Bonjour à tous
Lorsque je me connect à internet des fenêtres souvre automatiquement pour me demander d'executer des fichiers .tmp.exe
que faut t'il faire pour initialiser tout ca.
De plus windows explorer se déconnecte et se reconnecte sans arret depuis ça.
merci pour votre aide.

Bonjour, bienvenue sur le forum.

Ca rappele le virus nimda entre autres. Quel est ton antivirus ?

Bonjour et merci
mon antivirus est norton internet sécurity

Il ne l'a peut-être pas vu, ou ce n'est peut-être pas une saleté. On va vérifier ça.
Pour voir ce qui tourne sur ta machine et pouvoir nettoyer d'éventuelles infections, il faut faire quelques tests.

Voici comment démarrer.
Poste un rapport Hijackthis (v2.0.2) dans ta prochaine réponse stp :
Voici un tuto avec les liens nécessaires :
http://www.libellules.ch/poster_log_hijackthis.php

Merci beaucoup falkra
je ne pourrais faire ça que ce soir car je suis au boulot
je te tiens au courant
A+

Ok.
Ca permettre de voir si c'est une affaire de virus ou pas.

@ toute

bonjour
comme convenu je te poste le rapport d'analyse
Merci
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:43:03, on 05/03/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\Explorer.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hp\kbd\kbd.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Users\sandrine\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BrowserCmp - {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} - C:\Windows\system32\iebrowserc.dll
O2 - BHO: ContextEnhancer - {4C6C4BA2-1646-0F3A-1FAE-B393C162C92E} - C:\Program Files\ContextEnhancer\ContextEnhancer-4.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: dcads - {733716E1-76D2-4003-AC39-845281C0EF85} - C:\Windows\system32\nsd7918.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MySidesearch Search Assistant - {DDFA1356-E6ED-42a5-9D62-93211D424A90} - C:\Windows\system32\mysidesearch_sidebar.dll
O2 - BHO: (no name) - {F84E7511-6055-4F70-AC6E-B82FF4AA4811} - C:\Windows\system32\CddbPlaylist2Roxi.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Afficher Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 7829 bytes

Ouh, il y a du monde, ton pc est multiplement infecté. On va prendre tout ça dans l'ordre.

* Télécharge SmitFraudFix de S!Ri sur le bureau.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe
* Double-clique sur smitfraudfix.exe
* Choisis l'option 1 pour créer un rapport des fichiers responsables de l'infection.
* Poste le rapport sur le forum dans ta prochaine réponse.

Si process.exe est détecté par ton antivirus ou un autre logiciel, n'en tiens pas compte (choisis d'ignorer) et ne bloque pas le fichier, il sert à terminer des processus, d'où l'alerte émise par ces antivirus qui y voient un danger potentiel. (doc).

voila le résultat
SmitFraudFix v2.300

Scan done at 20:38:15,92, 05/03/2008
Run from C:\Users\sandrine\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\System32\mobsync.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\hp\kbd\kbd.exe
C:\Windows\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\sandrine


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\sandrine\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\sandrine\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000000


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8101 Family PCI-E Fast Ethernet NIC (NDIS 6.0)
DNS Server Search Order: 212.27.53.252
DNS Server Search Order: 212.27.54.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{4E5D6975-707B-469C-9818-C36FD4033274}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4E5D6975-707B-469C-9818-C36FD4033274}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4E5D6975-707B-469C-9818-C36FD4033274}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

Rien ? Pas drôle. On va essayer de virer en groupant. Je vais te demander deux rapports et on passe aux hostilités.

Premier rapport.

Télécharge DiagHelp.zip de Malekal_morte sur ton bureau.

• Décompresse-le, sur ton bureau par exemple.
• Un nouveau dossier chercher va être créé DiagHelp.
• Ouvre le et double-clique sur go.cmd (le .cmd peut ne pas apparaître)
• Une fenêtre va s'ouvrir, choisis l'option 1 et valide avec la touche entrée.
• L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande
• Copie/colle le contenu du bloc-note qui s'ouvre et joins-le à ta prochaine réponse.
• Le rapport est sauvegardé dans c:\resultat.txt il faudra aller le chercher éventuellement.
  
  NB : si un antivirus détecte Troj/INJECT MF choisis "ignorer" c'est une fausse alerte.
  NB : un outil, sigcheck.exe, peut demander l'accès à internet, si ton firewall te demande l'autorisation, laisse-le accéder à internet.

cela ne fonctionne pas on me met un message d'erreur run time error 52 bad file name or number et ce la plusieurs fois meme si je fais ok je n'ai pas de rapport

Tu es sous Vista, c'est certainement l'UAC.

Désactive l'UAC-User Account Control -contrôle des comptes utilisateurs :

* Démarrer > Panneau de Configuration
* Double clique sur l'icône Comptes d'utilisateurs
* Clique ensuite sur Désactiver et valide.

Puis fais le rapport diaghelp.

Réactive l'UAC une fois que c'est terminé.

effectivement ca marche mieux voila le résultat
DiagHelp version v1.4 - http://www.malekal.com
excute le 05/03/2008 à 21:21:29,12


Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\Windows\prefetch\CHCP.COM-950EAF32.pf -->05/03/2008 21:21:27
C:\Windows\prefetch\WMPNSCFG.EXE-DF1DD51A.pf -->05/03/2008 21:21:08
C:\Windows\prefetch\WMIPRVSE.EXE-43972D0F.pf -->05/03/2008 21:20:56
C:\Windows\prefetch\UPD2476.TMP.EXE-5CA731F7.pf -->05/03/2008 21:20:56
C:\Windows\prefetch\DLLHOST.EXE-A1CD8B86.pf -->05/03/2008 21:20:56
C:\Windows\prefetch\COH32.EXE-D1B20C81.pf -->05/03/2008 21:20:56
C:\Windows\prefetch\AgGlFgAppHistory.db -->05/03/2008 21:18:59
C:\Windows\prefetch\AgGlGlobalHistory.db -->05/03/2008 21:18:58
C:\Windows\prefetch\AgGlFaultHistory.db -->05/03/2008 21:18:58
C:\Windows\prefetch\PfSvPerfStats.bin -->05/03/2008 21:18:54

C:\Windows\System32\drivers\mrxdav.sys -->14/02/2008 03:12:52
C:\Windows\System32\drivers\WdfLdr.sys -->14/02/2008 03:10:51
C:\Windows\System32\drivers\Wdf01000.sys -->14/02/2008 03:10:51
C:\Windows\System32\drivers\sermouse.sys -->14/02/2008 03:10:50
C:\Windows\System32\drivers\mouhid.sys -->14/02/2008 03:10:50
C:\Windows\System32\drivers\mouclass.sys -->14/02/2008 03:10:50
C:\Windows\System32\drivers\kbdclass.sys -->14/02/2008 03:10:49

