:55 4,588,454 ----a-w c:\program files\setup.exe
          2005-09-09 17:55 37,766,164 ----a-w c:\program files\Data1.cab
          2005-09-09 17:55 35 ----a-w c:\program files\SCSSDist.ini
          .

          ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          *Note* empty entries & legit default entries are not shown
          REGEDIT4

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
          "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

          [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]
          2008-08-05 01:13 1610264 --a------ c:\program files\myBabylon\tbmyBa.dll

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
          "{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
          "{34EA1C70-42CC-42C5-AA29-EC58B95A343E}"= "c:\program files\myBabylon\tbmyBa.dll" [2008-08-05 1610264]

          [HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
          "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
          "Skype"="c:\apps\skype\Phone\Skype.exe" [2008-02-01 21974824]
          "feedreader.exe"="c:\program files\FeedReader30\feedreader.exe" [2007-03-16 1186304]
          "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-31 68856]
          "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
          "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
          "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
          "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
          "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
          "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-28 7573504]
          "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-04-28 86016]
          "Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]
          "DetectorApp"="c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
          "OmniPass"="c:\apps\Softex\OmniPass\scureapp.exe" [2006-01-30 1978368]
          "PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-02-23 147456]
          "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2008-06-13 1176808]
          "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-06 98304]
          "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
          "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 58992]
          "Norton Ghost 10.0"="c:\program files\Norton Ghost\Agent\GhostTray.exe" [2005-09-09 1537648]
          "Adobe Photo Downloader"="c:\program files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]
          "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
          "IdiomaX Office"="c:\program files\IdiomaX\Office Translator 4.0\IdxOffice.exe" [2007-01-18 397872]
          "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
          "McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [2008-07-10 5129504]
          "nwiz"="nwiz.exe" [2006-04-28 c:\windows\system32\nwiz.exe]
          "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
          "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 c:\windows\RTHDCPL.exe]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

          d:\documents and settings\sda\Start Menu\Programs\Startup\
          OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

          d:\documents and settings\All Users\Start Menu\Programs\Startup\
          Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2007-06-06 49254]
          Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
          HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
          HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
          Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
          SnagIt 8.lnk - c:\program files\TechSmith\SnagIt 8\SnagIt32.exe [2007-02-06 6379080]
          Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784]

          [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
          "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
          2006-01-30 08:53 49152 c:\apps\Softex\OmniPass\OPXPGina.dll

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
          "vidc.I420"= vdrcodec.dll
          "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
          "msacm.mpegacm"= mpegacm.acm
          "msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm
          "msacm.mpegacm "= c:\progra~1\COMMON~1\ULEADS~1\MPEG\mpegacm.acm
          "VIDC.MJPG"= Pvmjpg30.dll

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
          "DisableMonitoring"=dword:00000001

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
          "%windir%\\system32\\sessmgr.exe"=
          "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
          "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
          "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
          "c:\\Program Files\\Messenger\\msmsgs.exe"=
          "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
          "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
          "c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
          "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
          "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
          "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
          "c:\\Program Files\\eMule\\emule.exe"=
          "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
          "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
          "c:\\Program Files\\RealVNC\\vncviewer.exe"=
          "c:\\Program Files\\RealVNC\\WinVNC\\winvnc.exe"=
          "c:\\Program Files\\McAfee\\MBK\\McAfeeDataBackup.exe"=
          "c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
          "d:\\film a graver\\emule.exe"=
          "c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
          "c:\\Program Files\\LimeWire\\LimeWire.exe"=
          "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
          "c:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
          "c:\\WINDOWS\\system32\\java.exe"=
          "d:\\Documents and Settings\\sda\\Desktop\\SymNRT.exe"=
          "c:\\APPS\\skype\\Phone\\Skype.exe"=

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
          "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
          "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
          "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
          "500:UDP"= 500:UDP:@xpsp2res.dll,-22017

          R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-10-01 203280]
          S1 3672251a;3672251a;c:\windows\system32\drivers\3672251a.sys [2008-11-27 0]
          S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2008-03-18 1527900]
          S3 ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-12-01 27904]
          S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2008-03-18 544768]
          .
          Contents of the 'Scheduled Tasks' folder

          2008-11-15 c:\windows\Tasks\McDefragTask.job
          - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

