O secours VIRUS !

coucou !!!
Tout d'abord je te souhaite une trés bonne année 2009, j'espère qu tu as passé de bonnes fetes.

Je viens de rentrer de vacances et je vois que mon PC est vraiment trés lent et j'ai encore un virus sur msn !
Merci pour ton aide

Voila le rapport hijack :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:38:53, on 03/01/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16764)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Zimmermann\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Zimmermann\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Program Files\VCOM\Fix-It\Fix-It.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: torrent_search Toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files\torrent_search\tbtorr.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: torrent_search Toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files\torrent_search\tbtorr.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: torrent_search Toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files\torrent_search\tbtorr.dll
O3 - Toolbar: iMesh MediaBar - {B7D3E479-CC68-42B5-A338-938ECE35F419} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshMediaBar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\VCOM\Fix-It\MemCheck.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = Zimmermann\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Fix-It Task Manager - Avanquest Publishing USA, Inc. - C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

coucou !

wi g bien tout supprimer c peut etre pare que je l'ai fait 2 fois que ca a marquer ca !

voila le rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:16:42, on 21/12/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16764)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Zimmermann\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Zimmermann\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Zimmermann\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Program Files\eMule\emule.exe
C:\Users\Zimmermann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7B7S9FI7\HiJackThis[1].exe

coucou !

voila le rapport :

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 6.0.6000

17/12/2008 23:42:48
mbam-log-2008-12-17 (23-42-41).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 133893
Temps écoulé: 57 minute(s), 49 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore.1 (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Carlson (Dialer) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Common Files\Carlson (Dialer) -> No action taken.
C:\Program Files\Webtools (Trojan.Agent) -> No action taken.

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Salut,

Bonne nouvelle je crois que je n'ai plus de virus mon PC marche nikel !

Je te remercie pour tout, c super sympa de m'avoir aidé !

Voila le rapport :

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\\"Authentication Packages"|hex(7):6d,73,76,31,5f,30,00,00 /E : value set successfully!
========== FILES ==========
c:\windows\System32\warning.gif moved successfully.
c:\windows\System32\ahtn.htm moved successfully.
c:\windows\System32\uniq.tll moved successfully.
c:\windows\System32\test.ttt moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12172008_170316

salut !

Merci pour ton aide !

Voici le rapport :

ComboFix 08-12-15.01 - Zimmermann 2008-12-16 18:24:03.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Édition Intégrale 6.0.6000.0.1252.1.1036.18.1022.698 [GMT 1:00]
Lancé depuis: c:\users\Zimmermann\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\progra~2\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Zango
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Zango\Zango Uninstall Instructions.lnk
c:\progra~2\ZangoSA
c:\progra~2\ZangoSA\ZangoSA.dat
c:\progra~2\ZangoSA\ZangoSA_kyf.dat
c:\progra~2\ZangoSA\ZangoSAAbout.mht
c:\progra~2\ZangoSA\ZangoSAau.dat
c:\progra~2\ZangoSA\ZangoSAEula.mht
c:\program files\Mjcore
c:\program files\ShoppingReport
c:\users\ZIMMER~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\bestwiner.stt
c:\users\ZIMMER~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\CPV.stt
c:\users\ZIMMER~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\fbk.sts
c:\users\ZIMMER~1\AppData\Roaming\gadcom
c:\users\ZIMMER~1\AppData\Roaming\WeatherDPA
c:\users\ZIMMER~1\AppData\Roaming\WeatherDPA\Weather\WeatherStartup.xml
c:\users\ZIMMER~1\AppData\Roaming\Zango
c:\users\Zimmermann\AppData\Local\Microsoft\Windows\Temporary Internet Files\bestwiner.stt
c:\users\Zimmermann\AppData\Local\Microsoft\Windows\Temporary Internet Files\CPV.stt
c:\users\Zimmermann\AppData\Local\Microsoft\Windows\Temporary Internet Files\fbk.sts
c:\users\Zimmermann\AppData\Roaming\WeatherDPA\Weather\WeatherStartup.xml
c:\windows\system32\404Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\frmwrk32.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\System32\KQpVCfhk.ini
c:\windows\System32\KQpVCfhk.ini2
c:\windows\system32\Microsoft\backup.ftp
c:\windows\System32\nUDcdLRu.ini
c:\windows\system32\nUDcdLRu.ini2
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\qkclcmre.ini
c:\windows\system32\rhcuwgib.ini
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
c:\windows\system32\x64

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-16 au 2008-12-16 ))))))))))))))))))))))))))))))))))))
.