C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 -->05/03/2008 21:20:06
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 -->05/03/2008 21:20:06
C:\Windows\System32\tmp.txt -->05/03/2008 20:38:19
C:\Windows\System32\tmp.reg -->05/03/2008 20:38:19
C:\Windows\System32\PerfStringBackup.INI -->05/03/2008 19:13:37
C:\Windows\System32\perfh00C.dat -->05/03/2008 19:13:37
C:\Windows\System32\perfh009.dat -->05/03/2008 19:13:37
C:\Windows\System32\perfc00C.dat -->05/03/2008 19:13:37
C:\Windows\System32\perfc009.dat -->05/03/2008 19:13:37
C:\Windows\System32\VACFix.exe -->01/03/2008 23:12:41
C:\Windows\System32\DcadsSocial-uninstall.exe -->01/03/2008 10:53:41
C:\Windows\System32\mysidesearch_sidebar_uninstall.exe -->01/03/2008 10:50:53
C:\Windows\System32\dcads-remove.exe -->01/03/2008 10:50:22
C:\Windows\System32\IEDFix.exe -->29/02/2008 23:48:02
C:\Windows\System32\mysidesearch_sidebar.dll -->25/02/2008 15:34:48
C:\Windows\System32\WebClnt.dll -->14/02/2008 03:12:52
C:\Windows\System32\wpd_ci.dll -->14/02/2008 03:10:55
C:\Windows\System32\drvinst.exe -->14/02/2008 03:10:54
C:\Windows\System32\clfs.sys -->14/02/2008 03:10:54
C:\Windows\System32\cfgmgr32.dll -->14/02/2008 03:10:54
C:\Windows\System32\umpnpmgr.dll -->14/02/2008 03:10:53
C:\Windows\System32\dpx.dll -->14/02/2008 03:10:53
C:\Windows\System32\setupapi.dll -->14/02/2008 03:10:52
C:\Windows\System32\oleaut32.dll -->14/02/2008 03:10:52
C:\Windows\System32\kbd106n.dll -->14/02/2008 03:10:52

C:\Windows\bootstat.dat -->05/03/2008 21:19:55
C:\Windows\WindowsUpdate.log -->05/03/2008 21:18:53
C:\Windows\PFRO.log -->03/03/2008 09:52:44
C:\Windows\setupact.log -->23/02/2008 12:58:29
C:\Windows\S84BF1DA8.tmp -->03/02/2008 18:56:40
C:\Windows\DirectX.log -->01/02/2008 15:11:01
C:\Windows\win.ini -->31/01/2008 14:49:48
C:\Windows\king-uninstall.exe -->31/01/2008 14:28:17
C:\Windows\msxml4-KB941833-enu.LOG -->31/01/2008 13:06:35
C:\Windows\WindowsShell.Manifest -->31/01/2008 11:09:55
C:\Windows\explorer.exe -->31/01/2008 11:00:44
C:\Windows\msxml4-KB936181-enu.LOG -->31/01/2008 10:50:40
C:\Windows\DtcInstall.log -->24/09/2007 10:40:59
C:\Windows\TSSysprep.log -->24/09/2007 10:37:23
C:\Windows\xpsp1hfm.log -->14/09/2007 22:09:07

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed


ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - http://www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 1888
Command line: C:\Windows\Explorer.EXE