          2008-11-01 c:\windows\Tasks\McQcTask.job
          - c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]
          .
          - - - - ORPHANS REMOVED - - - -

          WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
          HKCU-Run-msiexec.exe - msiconf.exe
          HKLM-Run-ISUSPM Startup - c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
          HKLM-Run-ISUSScheduler - c:\program files\Common Files\InstallShield\UpdateService\issch.exe
          HKLM-Run-HP Update Assistant - c:\windows\system32\HPAware.exe
          HKLM-Run-c:\windows\system32\kdwzh.exe - c:\windows\system32\kdwzh.exe
          Notify-dimsntfy - (no file)

          **************************************************************************

          catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-12-06 18:54:01
          Windows 5.1.2600 Service Pack 2 NTFS

          scanning hidden processes ...

          scanning hidden autostart entries ...

          scanning hidden files ...

          scan completed successfully
          hidden files: 0

          **************************************************************************
          .
          --------------------- DLLs Loaded Under Running Processes ---------------------

          - - - - - - - > 'winlogon.exe'(660)
          c:\apps\Softex\OmniPass\opxpgina.dll
          .
          ------------------------ Other Running Processes ------------------------
          .
          c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
          c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
          c:\program files\Bonjour\mDNSResponder.exe
          c:\windows\system32\drivers\CDAC11BA.EXE
          c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe
          c:\apps\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
          c:\windows\system32\gearsec.exe
          c:\program files\Nero\Nero8\InCD\InCDsrv.exe
          c:\progra~1\McAfee\MSC\mcmscsvc.exe
          c:\program files\Common Files\McAfee\MNA\McNASvc.exe
          c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
          c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
          c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
          c:\program files\McAfee\MPF\MpfSrv.exe
          c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
          c:\program files\Norton Ghost\Agent\VProSvc.exe
          c:\windows\system32\nvsvc32.exe
          c:\apps\Softex\OmniPass\OmniServ.exe
          c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
          c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
          c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
          c:\program files\RealVNC\WinVNC\winvnc.exe
          c:\windows\system32\searchindexer.exe
          c:\apps\Powercinema\Kernel\TV\CLSched.exe
          c:\apps\Softex\OmniPass\OPXPApp.exe
          c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
          c:\progra~1\McAfee.com\Agent\mcagent.exe
          c:\progra~1\McAfee\VIRUSS~1\mcvsshld.exe
          c:\windows\system32\rundll32.exe
          c:\progra~1\MICROS~4\rapimgr.exe
          c:\apps\skype\Plugin Manager\skypePM.exe
          c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
          c:\program files\TechSmith\SnagIt 8\TscHelp.exe
          c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
          c:\program files\TechSmith\SnagIt 8\SnagPriv.exe
          c:\windows\system32\searchprotocolhost.exe
          c:\windows\system32\searchfilterhost.exe
          .
          **************************************************************************
          .
          Completion time: 2008-12-06 19:00:04 - machine was rebooted [sda]
          ComboFix-quarantined-files.txt 2008-12-06 17:59:53

          Pre-Run: 12.217.450.496 bytes free
          Post-Run: 12,111,077,376 bytes free

          290 --- E O F --- 2008-12-01 18:53:21
      3. noctambule28
        C'est bon

        tu as rebooter depuis ?

