Forums Zebulon.fr: Pc lent - Forums Zebulon.fr

Bonjour a tous et a toute

Voila depuis un bon moment mon pc c est mis a ramer sans aucune raison apparente et cela devient tres lourd comme vous pouvez l imaginer je sollicite donc votre aide si vous pouvez ... J ai bien sur essayer de tout scanner avec AVG anti-virus et Avast cela na rien donner...


Voici mon rapport HijackThis :




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:00:43, on 12/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\EoRezo\EoEngine.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Documents and Settings\Lodoss\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Lodoss\LOCALS~1\Temp\winlogon.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - (no file)
O2 - BHO: (no name) - {3340BEBB-5503-008A-5765-2C00BFC88E9D} - (no file)
O2 - BHO: (no name) - {35AB30D6-E8D3-410D-B1A3-7C011F2B5025} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: 0 - {59E480B9-192C-4887-B9B8-550EB6674AF2} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: (no name) - {6540EE93-060B-0BA8-5315-2F00BCBCDFB1} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: (no name) - {E860F2B7-81DB-4924-87C1-A8B5EA8288C3} - (no file)
O2 - BHO: 0 - {FD8A5C5D-4982-4840-408A-48B288694332} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Flash Driver] C:\DOCUME~1\Lodoss\LOCALS~1\Temp\winlogon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
O4 - HKLM\..\Run: [ItsTV] "C:\Program Files\ItsLabel\ItsTV.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uyynk] "C:\Program Files\?ymantec\w?wexec.exe"
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1181245195843
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\prokyzopr.html

--
End of file - 7059 bytes

Ce message a été modifié par lodoss01 - 12 juin 2008 - 04:57 .

salut et bienvenue

Le pc est infecté d'où la lenteur constatée!
On va utiliser ce programme afin de nettoyer les différentes infections >>

Désactive ton antivirus le temps du scan.

Télécharge combofix.exe de sUBs

• Assure toi que tous les programmes sont fermés avant de lancer le fix!
  
• Fait un double clique sur combofix.exe.
  
• Clique sur Oui au message de Limitation de Garantie qui s'affiche.
  
• Il est possible que ton parefeu te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sure: accepte!
  
• Note: Ne ferme pas la fenêtre qui vient de s'ouvrir , tu te retrouverais avec un bureau vide !
  
• Lorsque le scan est terminé, un rapport sera généré : poste en le contenu dans ton prochain message.
  
• Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

Merci de ta reponse Thanos voici le rapport de Combofix :


ComboFix 08-06-10.5 - Lodoss 2008-06-12 18:57:42.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.237 [GMT 2:00]
Endroit: C:\Documents and Settings\Lodoss\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Lodoss\Application Data\DOBE~1
C:\Documents and Settings\Lodoss\Local Settings\Temporary Internet Files\bestwiner.stt
C:\Documents and Settings\Lodoss\Local Settings\Temporary Internet Files\CPV.stt
C:\Documents and Settings\Lodoss\real.txt
C:\Program Files\CPV
C:\Program Files\inetget2
C:\Program Files\JavaCore
C:\Program Files\MapEDC
C:\Program Files\MapEDC\IDE.stt
C:\Program Files\NoDNS
C:\Program Files\NoDNS\UnInstall.exe
C:\Program Files\Temporary
C:\Program Files\Windows NT\prokyzopr.html
C:\Program Files\ymante~1
C:\WINDOWS\system32\real.txt
C:\WINDOWS\system32\wsnpoem
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\video.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-12 to 2008-06-12 ))))))))))))))))))))))))))))))))))))
.