Base Size Version Path
0x002f0000 0x2cd000 6.00.6000.16549 C:\Windows\Explorer.EXE
0x77940000 0x11e000 6.00.6000.16386 C:\Windows\system32\ntdll.dll
0x77aa0000 0xd8000 6.00.6000.16386 C:\Windows\system32\kernel32.dll
0x768c0000 0xbf000 6.00.6000.16386 C:\Windows\system32\ADVAPI32.dll
0x769a0000 0xc3000 6.00.6000.16525 C:\Windows\system32\RPCRT4.dll
0x777f0000 0x4b000 6.00.6000.16386 C:\Windows\system32\GDI32.dll
0x778a0000 0x9e000 6.00.6000.16438 C:\Windows\system32\USER32.dll
0x76aa0000 0xaa000 7.00.6000.16386 C:\Windows\system32\msvcrt.dll
0x77840000 0x55000 6.00.6000.16386 C:\Windows\system32\SHLWAPI.dll
0x76bd0000 0xace000 6.00.6000.16513 C:\Windows\system32\SHELL32.dll
0x776a0000 0x144000 6.00.6000.16386 C:\Windows\system32\ole32.dll
0x764a0000 0x8c000 6.00.6000.16609 C:\Windows\system32\OLEAUT32.dll
0x73350000 0x107000 6.00.6000.16386 C:\Windows\system32\SHDOCVW.dll
0x752a0000 0x3f000 6.00.6000.16386 C:\Windows\system32\UxTheme.dll
0x75550000 0x1a000 6.00.6000.16386 C:\Windows\system32\POWRPROF.dll
0x74000000 0xc000 6.00.6000.20640 C:\Windows\system32\dwmapi.dll
0x74a50000 0x1aa000 5.02.6000.16386 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16386_none_9ea0ac9ec96e7127\gdiplus.dll
0x75b20000 0x39000 6.00.6000.16509 C:\Windows\system32\slc.dll
0x74c70000 0xb7000 6.00.6000.16386 C:\Windows\system32\PROPSYS.dll
0x73200000 0x145000 6.00.6000.16386 C:\Windows\system32\BROWSEUI.dll
0x76980000 0x1e000 6.00.6000.16386 C:\Windows\system32\IMM32.dll
0x76610000 0xc7000 6.00.6000.16386 C:\Windows\system32\MSCTF.dll
0x75270000 0x30000 6.00.6000.16386 C:\Windows\system32\DUser.dll
0x77a60000 0x9000 6.00.6000.16386 C:\Windows\system32\LPK.DLL
0x76200000 0x7d000 1.626.6000.16386 C:\Windows\system32\USP10.dll
0x74fa0000 0x194000 6.10.6000.16386 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll
0x74450000 0xb2000 6.00.6000.16493 C:\Windows\system32\WindowsCodecs.dll
0x73850000 0x6000 6.00.6000.16386 C:\Windows\system32\IconCodecService.dll
0x76030000 0x2c000 6.00.6000.16386 C:\Windows\system32\apphelp.dll
0x76090000 0x14000 6.00.6000.16386 C:\Windows\system32\Secur32.dll
0x76410000 0x84000 2001.12.6930.16386 C:\Windows\system32\CLBCatQ.DLL
0x75620000 0x38000 6.00.6000.16386 C:\Windows\system32\rsaenh.dll
0x72880000 0xb2000 6.00.6000.16549 C:\Windows\system32\timedate.cpl
0x74850000 0x14000 3.05.2284.0000 C:\Windows\system32\ATL.DLL
0x75dd0000 0x6a000 6.00.6000.16386 C:\Windows\system32\NETAPI32.dll
0x76160000 0x7000 6.00.6000.16386 C:\Windows\system32\PSAPI.DLL
0x74d70000 0x38000 4.02.5406.0000 C:\Windows\system32\OLEACC.dll
0x72820000 0x53000 6.00.6000.16386 C:\Windows\system32\actxprxy.dll
0x760b0000 0x1e000 6.00.6000.16386 C:\Windows\system32\USERENV.dll
0x725e0000 0x2b000 6.00.6000.16386 C:\Windows\system32\msutb.dll
0x756e0000 0xd7000 6.00.6000.16386 C:\Windows\system32\WINBRAND.dll
0x74d30000 0x16000 6.00.6000.16386 C:\Windows\System32\shacct.dll
0x75cd0000 0x11000 6.00.6000.16386 C:\Windows\System32\SAMLIB.dll
0x72480000 0x3c000 6.00.6000.16404 C:\Windows\System32\msshsq.dll
0x72050000 0xc5000 6.00.6000.16386 C:\Windows\System32\NaturalLanguage6.dll
0x75b60000 0xf1000 6.00.6000.16425 C:\Windows\System32\CRYPT32.dll
0x75cb0000 0x12000 6.00.6000.16386 C:\Windows\System32\MSASN1.dll
0x71b30000 0x28c000 6.00.6000.16386 C:\Windows\System32\NLSData000c.dll
0x70f30000 0x5f4000 6.00.6000.16386 C:\Windows\System32\NLSLexicons000c.dll
0x74db0000 0x1e7000 6.00.6000.16513 C:\Windows\system32\authui.dll
0x75540000 0x5000 6.00.6000.16386 C:\Windows\system32\MSIMG32.dll
0x766f0000 0x127000 7.00.6000.16609 C:\Windows\system32\urlmon.dll
0x76820000 0x45000 7.00.6000.16386 C:\Windows\system32\iertutil.dll
0x75570000 0x21000 6.00.6000.16386 C:\Windows\system32\NTMARTA.DLL
0x76870000 0x49000 6.00.6000.16386 C:\Windows\system32\WLDAP32.dll
0x77a70000 0x2d000 6.00.6000.16386 C:\Windows\system32\WS2_32.dll
0x766e0000 0x6000 6.00.6000.16386 C:\Windows\system32\NSI.dll
0x71560000 0x5cd000 7.00.6000.16609 C:\Windows\system32\ieframe.dll
0x72ae0000 0x9000 6.00.6000.16386 C:\Windows\system32\LINKINFO.dll
0x75140000 0x33000 6.00.6000.16386 C:\Windows\system32\WINMM.dll
0x748d0000 0x30000 6.00.6000.16386 C:\Windows\system32\wdmaud.drv
0x748c0000 0x4000 6.00.6000.16386 C:\Windows\system32\ksuser.dll
0x752e0000 0x7000 6.00.6000.16386 C:\Windows\system32\AVRT.dll
0x75240000 0x27000 6.00.6000.20564 C:\Windows\system32\MMDevAPI.DLL
0x76280000 0x189000 6.00.6000.16609 C:\Windows\system32\SETUPAPI.dll
0x74c00000 0x2d000 6.00.6000.16386 C:\Windows\system32\WINTRUST.dll
0x76a70000 0x29000 6.00.6000.16470 C:\Windows\system32\imagehlp.dll
0x746a0000 0x21000 6.00.6000.16386 C:\Windows\System32\audioses.dll
0x74630000 0x66000 6.00.6000.16386 C:\Windows\System32\audioeng.dll
0x74840000 0x9000 6.00.6000.16386 C:\Windows\system32\msacm32.drv
0x747f0000 0x15000 6.00.6000.16386 C:\Windows\system32\MSACM32.dll
0x74620000 0x7000 6.00.6000.16386 C:\Windows\system32\midimap.dll
0x72a50000 0x4a000 6.00.6000.16386 C:\Windows\system32\ntshrui.dll
0x72ad0000 0xa000 6.00.6000.16386 C:\Windows\system32\cscapi.dll
0x72ac0000 0x9000 6.00.6000.16386 C:\Windows\system32\ExplorerFrame.dll
0x76540000 0xcf000 7.00.6000.16609 C:\Windows\system32\WININET.dll
0x76530000 0x3000 6.00.6000.16386 C:\Windows\system32\Normaliz.dll
0x74d60000 0x7000 4.00.6000.16386 C:\Windows\system32\msiltcfg.dll
0x75900000 0x8000 6.00.6000.16386 C:\Windows\system32\VERSION.dll
0x72eb0000 0x204000 4.00.6000.16386 C:\Windows\system32\msi.dll
0x729b0000 0x92000 6.00.6000.16386 C:\Windows\system32\stobject.dll
0x71ea0000 0xb6000 6.00.6000.16386 C:\Windows\system32\BatMeter.dll
0x75470000 0x9000 6.00.6000.16553 C:\Windows\system32\WTSAPI32.dll
0x755d0000 0x24000 6.00.6000.16386 C:\Windows\system32\WINSTA.dll
0x74510000 0x45000 2001.12.6930.16386 C:\Windows\system32\es.dll
0x75370000 0x30000 6.00.6000.16386 C:\Windows\System32\SndVolSSO.dll
0x75340000 0x21000 6.00.6000.16386 C:\Windows\ehome\ehSSO.dll
0x74610000 0x9000 6.00.6000.16386 C:\Windows\system32\HID.DLL
0x70910000 0x30b000 6.00.6000.16386 C:\Windows\System32\netshell.dll
0x75ac0000 0x19000 6.00.6000.16386 C:\Windows\System32\IPHLPAPI.DLL
0x75a80000 0x35000 6.00.6000.16512 C:\Windows\System32\dhcpcsvc.DLL
0x75cf0000 0x2b000 6.00.6000.20492 C:\Windows\System32\DNSAPI.dll
0x75a70000 0x7000 6.00.6000.16386 C:\Windows\System32\WINNSI.DLL
0x75a50000 0x20000 6.00.6000.16512 C:\Windows\System32\dhcpcsvc6.DLL
0x74870000 0xf000 6.00.6000.16386 C:\Windows\System32\nlaapi.dll
0x75480000 0x63000 6.00.6000.16501 C:\Windows\system32\FirewallAPI.dll
0x70d70000 0x1bf000 6.00.6000.16386 C:\Windows\system32\pnidui.dll
0x753b0000 0x17000 6.00.6000.16386 C:\Windows\system32\QUtil.dll
0x75ae0000 0x3e000 6.00.6000.16386 C:\Windows\system32\wevtapi.dll
0x753a0000 0x6000 6.00.6000.16386 C:\Windows\system32\wlanutil.dll
0x725b0000 0x27000 6.00.6000.16386 C:\Windows\system32\FunDisc.dll
0x75330000 0x9000 6.00.6000.16386 C:\Windows\system32\fdproxy.dll
0x72350000 0x126000 8.90.1101.0000 C:\Windows\System32\msxml3.dll
0x70260000 0x8000 6.00.6000.16386 C:\Windows\System32\npmproxy.dll
0x6fe00000 0xe000 6.00.6000.16551 C:\Windows\system32\Wlanapi.dll
0x6ea20000 0x2d000 6.00.6000.16386 C:\Windows\system32\OneX.DLL
0x6f9a0000 0xd000 6.00.6000.16386 C:\Windows\system32\eappprxy.dll
0x6e9f0000 0x28000 6.00.6000.16386 C:\Windows\system32\eappcfg.dll
0x759b0000 0x44000 6.00.6000.16386 C:\Windows\system32\bcrypt.dll
0x6e9d0000 0xd000 6.00.6000.16386 C:\Windows\System32\AltTab.dll
0x6e920000 0x23000 6.00.6000.16386 C:\Windows\system32\wpdshserviceobj.dll
0x72e00000 0x5f000 6.00.6000.16386 C:\Windows\system32\WINHTTP.dll
0x6e8e0000 0x40000 6.00.6000.16386 C:\Windows\System32\srchadmin.dll
0x6dd60000 0x3c000 7.00.6000.16386 C:\Windows\system32\webcheck.dll
0x6d920000 0x21c000 6.00.6000.16386 C:\Windows\System32\SyncCenter.dll
0x6e990000 0x39000 6.00.6000.16386 C:\Windows\system32\wscntfy.dll
0x729a0000 0xb000 6.00.6000.16386 C:\Windows\system32\WSCAPI.dll
0x6e770000 0x51000 6.00.6000.16386 C:\Windows\system32\imapi2.dll
0x70850000 0xb000 6.00.6000.16386 C:\Windows\system32\mssprxy.dll
0x75890000 0x3b000 6.00.6000.16386 C:\Windows\system32\mswsock.dll
0x75530000 0x6000 6.00.6000.16386 C:\Windows\System32\wshtcpip.dll
0x758f0000 0x6000 6.00.6000.16386 C:\Windows\System32\wship6.dll
0x72320000 0x8000 6.00.6000.16386 C:\Windows\System32\winrnr.dll
0x72310000 0xf000 6.00.6000.16386 C:\Windows\system32\napinsp.dll
0x72140000 0x12000 6.00.6000.16386 C:\Windows\system32\pnrpnsp.dll
0x73860000 0x6000 6.00.6000.16386 C:\Windows\system32\rasadhlp.dll
0x10000000 0x19000 1.00.0000.0003 C:\Program Files\SlySoft\AnyDVD\ADvdDiscHlp.dll
0x6ede0000 0x2b000 6.00.6000.16386 C:\Windows\system32\PortableDeviceTypes.dll
0x6fee0000 0x46000 6.00.6000.16386 C:\Windows\system32\PortableDeviceApi.dll
0x75f70000 0x5f000 6.00.6000.16386 C:\Windows\system32\SXS.DLL
0x6ba30000 0xf9000 6.00.6000.16386 C:\Windows\system32\bthprops.cpl
0x6f730000 0x2c000 6.00.6000.16386 C:\Windows\System32\QAgent.dll
0x72520000 0x8a000 6.00.6000.16386 C:\Windows\System32\fwpuclnt.dll
0x75c60000 0x14000 6.00.6000.16386 C:\Windows\system32\MPR.dll
0x6e1a0000 0x60000 6.00.6000.16386 C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
0x02d20000 0x10000 8.00.0000.0456 C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
0x73930000 0x9b000 8.00.50727.0762 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCR80.dll
0x03250000 0x4a000 1.00.0000.0000 C:\Windows\system32\iebrowserc.dll
0x739d0000 0x87000 8.00.50727.0762 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCP80.dll
0x6b170000 0x9a000 107.00.0003.0007 C:\Program Files\Common Files\Symantec Shared\ccL70U.dll
0x75210000 0x22000 1.01.1002.0000 C:\Windows\system32\xmllite.dll
0x70810000 0x12000 6.00.6000.16386 C:\Windows\system32\thumbcache.dll
0x74c50000 0x14000 6.00.6000.16386 C:\Windows\system32\Cabinet.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - http://www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 744
Command line: winlogon.exe