        sinon fait le ,

        <et reposte un nouvel hijackthis ensuite
        @+
        1. cdac Auteur
          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 16:23:33, on 6/12/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16735)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
          C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\WINDOWS\system32\drivers\CDAC11BA.EXE
          c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
          c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
          C:\WINDOWS\System32\GEARSec.exe
          C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
          C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
          C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
          c:\program files\common files\mcafee\mna\mcnasvc.exe
          c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
          C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
          C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
          C:\Program Files\McAfee\MPF\MPFSrv.exe
          C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
          C:\Program Files\Norton Ghost\Agent\VProSvc.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Apps\Softex\OmniPass\Omniserv.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
          C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
          C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
          C:\Program Files\RealVNC\WinVNC\WinVNC.exe
          C:\WINDOWS\system32\SearchIndexer.exe
          c:\APPS\Powercinema\Kernel\TV\CLSched.exe
          C:\Apps\Softex\OmniPass\OPXPApp.exe
          C:\WINDOWS\system32\wuauclt.exe
          c:\PROGRA~1\mcafee.com\agent\mcagent.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\wuauclt.exe
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
          C:\WINDOWS\RTHDCPL.EXE
          C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
          C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
          C:\Apps\Softex\OmniPass\scureapp.exe
          C:\APPS\Powercinema\PCMService.exe
          C:\Program Files\QuickTime\qttask.exe
          C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
          C:\Program Files\Common Files\Symantec Shared\ccApp.exe
          C:\Program Files\Norton Ghost\Agent\GhostTray.exe
          C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe
          C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
          C:\Program Files\Microsoft ActiveSync\wcescomm.exe
          C:\PROGRA~1\MICROS~4\rapimgr.exe
          C:\APPS\skype\Phone\Skype.exe
          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          C:\Program Files\Messenger\msmsgs.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
          C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
          C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
          C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
          C:\Program Files\Windows Desktop Search\WindowsSearch.exe
          C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
          C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
          C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
          C:\APPS\SKYPE\Plugin Manager\skypePM.exe
          C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
          C:\HiJackThis.exe

          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
          R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          R3 - URLSearchHook: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyBa.dll
          O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
          O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyBa.dll
          O2 - BHO: (no name) - {6B690ACD-9479-4C41-8A2D-D6083F650E81} - C:\WINDOWS\system32\HPDirecter.dll (file missing)
          O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
          O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
          O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
          O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
          O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
          O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O3 - Toolbar: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyBa.dll
          O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
          O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
          O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
          O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
          O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
          O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
          O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
          O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
          O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
          O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
          O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe
          O4 - HKLM\..\Run: [PCMService] "c:\APPS\Powercinema\PCMService.exe"
          O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
          O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
          O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
          O4 - HKLM\..\Run: [HP Update Assistant] C:\WINDOWS\system32\HPAware.exe
          O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
          O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
          O4 - HKLM\..\Run: [IdiomaX Office] C:\Program Files\IdiomaX\Office Translator 4.0\IdxOffice.exe
          O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
          O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdwzh.exe] C:\WINDOWS\system32\kdwzh.exe
          O4 - HKLM\..\Run: [McAfee Backup] "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe"
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
          O4 - HKCU\..\Run: [Skype] "C:\APPS\skype\Phone\Skype.exe" /nosplash /minimized
          O4 - HKCU\..\Run: [feedreader.exe] "C:\Program Files\FeedReader30\feedreader.exe"
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
          O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
          O4 - HKCU\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\8XD4789M\365_1_~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\ASY1S2TG\PRINT_~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\ARIGXBFP\WINK_U~2.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\AALLYZ75\MEMBER~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\ASY1S2TG\366_1_~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\8XD4789M\COMMON~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\ARIGXBFP\FR_YAH~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\8XD4789M\MEMBER~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\8XD4789M\BOTTOM~2.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\S78VXH00\WINK_U~2.SH! d:\DOCUME~1\sda\LOCALS~1\temp\WEREE0~1.SH!
          O4 - HKCU\..\Run: [msiexec.exe] msiconf.exe
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
          O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
          O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
          O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
          O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
          O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
          O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
          O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
          O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
          O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
          O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
          O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
          O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
          O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
          O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\beuk.htm
          O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
          O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
          O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
          O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
          O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
          O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
          O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
          O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
          O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
          O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
          O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
          O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
          O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
          O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
          O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
          O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
          O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
          O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
          O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
          O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
          O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
          O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
          O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
          O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
          O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
          O23 - Service: RemotelyAnywhere Maintenance Service (RAMaint) - Unknown owner - C:\Program Files\RemotelyAnywhere\RAMaint.exe (file missing)
          O23 - Service: RemotelyAnywhere Maintenance Service (RAMaint) - Unknown owner - C:\Program Files\RemotelyAnywhere\RAMaint.exe (file missing)
          O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
          O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
          O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
          O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
          O23 - Service: VNC Server (winvnc) - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe
      5. cdac Auteur
        bjr,
        je ne sais si j'ai bien fait, mais suis arrive sur page bleu avec option 1 hard drive. j'ai fait enter et ensuite j'ai fait SDFIX et runthis bat.
        à nouveau page bleu et pas de y. donc j'ai choisi option 2 nettoyaer malware et norman malware s'est mis en route et poursuit ses recherche. est ce bon.
        bàt
        1. noctambule28
          Rends toi sur ce site :

          https://www.virustotal.com/gui/

          Clique sur parcourir et cherche ce fichier : C:\WINDOWS\system32\kdwzh.exe
          Clique sur Send File.