2008-06-12 16:24 . 2008-06-12 16:24 4,551,483 --a------ C:\WINDOWS\system32\Les m‚tiers du combat.scr
2008-06-11 11:11 . 2008-04-14 17:52 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-06 21:08 . 2008-06-06 21:08 <REP> d-------- C:\Program Files\uTorrent
2008-06-06 21:08 . 2008-06-12 18:33 <REP> d-------- C:\Documents and Settings\Lodoss\Application Data\uTorrent
2008-06-05 10:59 . 2008-06-09 09:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-05 10:59 . 2008-06-05 10:59 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-20 23:37 . 2008-05-20 23:37 <REP> d-------- C:\Program Files\Command & Conquer Collection
2008-05-20 20:59 . 2008-05-20 20:59 <REP> d-------- C:\Program Files\Veoh Networks
2008-05-20 20:58 . 2008-05-20 20:58 <REP> d-------- C:\WINDOWS\Downloaded Installations
2008-05-20 20:31 . 2008-05-20 20:31 <REP> d-------- C:\Program Files\DivX
2008-05-14 14:18 . 2008-05-14 14:18 <REP> d-------- C:\Documents and Settings\Lodoss\Application Data\ItsLabel
2008-05-14 09:23 . 2008-05-14 09:24 <REP> d-------- C:\Program Files\Defcon
2008-05-13 16:39 . 2008-06-12 19:08 <REP> d-------- C:\Program Files\ItsLabel
2008-05-13 16:38 . 2008-05-13 16:57 <REP> d-------- C:\Program Files\EoRezo
2008-05-13 16:38 . 2008-06-12 19:08 <REP> d-------- C:\Documents and Settings\Lodoss\Application Data\EoRezo
2008-05-13 03:51 . 2008-05-13 03:51 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-05-13 03:51 . 2008-05-13 03:51 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-12 16:33 --------- d-----w C:\Documents and Settings\Lodoss\Application Data\Azureus
2008-06-12 16:23 --------- d-----w C:\Program Files\Valve
2008-06-01 22:10 --------- d-----w C:\Documents and Settings\Lodoss\Application Data\AVGTOOLBAR
2008-05-20 19:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-20 17:00 --------- d-----w C:\Documents and Settings\Lodoss\Application Data\Winamp
2008-05-16 14:18 --------- d-----w C:\Program Files\eMule
2008-05-15 13:06 --------- d-----w C:\Program Files\Astonsoft
2008-05-14 16:51 --------- d-----w C:\Program Files\MSN Spy 2004
2008-05-14 16:51 --------- d-----w C:\Program Files\LimeWire
2008-05-14 16:50 --------- d-----w C:\Program Files\Zylom Games
2008-05-14 16:50 --------- d-----w C:\Program Files\Runtime Software
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-30 21:37 --------- d-----w C:\Program Files\MsnSpy
2008-04-30 17:59 1,409 ----a-w C:\WINDOWS\Fonts\SncfPre.fot
2008-04-30 17:59 1,409 ----a-w C:\WINDOWS\Fonts\sncf09.fot
2008-04-26 18:28 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-26 02:35 --------- d-----w C:\Program Files\PC Inspector File Recovery
2008-04-25 17:17 --------- d-----w C:\Program Files\Alice
2008-04-25 16:10 --------- d-----w C:\Program Files\Twain
2008-04-25 16:04 75,272 ----a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-04-25 15:59 96,520 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-04-25 15:59 12,424 ----a-w C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-04-25 15:59 --------- d-----w C:\Program Files\AVG
2008-04-25 15:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-04-25 14:45 --------- d-----w C:\Program Files\Fichiers communs\Panda Software
2008-04-15 12:18 --------- d-----w C:\Program Files\Dofus
2008-04-14 15:52 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-02-25 18:57 10 ----a-w C:\Program Files\.autoreg
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"Uyynk"="C:\Program Files\?ymantec\w?wexec.exe" [ ]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-05-08 16:53 3640368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-10-13 17:01 277296]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51 257088]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 13:22 86016]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-04-25 18:04 1177368]
"EoEngine"="C:\Program Files\EoRezo\EoEngine.exe" [2008-04-16 12:01 565248]
"ItsTV"="C:\Program Files\ItsLabel\ItsTV.exe" [2007-04-26 16:19 2908160]
"EoWeather"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.DIV4"= divxc32f.dll
"VIDC.DIV3"= divxc32.dll
"MSACM.DIVXA32"= divxa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Access Password Recovery]
C:\Program Files\Intelore\Access Password Recovery\AccessPasswordRecovery.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra------ 2007-03-01 11:37 2321600 C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-20 01:09 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\flockbox]
--a------ 2007-12-14 17:59 1071472 C:\Sierra\My Lockbox\flockbox.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-12-05 15:41 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2006-01-07 06:26 176128 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
--a------ 2006-01-07 06:26 491520 C:\WINDOWS\system32\hphmon05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
--a------ 2006-01-07 06:26 49152 C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-04-17 12:41 196608 C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-04-13 06:07 69632 C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Security]
C:\WINDOWS\System32\NSecurity.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-11-30 11:40 1266936 C:\Program Files\Valve\Steam\\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-07-12 04:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]
--a------ 2006-10-13 17:04 707376 C:\WINDOWS\vVX1000.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoneAlarm Client]
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"vsmon"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-04-25 17:59]
R0 MPRIFL;MPRIFL;C:\WINDOWS\system32\DRIVERS\MPRIFL.SYS [2007-12-13 21:13]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-04-25 17:59]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-04-25 18:03]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-04-25 18:04]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2006-10-13 17:01]
R3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-10-13 17:04]
S2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-04-25 17:59]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-12-25 17:19]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 17:53]
S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-04 08:04]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-05-15 20:54:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-12 15:00:09 C:\WINDOWS\Tasks\HP Usg Daily.job"
- C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-12 19:06:28
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\RtlGina2.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-12 19:18:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-12 17:18:12