Base Size Version Path
0x007f0000 0x4e000 6.00.6000.16386 C:\Windows\system32\winlogon.exe
0x77940000 0x11e000 6.00.6000.16386 C:\Windows\system32\ntdll.dll
0x77aa0000 0xd8000 6.00.6000.16386 C:\Windows\system32\kernel32.dll
0x768c0000 0xbf000 6.00.6000.16386 C:\Windows\system32\ADVAPI32.dll
0x769a0000 0xc3000 6.00.6000.16525 C:\Windows\system32\RPCRT4.dll
0x778a0000 0x9e000 6.00.6000.16438 C:\Windows\system32\USER32.dll
0x777f0000 0x4b000 6.00.6000.16386 C:\Windows\system32\GDI32.dll
0x76aa0000 0xaa000 7.00.6000.16386 C:\Windows\system32\msvcrt.dll
0x76090000 0x14000 6.00.6000.16386 C:\Windows\system32\Secur32.dll
0x755d0000 0x24000 6.00.6000.16386 C:\Windows\system32\WINSTA.dll
0x76160000 0x7000 6.00.6000.16386 C:\Windows\system32\PSAPI.DLL
0x760b0000 0x1e000 6.00.6000.16386 C:\Windows\system32\USERENV.dll
0x76980000 0x1e000 6.00.6000.16386 C:\Windows\system32\IMM32.DLL
0x76610000 0xc7000 6.00.6000.16386 C:\Windows\system32\MSCTF.dll
0x77a60000 0x9000 6.00.6000.16386 C:\Windows\system32\LPK.DLL
0x76200000 0x7d000 1.626.6000.16386 C:\Windows\system32\USP10.dll
0x76030000 0x2c000 6.00.6000.16386 C:\Windows\system32\apphelp.dll
0x75570000 0x21000 6.00.6000.16386 C:\Windows\system32\NTMARTA.DLL
0x76870000 0x49000 6.00.6000.16386 C:\Windows\system32\WLDAP32.dll
0x77a70000 0x2d000 6.00.6000.16386 C:\Windows\system32\WS2_32.dll
0x766e0000 0x6000 6.00.6000.16386 C:\Windows\system32\NSI.dll
0x75cd0000 0x11000 6.00.6000.16386 C:\Windows\system32\SAMLIB.dll
0x776a0000 0x144000 6.00.6000.16386 C:\Windows\system32\ole32.dll
0x745b0000 0x3e000 6.00.6000.16386 C:\Windows\system32\SHSVCS.dll
0x752a0000 0x3f000 6.00.6000.16386 C:\Windows\system32\uxtheme.dll
0x75620000 0x38000 6.00.6000.16386 C:\Windows\system32\rsaenh.dll
0x74450000 0xb2000 6.00.6000.16493 C:\Windows\system32\WindowsCodecs.dll
0x75dd0000 0x6a000 6.00.6000.16386 C:\Windows\system32\NETAPI32.dll
0x75b20000 0x39000 6.00.6000.16509 C:\Windows\system32\slc.dll
0x75c60000 0x14000 6.00.6000.16386 C:\Windows\system32\MPR.dll


Le volume dans le lecteur C s'appelle HP
Le numéro de série du volume est 0E4E-466E

Répertoire de C:\Windows\system32

02/11/2006 10:45 7 680 csrss.exe
1 fichier(s) 7 680 octets
0 Rép(s) 230 782 337 024 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle HP
Le numéro de série du volume est 0E4E-466E

Répertoire de C:\Windows\Downloaded Program Files

31/01/2008 14:23 <REP> .
31/01/2008 14:23 <REP> ..
18/09/2006 22:26 65 desktop.ini
04/01/2008 09:51 144 swdir.inf
2 fichier(s) 209 octets

Total des fichiers listés :
2 fichier(s) 209 octets
2 Rép(s) 230 782 337 024 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..


Liste des fichiers en exception sur le pare-feu XP SP2

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]



exports des policies
REGEDIT4

[System]
"ConsentPromptBehaviorAdmin"=dword:00000002
"ConsentPromptBehaviorUser"=dword:00000001
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000000
"EnableSecureUIAPaths"=dword:00000001
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"scforceoption"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"FilterAdministratorToken"=dword:00000000

[System\UIPI]

[System\UIPI\Clipboard]

[System\UIPI\Clipboard\ExceptionFormats]
"CF_TEXT"=dword:00000001
"CF_BITMAP"=dword:00000002
"CF_OEMTEXT"=dword:00000007
"CF_DIB"=dword:00000008
"CF_PALETTE"=dword:00000009
"CF_UNICODETEXT"=dword:0000000d
"CF_DIBV5"=dword:00000011



Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-05 21:21:53
Windows 6.0.6000 NTFS

scanning hidden services & system hive ...