          Un rapport va s'élaborer ligne à ligne.

          Attends la fin. Il doit comprendre la taille du fichier envoyé.
          Sauvegarde le rapport avec le bloc-note.

          Copie le dans ta réponse.
          1. cdac Auteur
            je ne trouve pazs ds systeme32 le fichier. inexistant
          2. noctambule28
            @cdacAS-tu affiché les fichiers cachés?

            sinon fait ceci

            Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
            http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
            Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
            • Redémarre ton ordinateur
            • Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
            • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
            • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
            • Choisis ton compte.
            Déroule la liste des instructions ci-dessous :
            • Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le scrïpt.
            • Appuie sur Y pour commencer le processus de nettoyage.
            • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
            • Appuie sur une touche pour redémarrer le PC.
            • Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
            • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
            • Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau.
            • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
            • Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

            lien de upload
            https://www.bleepingcomputer.com/submit-malware.php?channel=27
          3. cdac
            @noctambule28voila ce qui etait demandé. j'espère qu'on avance.

            Pour ma part après etre revenu l'ordi avait une fenetre bleue avec comme mesage d'erreur :
            0X0000008E (0XC0000005,0X80509D31,0XB225F29C,0X00000000). Sais pas si ça peut aider.
            bàt
            Norman Malware Cleaner
            Copyright © 1990 - 2008, Norman ASA. Built 2008/12/05 09:13:31

            Norman Scanner Engine Version: 5.93.01
            Nvcbin.def Version: 5.93.00, Date: 2008/12/05 09:13:31, Variants: 2281922

            Running pre-scan cleanup routine:
            Operating System: Microsoft Windows XP Home 5.1.2600 Service Pack 2
            Logged on user: SERGE\sda

            Scan started: 06/12/2008 13:51:56

            Scanning running processes and process memory...

            C:\WINDOWS\Explorer.EXE(3896) (C:\WINDOWS\system32\HPDirecter.dll!0x02D90000) (Infected with W32/BHO.BGA)
            File marked for defered cleaning (reboot required)

            C:\Program Files\Internet Explorer\iexplore.exe(5540) (C:\WINDOWS\system32\HPDirecter.dll!0x03460000) (Infected with W32/BHO.BGA)
            File marked for defered cleaning (reboot required)

            C:\WINDOWS\System32\drivers\3672251a.sys (Error opening file: Not found)

            Number of processes/threads found: 4712
            Number of processes/threads scanned: 4711
            Number of processes/threads not scanned: 1
            Number of infected processes/threads terminated: 0
            Total scanning time: 1m 48s

            Scanning file system...

            Scanning: C:\*.*

            C:\SmitfraudFix.zip/SmitfraudFix/VACFix.exe (Infected with W32/Smalldrp.APNN)
            Deleted file

            HIJACK :