2050-12-31 19:41 . 2050-12-31 19:41 <REP> d----c--- c:\program files\BitLocker
2039-01-13 14:54 . 2039-01-13 14:54 211,000 --a------ c:\windows\System32\drivers\volsnap.sys
2039-01-13 14:54 . 2039-01-13 14:54 11,776 --a------ c:\windows\System32\sbunattend.exe
2008-12-16 15:21 . 2008-12-12 00:57 78,336 --a--c--- c:\windows\System32\Agent.OMZ.Fix.exe
2008-12-15 23:32 . 2008-12-15 23:32 <REP> d----c--- c:\program files\Trend Micro
2008-12-15 22:49 . 2008-12-16 08:27 <REP> d----c--- c:\users\All Users\PrevxCSI
2008-12-15 22:49 . 2008-12-15 22:49 <REP> d----c--- c:\program files\PrevxCSI
2008-12-15 22:49 . 2008-12-16 08:27 <REP> d----c--- c:\progra~2\PrevxCSI
2008-12-15 22:49 . 2008-12-15 22:49 26,808 --a--c--- c:\windows\System32\drivers\pxark.sys
2008-12-15 22:36 . 2008-12-16 15:15 <REP> d----c--- c:\users\Zimmermann\SmitfraudFix
2008-12-15 20:48 . 2008-12-15 21:00 <REP> d----c--- c:\program files\Wise Disk Cleaner
2008-12-15 19:35 . 2008-12-15 20:47 <REP> d----c--- c:\program files\Doctor Spyware Cleaner
2008-12-13 20:01 . 2008-12-13 20:01 <REP> d----c--- c:\program files\AxBx
2008-12-13 17:59 . 2008-12-13 17:59 10,520 --a--c--- c:\windows\System32\avgrsstx.dll
2008-12-13 17:58 . 2008-12-16 09:53 <REP> d----c--- c:\windows\System32\drivers\Avg
2008-12-13 17:58 . 2008-12-13 17:58 97,928 --a--c--- c:\windows\System32\drivers\avgldx86.sys
2008-12-13 17:58 . 2008-12-13 17:58 69,128 --a--c--- c:\windows\System32\drivers\avgwfpx.sys
2008-12-13 14:24 . 2008-12-15 17:12 <REP> d----c--- c:\program files\The Cleaner Demo
2008-12-13 13:53 . 2008-12-13 20:10 <REP> d----c--- c:\users\Zimmermann\AppData\Roaming\Twain
2008-12-13 13:48 . 2008-12-13 18:36 <REP> d----c--- c:\program files\Webtools
2008-12-13 02:23 . 2008-12-16 13:04 <REP> d--h-c--- C:\$AVG8.VAULT$
2008-12-13 02:03 . 2008-12-15 23:02 <REP> d----c--- c:\users\All Users\avg8
2008-12-13 02:03 . 2008-12-13 02:03 <REP> d----c--- c:\program files\AVG
2008-12-13 02:03 . 2008-12-15 23:02 <REP> d----c--- c:\progra~2\avg8
2008-12-12 20:56 . 2008-12-12 20:56 <REP> d----c--- c:\users\All Users\Fighters
2008-12-12 20:56 . 2008-12-13 01:48 <REP> d----c--- c:\program files\Fighters
2008-12-12 20:56 . 2008-12-12 20:56 <REP> d----c--- c:\progra~2\Fighters
2008-12-12 08:10 . 2008-12-14 01:35 4,785 --a--c--- c:\windows\System32\warning.gif
2008-12-12 08:10 . 2008-12-14 01:35 1,347 --a--c--- c:\windows\System32\ahtn.htm
2008-12-12 08:09 . 2008-12-12 08:09 1 --a--c--- c:\windows\System32\uniq.tll
2008-12-12 08:09 . 2008-12-12 08:09 1 --a--c--- c:\windows\System32\test.ttt
2008-12-11 03:11 . 2008-10-22 00:31 2,048 --a--c--- c:\windows\System32\tzres.dll
2008-12-10 07:33 . 2008-11-01 00:38 4,247,552 --a--c--- c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-10 07:33 . 2008-11-01 04:33 1,687,040 --a--c--- c:\windows\System32\gameux.dll
2008-12-10 07:33 . 2008-11-01 04:33 28,672 --a--c--- c:\windows\System32\Apphlpdm.dll
2008-12-10 05:26 . 2008-06-23 02:52 2,855,424 --a--c--- c:\windows\System32\mf.dll
2008-12-10 05:26 . 2008-06-23 02:52 996,352 --a--c--- c:\windows\System32\WMNetMgr.dll
2008-12-10 05:26 . 2008-06-23 02:52 98,816 --a--c--- c:\windows\System32\mfps.dll
2008-12-10 05:26 . 2008-06-23 02:52 94,720 --a--c--- c:\windows\System32\logagent.exe
2008-12-10 05:26 . 2008-06-23 02:52 52,736 --a--c--- c:\windows\System32\rrinstaller.exe
2008-12-10 05:26 . 2008-06-23 02:52 24,576 --a--c--- c:\windows\System32\mfpmp.exe
2008-12-10 05:26 . 2008-06-22 23:34 2,048 --a--c--- c:\windows\System32\mferror.dll
2008-12-10 04:15 . 2008-10-21 06:16 297,472 --a--c--- c:\windows\System32\gdi32.dll
2008-12-10 03:57 . 2008-10-29 07:20 2,923,520 --a--c--- c:\windows\explorer.exe
2008-12-09 21:52 . 2008-12-09 21:52 <REP> d----c--- c:\users\Zimmermann\AppData\Roaming\AVS4YOU
2008-12-09 21:52 . 2008-12-09 21:52 <REP> d----c--- c:\users\All Users\AVS4YOU
2008-12-09 21:52 . 2008-12-09 21:52 <REP> d----c--- c:\progra~2\AVS4YOU
2008-12-09 21:49 . 2008-12-13 13:18 <REP> d----c--- c:\program files\Common Files\AVSMedia
2008-12-09 21:49 . 2008-12-13 13:24 <REP> d----c--- c:\program files\AVS4YOU
2008-12-09 21:49 . 2007-02-27 18:36 1,700,352 --a--c--- c:\windows\System32\GdiPlus.dll
2008-12-09 21:49 . 2007-02-27 18:36 974,848 --a--c--- c:\windows\System32\mfc70.dll
2008-12-09 21:49 . 2007-02-27 18:36 487,424 --a--c--- c:\windows\System32\msvcp70.dll
2008-12-09 21:49 . 2007-02-27 18:36 344,064 --a--c--- c:\windows\System32\msvcr70.dll
2008-12-09 19:47 . 2008-12-09 19:47 <REP> d----c--- c:\users\All Users\TVU Networks
2008-12-09 19:47 . 2008-12-09 19:47 <REP> d----c--- c:\progra~2\TVU Networks
2008-11-28 20:11 . 2008-11-28 20:11 <REP> d----c--- c:\users\All Users\233B8
2008-11-28 20:11 . 2008-11-28 20:11 <REP> d----c--- c:\progra~2\233B8
2008-11-25 23:12 . 2008-08-28 04:22 712,704 --a--c--- c:\windows\System32\WindowsCodecs.dll
2008-11-25 23:12 . 2008-08-28 04:24 425,472 --a--c--- c:\windows\System32\PhotoMetadataHandler.dll
2008-11-25 23:12 . 2008-08-28 04:22 347,648 --a--c--- c:\windows\System32\WindowsCodecsExt.dll
2008-11-25 23:12 . 2008-10-22 04:43 241,152 --a--c--- c:\windows\System32\PortableDeviceApi.dll
2008-11-25 23:12 . 2008-10-22 04:43 160,768 --a--c--- c:\windows\System32\PortableDeviceTypes.dll
2008-11-25 23:12 . 2008-10-22 04:43 95,232 --a--c--- c:\windows\System32\PortableDeviceClassExtension.dll
2008-11-25 22:46 . 2008-10-21 06:16 1,645,568 --a--c--- c:\windows\System32\connect.dll
2008-11-17 20:12 . 2008-12-15 20:59 <REP> d----c--- c:\users\Zimmermann\AppData\Roaming\RayV