IPC error: 2 Le fichier spécifié est introuvable.
scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (http://www.security.org.sg)

Sorry, this version supports only Win2K/XP

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (http://www.security.org.sg)

Sorry, this version supports only Win2K/XP

Le volume dans le lecteur C s'appelle HP
Le numéro de série du volume est 0E4E-466E

Répertoire de C:\Program Files

04/03/2008 22:13 <REP> .
04/03/2008 22:13 <REP> ..
14/09/2007 22:17 <REP> Adobe
01/03/2008 10:50 <REP> Adssite Games Collection
14/09/2007 22:01 <REP> ATI
14/09/2007 22:03 <REP> ATI Technologies
02/02/2008 10:21 <REP> Azureus
06/02/2008 20:11 <REP> Common Files
05/03/2008 21:20 <REP> ContextEnhancer
31/01/2008 19:03 <REP> DivX
31/01/2008 12:37 <REP> DVD Shrink
15/09/2007 06:59 <REP> EasyBits
03/02/2008 20:03 <REP> Elaborate Bytes
04/03/2008 22:13 <REP> Google
14/09/2007 22:24 <REP> Hewlett-Packard
01/02/2008 16:36 <REP> HomePlayer1.5
14/09/2007 22:18 <REP> HP
14/02/2008 03:19 <REP> Internet Explorer
14/09/2007 22:18 <REP> Java
02/03/2008 11:25 <REP> LimeWire
02/11/2006 13:37 <REP> Microsoft Games
31/01/2008 12:27 <REP> Microsoft Office
03/03/2008 10:55 <REP> Microsoft Silverlight
31/01/2008 12:27 <REP> Microsoft Visual Studio
31/01/2008 12:24 <REP> Microsoft Visual Studio 8
04/03/2008 22:13 <REP> Microsoft Works
31/01/2008 12:26 <REP> Microsoft.NET
15/09/2007 07:11 <REP> Movie Maker
31/01/2008 12:27 <REP> MSBuild
02/11/2006 13:37 <REP> MSN
31/01/2008 10:50 <REP> MSXML 4.0
14/09/2007 22:16 <REP> muvee Technologies
25/02/2008 11:21 <REP> Nero
01/02/2008 10:49 <REP> Norton Internet Security
15/02/2008 15:00 <REP> Norton Security Scan
14/09/2007 22:40 <REP> PC-Doctor 5 for Windows
14/09/2007 22:05 <REP> Realtek
02/11/2006 13:37 <REP> Reference Assemblies
14/09/2007 22:15 <REP> Roxio
14/09/2007 22:26 <REP> Services en ligne
03/02/2008 19:26 <REP> SlySoft
01/02/2008 10:34 <REP> Symantec
02/02/2008 10:39 <REP> uTorrent
31/01/2008 11:06 <REP> Windows Calendar
15/09/2007 07:11 <REP> Windows Collaboration
15/09/2007 07:21 <REP> Windows Defender
15/09/2007 07:11 <REP> Windows Journal
31/01/2008 11:06 <REP> Windows Mail
31/01/2008 11:06 <REP> Windows Media Player
31/01/2008 10:33 <REP> Windows NT
15/09/2007 07:11 <REP> Windows Photo Gallery
31/01/2008 11:06 <REP> Windows Sidebar
01/02/2008 13:07 <REP> WinRAR
0 fichier(s) 0 octets
53 Rép(s) 230 775 607 296 octets libres
Le volume dans le lecteur C s'appelle HP
Le numéro de série du volume est 0E4E-466E

Répertoire de C:\Program Files\fichiers communs

Le volume dans le lecteur C s'appelle HP
Le numéro de série du volume est 0E4E-466E

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

31/01/2008 12:27 <REP> .
31/01/2008 12:27 <REP> ..
31/01/2008 12:23 <REP> 1036
26/10/2006 20:12 40 256 MSOSV.DLL
1 fichier(s) 40 256 octets
3 Rép(s) 230 775 607 296 octets libres
Le volume dans le lecteur C s'appelle HP
Le numéro de série du volume est 0E4E-466E

Répertoire de C:\Program Files\common files

06/02/2008 20:11 <REP> .
06/02/2008 20:11 <REP> ..
14/09/2007 22:17 <REP> Adobe
04/03/2008 21:55 <REP> Ahead
31/01/2008 12:27 <REP> DESIGNER
14/09/2007 22:08 <REP> HP
14/09/2007 22:09 <REP> InstallShield
14/09/2007 22:18 <REP> Java
14/09/2007 22:16 <REP> LightScribe
14/09/2007 22:15 <REP> LS Getting Started
31/01/2008 14:47 <REP> microsoft shared
14/09/2007 22:16 <REP> muvee Technologies
31/01/2008 18:56 <REP> PX Storage Engine
14/09/2007 22:14 <REP> Roxio Shared
02/11/2006 12:18 <REP> Services
14/09/2007 22:14 <REP> Sonic Shared
02/11/2006 12:18 <REP> SpeechEngines
04/03/2008 22:13 <REP> SureThing Shared
11/02/2008 23:54 <REP> Symantec Shared
31/01/2008 12:23 <REP> System
0 fichier(s) 0 octets
20 Rép(s) 230 775 603 200 octets libres




c:\Users\sandrine\Documents\Downloads\Clone DVD 2.9.1.0 & Clone CD 5.3.0.1\CloneCD 5.3.0.1.exe
c:\Users\sandrine\Documents\Downloads\Clone DVD 2.9.1.0 & Clone CD 5.3.0.1\CloneDVD 2.9.1.0 Keygen.exe
c:\Users\sandrine\Documents\Downloads\Clone DVD 2.9.1.0 & Clone CD 5.3.0.1\CloneDVD 2.9.1.0.exe
c:\Users\sandrine\Documents\Downloads\Clone DVD 2.9.1.0 & Clone CD 5.3.0.1\Slysoft Products Generic Crack 1.43.exe
c:\Users\sandrine\Documents\Downloads\Nero 7.8.5.0\Nero 7.8.5.0.exe

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_PC-de-sandrine.tar.gz a l'adresse http://upload.malekal.com

Ok, bien joué.

On va faire un 2eme rapport, et on passe à l'attaque.
Pour être tranquilles, désactive l'UAC avant. On réactivera après. Mais il ne faudra pas oublier de réactiver, après les hostilités, ou bien avant d'éteindre la machine si ça ne finit pas ce soir.

Télécharge combofix.exe de sUBs et sauvegarde le sur ton bureau (et pas ailleurs).

• Double-clique combofix.exe afin de l'exécuter et suis les instructions.
• Lorsque l'analyse sera complétée, un rapport apparaîtra.
• Copie-colle ce rapport dans ta prochaine réponse.
  Le rapport se trouve dans : C:\Combofix.txt (si jamais).

voila le résultat
ComboFix 08-03-05.1 - sandrine 2008-03-05 21:45:12.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1384 [GMT 1:00]
Endroit: C:\Users\sandrine\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Program Files\Adssite Games Collection
C:\Program Files\Adssite Games Collection\BattlesOfHelicopters.exe
C:\Program Files\Adssite Games Collection\BobAndBill.exe
C:\Program Files\Adssite Games Collection\CrazyBlocks.exe
C:\Program Files\Adssite Games Collection\Lines.exe
C:\Program Files\Adssite Games Collection\uninstall.exe
C:\Program Files\Adssite Games Collection\VideoPool.exe
C:\Users\sandrine\AppData\Roaming\urlredir.cfg
C:\Windows\system32\dcads-remove.exe
C:\Windows\system32\DcadsSocial-uninstall.exe
C:\Windows\system32\iebrowserc.dll
C:\Windows\system32\jusched.exe
C:\Windows\system32\nsd7918.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\poof




((((((((((((((((((((((((((((( Fichiers créés 2008-02-05 to 2008-03-05 ))))))))))))))))))))))))))))))))))))
.