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 15:52:18, on 6/12/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16735)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
            C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Bonjour\mDNSResponder.exe
            C:\WINDOWS\system32\drivers\CDAC11BA.EXE
            c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
            c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
            C:\WINDOWS\System32\GEARSec.exe
            C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
            C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
            C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
            c:\program files\common files\mcafee\mna\mcnasvc.exe
            c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
            C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
            C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
            C:\Program Files\McAfee\MPF\MPFSrv.exe
            C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
            C:\Program Files\Norton Ghost\Agent\VProSvc.exe
            C:\WINDOWS\system32\nvsvc32.exe
            C:\Apps\Softex\OmniPass\Omniserv.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
            C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
            C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
            C:\Program Files\RealVNC\WinVNC\WinVNC.exe
            C:\WINDOWS\system32\SearchIndexer.exe
            c:\APPS\Powercinema\Kernel\TV\CLSched.exe
            C:\Apps\Softex\OmniPass\OPXPApp.exe
            c:\PROGRA~1\mcafee.com\agent\mcagent.exe
            C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
            C:\WINDOWS\Explorer.EXE
            C:\WINDOWS\system32\wuauclt.exe
            C:\WINDOWS\system32\RUNDLL32.EXE
            C:\WINDOWS\RTHDCPL.EXE
            C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
            C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
            C:\Apps\Softex\OmniPass\scureapp.exe
            C:\APPS\Powercinema\PCMService.exe
            C:\Program Files\QuickTime\qttask.exe
            C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
            C:\Program Files\Common Files\Symantec Shared\ccApp.exe
            C:\Program Files\Norton Ghost\Agent\GhostTray.exe
            C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe
            C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
            C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\Microsoft ActiveSync\wcescomm.exe
            C:\PROGRA~1\MICROS~4\rapimgr.exe
            C:\APPS\skype\Phone\Skype.exe
            C:\Program Files\FeedReader30\feedreader.exe
            C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            C:\Program Files\Messenger\msmsgs.exe
            C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
            C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
            C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
            C:\Program Files\Windows Desktop Search\WindowsSearch.exe
            C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
            C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
            C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
            C:\WINDOWS\system32\NOTEPAD.EXE
            C:\APPS\SKYPE\Plugin Manager\skypePM.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
            C:\WINDOWS\system32\SearchProtocolHost.exe
            C:\HiJackThis.exe

            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
            R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            R3 - URLSearchHook: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyBa.dll
            O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
            O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
            O2 - BHO: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyBa.dll
            O2 - BHO: (no name) - {6B690ACD-9479-4C41-8A2D-D6083F650E81} - C:\WINDOWS\system32\HPDirecter.dll (file missing)
            O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
            O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
            O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
            O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
            O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
            O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            O3 - Toolbar: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyBa.dll
            O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
            O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
            O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
            O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
            O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
            O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
            O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
            O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
            O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
            O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
            O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe
            O4 - HKLM\..\Run: [PCMService] "c:\APPS\Powercinema\PCMService.exe"
            O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
            O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
            O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
            O4 - HKLM\..\Run: [HP Update Assistant] C:\WINDOWS\system32\HPAware.exe
            O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
            O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
            O4 - HKLM\..\Run: [IdiomaX Office] C:\Program Files\IdiomaX\Office Translator 4.0\IdxOffice.exe
            O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
            O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdwzh.exe] C:\WINDOWS\system32\kdwzh.exe
            O4 - HKLM\..\Run: [McAfee Backup] "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe"
            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
            O4 - HKCU\..\Run: [Skype] "C:\APPS\skype\Phone\Skype.exe" /nosplash /minimized
            O4 - HKCU\..\Run: [feedreader.exe] "C:\Program Files\FeedReader30\feedreader.exe"
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
            O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
            O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
            O4 - HKCU\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\8XD4789M\365_1_~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\ASY1S2TG\PRINT_~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\ARIGXBFP\WINK_U~2.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\AALLYZ75\MEMBER~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\ASY1S2TG\366_1_~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\8XD4789M\COMMON~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\ARIGXBFP\FR_YAH~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\8XD4789M\MEMBER~1.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\8XD4789M\BOTTOM~2.SH! D:\DOCUME~1\sda\LOCALS~1\TEMPOR~1\Content.IE5\S78VXH00\WINK_U~2.SH! d:\DOCUME~1\sda\LOCALS~1\temp\WEREE0~1.SH!
            O4 - HKCU\..\Run: [msiexec.exe] msiconf.exe
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
            O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
            O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
            O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
            O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
            O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
            O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
            O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
            O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
            O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
            O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
            O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
            O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
            O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
            O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\beuk.htm
            O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
            O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
            O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
            O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
            O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
            O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
            O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
            O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
            O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
            O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
            O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
            O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
            O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
            O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
            O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
            O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
            O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
            O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
            O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
            O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
            O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
            O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
            O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
            O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
            O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
            O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
            O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
            O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
            O23 - Service: RemotelyAnywhere Maintenance Service (RAMaint) - Unknown owner - C:\Program Files\RemotelyAnywhere\RAMaint.exe (file missing)
            O23 - Service: RemotelyAnywhere Maintenance Service (RAMaint) - Unknown owner - C:\Program Files\RemotelyAnywhere\RAMaint.exe (file missing)
            O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
            O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
            O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
            O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
            O23 - Service: VNC Server (winvnc) - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe
        • 1
        • 2