Pre-Run: 35,215,790,080 octets libres
Post-Run: 37,004,578,816 octets libres

220 --- E O F --- 2008-06-11 12:04:51

Petit up si ca derange personne ^^

re!

Voici la suite >>

Désinstalle ce programme si tu trouves >> EoEngine ou/et eoRezo

1°) Rend toi sur cette page afin de télécharger le fichier CFScript > http://www.sendspace.com/file/0rothy
pour cela, clique sur le lien en bas de page > Download Link: CFScript

• Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
  
  
• Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!
  Ne touche à rien tant que le scan n'est pas terminé.
  
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
  
• Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

2°) Fais un scan en ligne >>

Assure toi que les contrôles activeX soient bien configurés dans les options internet comme décrit sur ce lien=> Cybersécurité

• Fais un scan en ligne Kaspersky
  
• Clique sur Accept
  
• Une barre jaune va te demander si tu acceptes d'installer le Kavwebscan_Unicode.cab, installe l'Active X.
  
• clique une nouvelle fois sur "Accept"
  
• Les bases de mises à jour vont s'installer, patiente un moment
  
• Clique sur Next.
  
• Clique sur My Computer, le scan se met en route; attends la fin du scan sans fermer la fenêtre sinon il s'arrêtera.

A la fin du scan, si des objets infectés sont découverts, clique sur Save report as... Choisis bureau et nomme le rapport "rapport Kaspersky" et dans le champ d'enregistrement, choisis "fichiers texte" enregistre alors le rapport.

Copie/colle l'entièreté du fichier texte ouvert, par clic droit dessus, sélectionner tout/copier.

Colle ce rapport dans ta réponse sur le forum.

Aide en cas de problème :Cybersécurité

NOTE: Le scan est à faire avec Internet Explorer.

poste les deux rapports stp ainsi qu'un nouveau rapport hijackthis.

@+

Re thanos ^^


Premier Rapport :



ComboFix 08-06-10.5 - Lodoss 2008-06-13 0:47:51.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.176 [GMT 2:00]
Endroit: C:\Documents and Settings\Lodoss\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Lodoss\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Lodoss\Application Data\EoRezo
C:\Documents and Settings\Lodoss\Application Data\EoRezo\cmhost.cyp
C:\Documents and Settings\Lodoss\Application Data\EoRezo\ConfMedia.cyp
C:\Documents and Settings\Lodoss\Application Data\EoRezo\db\cat.cyp
C:\Documents and Settings\Lodoss\Application Data\EoRezo\eoDesktop\config.xml
C:\Documents and Settings\Lodoss\Application Data\EoRezo\eoDesktop\eoDesktop.html
C:\Documents and Settings\Lodoss\Application Data\EoRezo\eoDesktop\userConfig.xml
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather.cfg
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\EoWeather.cfg
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\EoWeatherVal_02EC282.cfg
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\67_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\67_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\69_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\69_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\70_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\70_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\78_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\78_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\82_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\82_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\83_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\83_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\84_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\84_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\85_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\85_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\89_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\89_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\back.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\background.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\background_1.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\background_1days.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\background_2days.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\background_7days.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\backPressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\band.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\band_small.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\close.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\closePressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\dayPrevisionBackground.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\dayPrevisionClose.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\earth.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\fonds_écran.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\help.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\helpPressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\minimise.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\minimisePressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\next.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\nextPressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\option.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\optionPressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\reflet_ecran.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\small_background.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_classic\Thumbs.db
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\67_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\67_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\69_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\69_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\70_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\70_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\78_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\78_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\82_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\82_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\83_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\83_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\84_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\84_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\85_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\85_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\89_day.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\89_night.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\about.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\back.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\background.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\background_1.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\background_1days.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\background_2days.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\background_7days.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\backPressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\close.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\closePressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\dayPrevisionBackground.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\dayPrevisionClose.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\earth.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\fonds_écran.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\help.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\helpPressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\minimise.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\minimisePressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\next.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\nextPressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\option.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\optionPressed.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\reflet_ecran.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\Thumbs.db
C:\Documents and Settings\Lodoss\Application Data\EoRezo\EoWeather\images_station_meteo\txt_14x13.png
C:\Documents and Settings\Lodoss\Application Data\EoRezo\host.cyp
C:\Documents and Settings\Lodoss\Application Data\EoRezo\towns.cfg
C:\Documents and Settings\Lodoss\Application Data\EoRezo\user.cyp
C:\PROGRA~1\ALWILS~1
C:\Program Files\BOONTY
C:\Program Files\BOONTY\Components\J_apprends_la_guitare_Electrique_Telecharger(fr_2566){246440}.exe
C:\Program Files\EoRezo
C:\Program Files\EoRezo\EoAdv\EoAdv.dll
C:\Program Files\EoRezo\EoAdv\eoAdv.url
C:\Program Files\EoRezo\EoAdv\tmp\eoRezoBho.dll.3861
C:\Program Files\EoRezo\EoAdv\tmp\eoRezoBho.dll.5841
C:\Program Files\EoRezo\EoEngine.exe
C:\Program Files\EoRezo\EoMultiLanguage.dll
C:\Program Files\EoRezo\EoRezoTools_16.dll
C:\Program Files\EoRezo\EoRezoTools_25.dll
C:\Program Files\EoRezo\FreeImage.dll
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-12 to 2008-06-12 ))))))))))))))))))))))))))))))))))))
.