2008-03-05 21:22 . 2008-03-05 21:22 3,273,265 --a------ C:\upload_moi_PC-de-sandrine.tar.gz
2008-03-05 20:38 . 2008-03-05 20:38 3,718 --a------ C:\Windows\System32\tmp.reg
2008-03-05 20:37 . 2007-09-05 23:22 289,144 --a------ C:\Windows\System32\VCCLSID.exe
2008-03-05 20:37 . 2006-04-27 16:49 288,417 --a------ C:\Windows\System32\SrchSTS.exe
2008-03-05 20:37 . 2008-03-01 23:12 86,016 --a------ C:\Windows\System32\VACFix.exe
2008-03-05 20:37 . 2008-02-29 23:48 82,432 --a------ C:\Windows\System32\IEDFix.exe
2008-03-05 20:37 . 2003-06-05 20:13 53,248 --a------ C:\Windows\System32\Process.exe
2008-03-05 20:37 . 2004-07-31 17:50 51,200 --a------ C:\Windows\System32\dumphive.exe
2008-03-05 20:37 . 2007-10-03 23:36 25,600 --a------ C:\Windows\System32\WS2Fix.exe
2008-03-03 10:53 . 2008-03-03 10:55 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-03-02 11:04 . 2008-03-02 11:25 <REP> d-------- C:\Program Files\LimeWire
2008-03-02 10:51 . 2008-03-03 10:47 <REP> dr------- C:\Users\sandrine\Searches
2008-03-01 11:58 . 2008-03-05 21:43 <REP> d-------- C:\Program Files\ContextEnhancer
2008-03-01 10:50 . 2008-03-01 10:50 84,761 --a------ C:\Windows\System32\mysidesearch_sidebar_uninstall.exe
2008-02-28 17:57 . 2008-03-02 11:05 <REP> d-------- C:\Users\sandrine\AppData\Roaming\LimeWire
2008-02-25 15:34 . 2008-02-25 15:34 339,968 --a------ C:\Windows\System32\mysidesearch_sidebar.dll
2008-02-23 12:37 . 2008-02-23 12:37 <REP> d-------- C:\Users\sandrine\AppData\Roaming\WinBatch
2008-02-16 17:56 . 2008-01-10 06:50 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-02-14 03:12 . 2008-02-14 03:12 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-02-14 03:12 . 2008-02-14 03:12 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-02-14 03:07 . 2008-02-14 03:07 3,505,720 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-14 03:07 . 2008-02-14 03:07 3,471,928 --a------ C:\Windows\System32\ntoskrnl.exe
2008-02-14 03:07 . 2008-02-14 03:07 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-02-14 03:07 . 2008-02-14 03:07 109,624 --a------ C:\Windows\System32\drivers\ataport.sys
2008-02-14 03:07 . 2008-02-14 03:07 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys
2008-02-14 03:07 . 2008-02-14 03:07 21,560 --a------ C:\Windows\System32\drivers\atapi.sys
2008-02-14 03:07 . 2008-02-14 03:07 17,464 --a------ C:\Windows\System32\drivers\intelide.sys
2008-02-14 03:06 . 2008-02-14 03:06 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-02-14 03:06 . 2008-02-14 03:06 216,632 --a------ C:\Windows\System32\drivers\netio.sys
2008-02-14 03:06 . 2008-02-14 03:06 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-02-14 03:06 . 2008-02-14 03:06 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-02-14 03:06 . 2008-02-14 03:06 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-02-14 03:05 . 2008-02-14 03:05 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 03:05 . 2008-02-14 03:05 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-02-06 21:26 . 2008-02-09 12:17 <REP> d-------- C:\Users\sandrine\AppData\Roaming\???????sAppData
2008-02-05 20:06 . 2008-02-05 20:06 97,216 --a------ C:\Windows\System32\drivers\AnyDVD.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 17:55 --------- d-----w C:\ProgramData\Symantec
2008-03-04 21:13 --------- d-----w C:\Users\sandrine\AppData\Roaming\uTorrent
2008-03-04 21:13 --------- d-----w C:\ProgramData\Microsoft Help
2008-03-04 21:13 --------- d-----w C:\Program Files\Microsoft Works
2008-03-04 21:13 --------- d-----w C:\Program Files\Google
2008-03-04 21:13 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2008-03-04 20:55 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-04 20:54 --------- d-----w C:\ProgramData\Nero
2008-03-02 09:59 --------- d-----w C:\Users\sandrine\AppData\Roaming\Shareaza
2008-03-01 10:28 --------- d-----w C:\Users\sandrine\AppData\Roaming\Ahead
2008-02-25 10:21 --------- d-----w C:\Program Files\Nero
2008-02-15 14:00 --------- d-----w C:\Program Files\Norton Security Scan
2008-02-14 02:05 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 02:05 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 02:05 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 02:05 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 02:02 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-14 02:02 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-14 02:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-14 02:02 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-11 22:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-09 11:31 --------- d-----w C:\ProgramData\Roxio
2008-02-09 11:17 --------- d-----w C:\Users\sandrine\AppData\Roaming\???????sAppData
2008-02-09 10:47 --------- d-----w C:\Users\sandrine\AppData\Roaming\Roxio
2008-02-06 19:28 --------- d-----w C:\ProgramData\DVD Shrink
2008-02-03 19:07 --------- d-----w C:\Users\sandrine\AppData\Roaming\Elaborate Bytes
2008-02-03 19:03 --------- d-----w C:\Program Files\Elaborate Bytes
2008-02-03 18:26 --------- d-----w C:\Program Files\SlySoft
2008-02-03 17:44 --------- d-----w C:\ProgramData\Elaborate Bytes
2008-02-03 09:17 --------- d-----w C:\Users\sandrine\AppData\Roaming\Nero
2008-02-02 19:02 --------- d-----w C:\ProgramData\Ahead
2008-02-02 09:39 --------- d-----w C:\Program Files\uTorrent
2008-02-02 09:21 --------- d-----w C:\Program Files\Azureus
2008-02-01 15:36 --------- d-----w C:\Program Files\HomePlayer1.5
2008-02-01 14:20 --------- d-----w C:\ProgramData\LightScribe
2008-02-01 14:16 --------- d-----w C:\Users\sandrine\AppData\Roaming\Azureus
2008-02-01 09:49 --------- d-----w C:\Program Files\Norton Internet Security
2008-02-01 09:34 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-02-01 09:34 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
2008-02-01 09:34 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-02-01 09:34 --------- d-----w C:\Program Files\Symantec
2008-01-31 18:03 --------- d-----w C:\Program Files\DivX
2008-01-31 18:00 --------- d-----w C:\Users\sandrine\AppData\Roaming\DivX
2008-01-31 17:56 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-01-31 13:28 32,390 ----a-w C:\Windows\king-uninstall.exe
2008-01-31 12:58 --------- d-----w C:\ProgramData\Azureus
2008-01-31 12:02 --------- d-----w C:\ProgramData\SlySoft
2008-01-31 11:37 --------- d-----w C:\Program Files\DVD Shrink
2008-01-31 11:27 --------- d-----w C:\Program Files\MSBuild
2008-01-31 11:26 --------- d-----w C:\Program Files\Microsoft.NET
2008-01-31 11:24 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-01-31 10:19 --------- d-----w C:\Users\sandrine\AppData\Roaming\Symantec
2008-01-31 10:09 174 --sha-w C:\Program Files\desktop.ini
2008-01-31 10:06 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-31 10:06 --------- d-----w C:\Program Files\Windows Mail
2008-01-31 10:06 --------- d-----w C:\Program Files\Windows Calendar
2008-01-31 10:00 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-01-31 10:00 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-01-31 10:00 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-01-31 10:00 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-01-31 10:00 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-01-31 10:00 297,984 ----a-w C:\Windows\System32\wlansec.dll
2008-01-31 10:00 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2008-01-31 10:00 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-01-31 10:00 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-01-31 10:00 2,923,520 ----a-w C:\Windows\explorer.exe
2008-01-31 10:00 2,028,544 ----a-w C:\Windows\System32\win32k.sys
2008-01-31 09:58 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-01-31 09:58 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-01-31 09:58 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-01-31 09:58 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-01-31 09:56 8,704 ----a-w C:\Windows\System32\hcrstco.dll
2008-01-31 09:56 8,704 ----a-w C:\Windows\System32\hccoin.dll
2008-01-31 09:56 73,216 ----a-w C:\Windows\system32\drivers\usbccgp.sys
2008-01-31 09:56 5,888 ----a-w C:\Windows\system32\drivers\usbd.sys
2008-01-31 09:56 38,400 ----a-w C:\Windows\system32\drivers\usbehci.sys
2008-01-31 09:56 23,040 ----a-w C:\Windows\system32\drivers\usbuhci.sys
2008-01-31 09:56 224,768 ----a-w C:\Windows\system32\drivers\usbport.sys
2008-01-31 09:56 193,536 ----a-w C:\Windows\system32\drivers\usbhub.sys
2008-01-31 09:56 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-01-31 09:55 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-01-31 09:55 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-01-31 09:54 61,440 ----a-w C:\Windows\System32\ntprint.exe
2008-01-31 09:54 269,824 ----a-w C:\Windows\System32\schannel.dll
2008-01-31 09:54 220,160 ----a-w C:\Windows\System32\ntprint.dll
2008-01-31 09:54 120,320 ----a-w C:\Windows\System32\dhcpcsvc6.dll
2008-01-31 09:54 10,240 ----a-w C:\Windows\System32\dhcpcmonitor.dll
2008-01-31 09:54 1,984,512 ----a-w C:\Windows\System32\authui.dll
2008-01-31 09:52 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-01-31 09:50 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-01-31 09:50 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-01-31 09:50 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-01-31 09:50 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-01-31 09:50 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-01-31 09:50 --------- d-----w C:\Program Files\MSXML 4.0
2008-01-31 09:49 750,080 ----a-w C:\Windows\System32\qmgr.dll
2008-01-31 09:48 --------- d--h--w C:\ProgramData\CanonBJ
2008-01-31 09:47 --------- d-----w C:\Users\sandrine\AppData\Roaming\Hewlett-Packard
2008-01-31 09:47 --------- d-----w C:\ProgramData\Hewlett-Packard
2008-01-31 09:46 --------- d-----w C:\Users\sandrine\AppData\Roaming\ATI
.