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-16 17:17 --------- dc----w c:\users\Zimmermann\AppData\Roaming\uTorrent
2008-12-15 19:59 --------- dc----w c:\program files\PCFriendly
2008-12-15 19:47 --------- dc----w c:\program files\torrent_search
2008-12-15 16:01 --------- dc----w c:\program files\iMesh Applications
2008-12-12 21:05 --------- dc-h--w c:\program files\Common Files\Carlson
2008-12-12 20:47 --------- dc----w c:\program files\Alwil Software
2008-12-12 14:37 --------- dc----w c:\program files\eMule
2008-12-11 02:31 174 --sha-w c:\program files\desktop.ini
2008-12-11 02:28 --------- dc----w c:\program files\Windows Mail
2008-11-30 19:45 --------- dc----w c:\users\Zimmermann\AppData\Roaming\Nokia Multimedia Player
2008-11-30 18:45 --------- dc----w c:\users\Zimmermann\AppData\Roaming\Nokia
2008-11-08 18:03 --------- dc----w c:\users\Zimmermann\AppData\Roaming\Apple Computer
2008-11-08 18:00 --------- dc----w c:\program files\iTunes
2008-11-08 18:00 --------- dc----w c:\progra~2\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-08 17:59 --------- dc----w c:\program files\iPod
2008-11-08 17:59 --------- dc----w c:\progra~2\Apple Computer
2008-11-08 17:56 --------- dc----w c:\program files\Bonjour
2008-11-08 17:53 --------- dc----w c:\program files\Apple Software Update
2008-11-08 17:49 --------- dc----w c:\progra~2\Apple
2008-11-05 15:36 --------- dc----w c:\program files\BitTorrent Fastest Tool
2008-11-01 03:33 537,600 -c--a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:33 52,736 -c--a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:33 449,536 -c--a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:33 2,144,256 -c--a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:33 173,056 -c--a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-31 23:23 2,560 -c--a-w c:\windows\AppPatch\AcRes.dll
2008-10-30 13:27 --------- dc----w c:\program files\Garmin GPS Plugin
2007-11-27 15:01 656,518 -c--a-w c:\users\Zimmermann\AppData\Roaming\mdb.bin
2007-03-21 19:02 16,384 -csha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-03-21 19:02 32,768 -csha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-03-21 19:02 16,384 -csha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2039-01-13 1232896]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-09-08 3513344]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-05-08 3640368]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"Google Update"="c:\users\Zimmermann\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-13 1261336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\khfCVpQK