2008-06-12 16:24 . 2008-06-12 16:24 4,551,483 --a------ C:\WINDOWS\system32\Les métiers du combat.scr
2008-06-11 11:11 . 2008-04-14 17:52 272,768 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-06 21:08 . 2008-06-12 23:33 <REP> d-------- C:\Program Files\uTorrent
2008-06-06 21:08 . 2008-06-13 00:52 <REP> d-------- C:\Documents and Settings\Lodoss\Application Data\uTorrent
2008-06-05 10:59 . 2008-06-09 09:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-05 10:59 . 2008-06-05 10:59 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-20 23:37 . 2008-05-20 23:37 <REP> d-------- C:\Program Files\Command & Conquer Collection
2008-05-20 20:59 . 2008-05-20 20:59 <REP> d-------- C:\Program Files\Veoh Networks
2008-05-20 20:58 . 2008-05-20 20:58 <REP> d-------- C:\WINDOWS\Downloaded Installations
2008-05-20 20:31 . 2008-05-20 20:31 <REP> d-------- C:\Program Files\DivX
2008-05-14 14:18 . 2008-05-14 14:18 <REP> d-------- C:\Documents and Settings\Lodoss\Application Data\ItsLabel
2008-05-14 09:23 . 2008-05-14 09:24 <REP> d-------- C:\Program Files\Defcon
2008-05-13 16:39 . 2008-06-12 19:08 <REP> d-------- C:\Program Files\ItsLabel
2008-05-13 03:51 . 2008-05-13 03:51 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-05-13 03:51 . 2008-05-13 03:51 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-12 16:33 --------- d-----w C:\Documents and Settings\Lodoss\Application Data\Azureus
2008-06-12 16:23 --------- d-----w C:\Program Files\Valve
2008-06-01 22:10 --------- d-----w C:\Documents and Settings\Lodoss\Application Data\AVGTOOLBAR
2008-05-20 19:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-20 17:00 --------- d-----w C:\Documents and Settings\Lodoss\Application Data\Winamp
2008-05-16 14:18 --------- d-----w C:\Program Files\eMule
2008-05-15 13:06 --------- d-----w C:\Program Files\Astonsoft
2008-05-14 16:51 --------- d-----w C:\Program Files\MSN Spy 2004
2008-05-14 16:51 --------- d-----w C:\Program Files\LimeWire
2008-05-14 16:50 --------- d-----w C:\Program Files\Zylom Games
2008-05-14 16:50 --------- d-----w C:\Program Files\Runtime Software
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:15 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-30 21:37 --------- d-----w C:\Program Files\MsnSpy
2008-04-30 17:59 1,409 ----a-w C:\WINDOWS\Fonts\SncfPre.fot
2008-04-30 17:59 1,409 ----a-w C:\WINDOWS\Fonts\sncf09.fot
2008-04-26 18:28 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-26 02:35 --------- d-----w C:\Program Files\PC Inspector File Recovery
2008-04-25 17:17 --------- d-----w C:\Program Files\Alice
2008-04-25 16:10 --------- d-----w C:\Program Files\Twain
2008-04-25 16:04 75,272 ----a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-04-25 16:03 10,520 ----a-w C:\WINDOWS\system32\avgrsstx.dll
2008-04-25 15:59 96,520 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-04-25 15:59 12,424 ----a-w C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-04-25 15:59 --------- d-----w C:\Program Files\AVG
2008-04-25 15:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-04-25 14:45 --------- d-----w C:\Program Files\Fichiers communs\Panda Software
2008-04-17 10:52 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2008-04-15 12:18 --------- d-----w C:\Program Files\Dofus
2008-04-14 15:52 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-25 04:51 194,144 ------w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,376 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2008-02-25 18:57 10 ----a-w C:\Program Files\.autoreg
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-05-08 16:53 3640368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-10-13 17:01 277296]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51 257088]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 13:22 86016]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-04-25 18:04 1177368]
"ItsTV"="C:\Program Files\ItsLabel\ItsTV.exe" [2007-04-26 16:19 2908160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.DIV4"= divxc32f.dll
"VIDC.DIV3"= divxc32.dll
"MSACM.DIVXA32"= divxa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Access Password Recovery]
C:\Program Files\Intelore\Access Password Recovery\AccessPasswordRecovery.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra------ 2007-03-01 11:37 2321600 C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-20 01:09 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\flockbox]
--a------ 2007-12-14 17:59 1071472 C:\Sierra\My Lockbox\flockbox.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-12-05 15:41 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2006-01-07 06:26 176128 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
--a------ 2006-01-07 06:26 491520 C:\WINDOWS\system32\hphmon05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
--a------ 2006-01-07 06:26 49152 C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-04-17 12:41 196608 C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-04-13 06:07 69632 C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-11-30 11:40 1266936 C:\Program Files\Valve\Steam\\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-07-12 04:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]
--a------ 2006-10-13 17:04 707376 C:\WINDOWS\vVX1000.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-04-25 17:59]
R0 MPRIFL;MPRIFL;C:\WINDOWS\system32\DRIVERS\MPRIFL.SYS [2007-12-13 21:13]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-04-25 17:59]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-04-25 18:03]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-04-25 18:04]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2006-10-13 17:01]
R3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-10-13 17:04]
S2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-04-25 17:59]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 17:53]
S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-04 08:04]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-06-12 20:54:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-12 19:00:02 C:\WINDOWS\Tasks\HP Usg Daily.job"
- C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-13 00:52:41
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...