((((((((((((((((((((((((((((( snapshot@2008-03-05_21.40.35.30 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-05 20:38:52 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-03-05 20:46:10 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-03-05 20:46:10 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-03-05 20:24:39 103,726 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-03-05 20:43:10 103,726 ----a-w C:\Windows\System32\perfc009.dat
- 2008-03-05 20:24:39 117,366 ----a-w C:\Windows\System32\perfc00C.dat
+ 2008-03-05 20:43:10 117,366 ----a-w C:\Windows\System32\perfc00C.dat
- 2008-03-05 20:24:39 609,944 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-03-05 20:43:10 609,944 ----a-w C:\Windows\System32\perfh009.dat
- 2008-03-05 20:24:39 690,594 ----a-w C:\Windows\System32\perfh00C.dat
+ 2008-03-05 20:43:10 690,594 ----a-w C:\Windows\System32\perfh00C.dat
- 2008-03-05 20:21:49 5,792 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1017998519-953618848-1121065845-1000_UserData.bin
+ 2008-03-05 20:40:40 6,064 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1017998519-953618848-1121065845-1000_UserData.bin
- 2008-03-05 20:21:49 55,734 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-03-05 20:40:40 55,790 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C6C4BA2-1646-0F3A-1FAE-B393C162C92E}]
2007-12-30 21:48 1019904 --a------ C:\Program Files\ContextEnhancer\ContextEnhancer-1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
2007-08-24 20:51 316784 --a------ C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-01-31 11:41 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DDFA1356-E6ED-42a5-9D62-93211D424A90}]
2008-02-25 15:34 339968 --a------ C:\Windows\system32\mysidesearch_sidebar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [2007-08-24 20:51 316784]

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-02-06 11:06 1682368]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-09-15 07:20 1006264]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 16:01 65536]
"KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 17:16 65536]
"OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 12:59 118784]
"StartCCC"="c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35 90112]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 12:06 4669440 C:\Windows\RtHDVCpl.exe]
"HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 12:13 71176]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]
"SunJavaUpdateReg"="C:\Windows\system32\jureg.exe" [2007-04-07 01:56 54936]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 15:24 54840]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 13:15 51048]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 14:47 57344]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6C1F8FB3-8252-42B9-9296-69B1498CBE3F}"= UDP:6346:shareaza
"{2CAC91C3-EDA9-4206-AFA4-3B659C470058}"= TCP:6346:shareaza
"{68F9E2BD-B6BD-4CC5-B9EF-C527308B8FE4}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{8A0DDBA5-4777-42E8-B0A2-095F3C47A419}"= UDP:8080:homeplayer
"{8469D0AD-0ECD-4A40-849B-F90E8A41BE4D}"= TCP:8080:homeplayer
"{7E9A3FEC-223C-4ACA-9195-0D14B6B15300}"= UDP:62770:utorrent
"{BD703C1A-FFFB-4C51-AA26-70308700AAD8}"= TCP:62770:utorrent
"{47DF1BE7-CD51-43A8-ADA2-B65D6F3411FE}"= Disabled:UDP:4:82.243.170.2
"{A792F460-B2C4-4BED-AFF7-F7F29DCE1A4B}"= Disabled:UDP:3620:82.243.170.2
"{A39E1F71-C6D0-4CBF-B3F2-4D4F04A5AA80}"= Disabled:TCP:4:82.243.170.2
"{0A92365B-35E5-4CEF-9825-71F5FFE3975E}"= Disabled:TCP:1316:82.243.170.2
"TCP Query User{ECD4B7AF-55E3-4A0B-BD15-4A4C8ED47294}C:\program files\homeplayer1.5\homeplayer.exe"= UDP:C:\program files\homeplayer1.5\homeplayer.exe:HomePlayer|Desc=HomePlayer
"UDP Query User{9DCB4CC3-229F-4BEB-904F-4BC9F9B02357}C:\program files\homeplayer1.5\homeplayer.exe"= TCP:C:\program files\homeplayer1.5\homeplayer.exe:HomePlayer|Desc=HomePlayer
"{C72D4E48-EAA9-4BEE-BD51-97E97A70B085}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{E493CCC6-D9DD-43A0-B41E-574868DA9E09}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080305.001\IDSvix86.sys [2008-02-13 17:18]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-08-13 23:07]
R3 RTL8169;Realtek 8169 NT Driver;C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-03-05 22:28]
R3 SymIMMP;SymIMMP;C:\Windows\system32\DRIVERS\SymIM.sys [2007-08-09 17:27]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-08-13 13:50]
S3 COH_Mon;COH_Mon;C:\Windows\system32\Drivers\COH_Mon.sys [2008-01-12 18:32]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\Windows\system32\DRIVERS\SymIM.sys [2007-08-09 17:27]