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1322491995-125332216-1985452608-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{02A5486C-FBF3-4968-B6D1-552F50735FBC}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:bittorrent
"UDP Query User{E597B725-59BD-4D97-9937-8DA08BCA8EBF}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:bittorrent
"{85D5CDF9-BB40-4AD0-B4FF-95CDE90FBB3B}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{932EE43E-EBF4-4889-8105-7B26DBA579AE}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{70E5BDAE-E9DE-4031-8947-FCB15F1EFD54}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{145BD696-4C0A-40EE-A485-7A8F89DAD1D5}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{552801F0-5A0A-46E3-A2B9-83D596E0D28D}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{9B024921-AC70-4A0D-BAAE-7CE8FB75877C}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{916E24F7-850D-4EA2-A46F-FF41C095A5E3}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{C7C59A3E-A1B9-4BCA-9200-0FF5944EFFB4}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{68F0C180-0C7D-445D-A912-17DD4F874A56}"= UDP:c:\program files\RayV\RayV\RayV.exe:RayV
"{CB439859-EE37-41E2-A4C0-356D7B288AF1}"= TCP:c:\program files\RayV\RayV\RayV.exe:RayV
"{A43120B9-866C-4023-8C99-E6AE8999E034}"= UDP:c:\program files\RayV\RayV\RayV.exe:RayV
"{CEB2ACD6-360A-4552-916E-E91351C5EFF8}"= TCP:c:\program files\RayV\RayV\RayV.exe:RayV
"{0A09C2A2-0960-454A-A7D0-B63882173946}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{E0C4B7D5-96A6-437B-B93F-61A3D17FABDA}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{196cd37b-d8af-11db-b861-000ae4d9416c}]
\shell\AutoRun\command - E:\fooool.exe
\shell\explore\Command - E:\fooool.exe
\shell\open\Command - E:\fooool.exe
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{5461D164-03F8-4A3E-9B3E-24C1C012B7C2} - c:\windows\system32\khfCVpQK.dll
HKCU-Run-30118b7f - c:\windows\system32\bigwuchr.dll
HKLM-Run-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe
HKLM-Run-30118b7f - c:\windows\system32\bigwuchr.dll
HKLM-Run-Framework Windows - frmwrk32.exe

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 18:33:15
Windows 6.0.6000 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(3496)
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_fre.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\program files\Microsoft Office\OFFICE11\msohev.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\progra~1\AVG\AVG8\avgwdsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\PrevxCSI\prevxcsi.exe
c:\program files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
c:\program files\PrevxCSI\prevxcsi.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgemc.exe
c:\windows\System32\conime.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Heure de fin: 2008-12-16 18:50:50 - La machine a redémarré [Zimmermann]
ComboFix-quarantined-files.txt 2008-12-16 17:49:56

Avant-CF: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Après-CF: 9,433,477,120 octets libres

258 --- E O F --- 2008-12-16 12:07:49

Mon pc est de plus en plus lent ! o secours !!!

Voici le rapport merci de ton attention !

SmitFraudFix v2.386

Scan done at 15:22:35,87, 16/12/2008
Run from C:\Users\Zimmermann\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Zimmermann

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\ZIMMER~1\AppData\Local\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Zimmermann\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\ZIMMER~1\DOCUME~1\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="avgrsstx.dll"
"LoadAppInit_DLLs"=dword:00000001

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{D41FFDBC-2DBF-4CDE-9372-281C4672AD22}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{D41FFDBC-2DBF-4CDE-9372-281C4672AD22}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{D41FFDBC-2DBF-4CDE-9372-281C4672AD22}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End