**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Boonty Games]
"ImagePath"="\"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe\""
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\RtlGina2.dll
.
Temps d'accomplissement: 2008-06-13 0:56:34
ComboFix-quarantined-files.txt 2008-06-12 22:55:29
ComboFix2.txt 2008-06-12 17:18:20

Pre-Run: 36,707,868,672 octets libres
Post-Run: 36,692,430,848 octets libres

299 --- E O F --- 2008-06-11 12:04:51

Tu m' escusera mais le scan de mon pc est a 0 % apres 15 mn de scan...

salut

Bien: un dossier à éliminer manuellement >> C:\Program Files\.autoreg

Citation

Ok essaie ce scan alors >>

Clique sur le lien suivant > ESET Online Scanner Link

• Coche la case YES, I accept the Terms Of Use
  
• Clique sur le bouton Start
  
• Clique ensuite sur le bouton Install
  
• Clique sur Start
  
• Le scanner va se mettre à jour.
  
• Ne coche pas la case Remove found threats
  
• Clique sur le bouton Scan
  
• Le scan va se lancer: soit patient.
  
• Lorsque le scan s'achève, clique sur le menu Details
  
• Copie/colle le contenu du rapport généré: il se trouve ici > the contents of the C:\Program Files\EsetOnlineScanner et se nomme log.txt

@+

Re c est bon j ai reussi avec kaspersky en le laissent tourner toute la nuit il n' a rien trouver et voici le rapport hjt :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:27:05, on 13/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Lodoss\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ItsTV] "C:\Program Files\ItsLabel\ItsTV.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1181245195843
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 6105 bytes

Re petit up