*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-03-03 20:54:31 C:\Windows\Tasks\Norton Internet Security - Effectuer une analyse complète du système - sandrine.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeB/TASK:
"2008-02-15 14:51:42 C:\Windows\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-05 21:46:18
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-05 21:46:57
ComboFix-quarantined-files.txt 2008-03-05 20:46:55
.
2008-03-03 09:55:46 --- E O F ---

Je te prépare un script. Pendant ce temps : tu avais déjà utilisé ComboFix sur cette machine ? Récemment ?

non pas que je sache mais je suis pas une flèche en informatique loin de là

Le rapport indique que Combofix a déjà servi une fois sur la machine. (---- Previous Run -------)
Tu n'étais peut-être pas dessus. Peu importe. ton problème est simple, tu as choppé beaucoup de saletés par des cracks et du P2P. Tes ennuis viennent de là. Après, ton antivirus, (ici Norton), il n'a rien vu et a tout laissé entrer on dirait.

Garde l'UAC désactivée.

Allons-y.

Crée un fichier texte nommé CFScript.txt
Double clique pour l'ouvrir, et copie colle ceci dedans :

File::
C:\Windows\System32\DcadsSocial-uninstall.exe
C:\Windows\System32\dcads-remove.exe
C:\Windows\System32\mysidesearch_sidebar_uninstall.exe
C:\Windows\System32\mysidesearch_sidebar.dll
C:\Windows\system32\nsd7918.dll
C:\Windows\system32\CddbPlaylist2Roxi.dll
C:\Windows\SMINST\launcher.exe

Folder::
C:\Program Files\Adssite Games Collection
C:\Program Files\ContextEnhancer

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4C6C4BA2-1646-0F3A-1FAE-B393C162C92E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DDFA1356-E6ED-42a5-9D62-93211D424A90}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{733716E1-76D2-4003-AC39-845281C0EF85}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F84E7511-6055-4F70-AC6E-B82FF4AA4811}]

Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture

• Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
• Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
• Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Bonjour Falkra
je suis désolé pour hier soir mais la manip demandée à fait planter l'ordinateur plusieurs fois et vu l'heure tardive j'ai laissé tomber.
A chaque fois que je lance combofix internet plante et je suis obligée de relancer l'ordinateur.
j'ai relancé la bécane ce matin par contre on ne m'a pas demandé 1 ou 2 mais oui ou non et le bureau n'à pas disparu plusieurs fois comme tu me l'avais dit
je te poste le résultat et encore merci pour tout ce que tu fais pour moi
ComboFix 08-03-05.1 - sandrine 2008-03-06 7:38:03.6 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1355 [GMT 1:00]
Endroit: C:\Users\sandrine\Desktop\ComboFix.exe
Command switches used :: C:\Users\sandrine\Desktop\CFScript.txt
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-06 to 2008-03-06 ))))))))))))))))))))))))))))))))))))
.

2008-03-05 21:22 . 2008-03-05 21:22 3,273,265 --a------ C:\upload_moi_PC-de-sandrine.tar.gz
2008-03-05 20:38 . 2008-03-05 20:38 3,718 --a------ C:\Windows\System32\tmp.reg
2008-03-05 20:37 . 2007-09-05 23:22 289,144 --a------ C:\Windows\System32\VCCLSID.exe
2008-03-05 20:37 . 2006-04-27 16:49 288,417 --a------ C:\Windows\System32\SrchSTS.exe
2008-03-05 20:37 . 2008-03-01 23:12 86,016 --a------ C:\Windows\System32\VACFix.exe
2008-03-05 20:37 . 2008-02-29 23:48 82,432 --a------ C:\Windows\System32\IEDFix.exe
2008-03-05 20:37 . 2003-06-05 20:13 53,248 --a------ C:\Windows\System32\Process.exe
2008-03-05 20:37 . 2004-07-31 17:50 51,200 --a------ C:\Windows\System32\dumphive.exe
2008-03-05 20:37 . 2007-10-03 23:36 25,600 --a------ C:\Windows\System32\WS2Fix.exe
2008-03-03 10:53 . 2008-03-03 10:55 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-03-02 11:04 . 2008-03-02 11:25 <REP> d-------- C:\Program Files\LimeWire
2008-03-02 10:51 . 2008-03-03 10:47 <REP> dr------- C:\Users\sandrine\Searches
2008-03-01 11:58 . 2008-03-06 07:34 <REP> d-------- C:\Program Files\ContextEnhancer
2008-03-01 10:50 . 2008-03-01 10:50 84,761 --a------ C:\Windows\System32\mysidesearch_sidebar_uninstall.exe
2008-02-28 17:57 . 2008-03-02 11:05 <REP> d-------- C:\Users\sandrine\AppData\Roaming\LimeWire
2008-02-25 15:34 . 2008-02-25 15:34 339,968 --a------ C:\Windows\System32\mysidesearch_sidebar.dll
2008-02-23 12:37 . 2008-02-23 12:37 <REP> d-------- C:\Users\sandrine\AppData\Roaming\WinBatch
2008-02-16 17:56 . 2008-01-10 06:50 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-02-14 03:12 . 2008-02-14 03:12 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-02-14 03:12 . 2008-02-14 03:12 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-02-14 03:07 . 2008-02-14 03:07 3,505,720 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-14 03:07 . 2008-02-14 03:07 3,471,928 --a------ C:\Windows\System32\ntoskrnl.exe
2008-02-14 03:07 . 2008-02-14 03:07 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-02-14 03:07 . 2008-02-14 03:07 109,624 --a------ C:\Windows\System32\drivers\ataport.sys
2008-02-14 03:07 . 2008-02-14 03:07 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys
2008-02-14 03:07 . 2008-02-14 03:07 21,560 --a------ C:\Windows\System32\drivers\atapi.sys
2008-02-14 03:07 . 2008-02-14 03:07 17,464 --a------ C:\Windows\System32\drivers\intelide.sys
2008-02-14 03:06 . 2008-02-14 03:06 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-02-14 03:06 . 2008-02-14 03:06 216,632 --a------ C:\Windows\System32\drivers\netio.sys
2008-02-14 03:06 . 2008-02-14 03:06 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-02-14 03:06 . 2008-02-14 03:06 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-02-14 03:06 . 2008-02-14 03:06 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-02-14 03:05 . 2008-02-14 03:05 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 03:05 . 2008-02-14 03:05 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-02-06 21:26 . 2008-02-09 12:17 <REP> d-------- C:\Users\sandrine\AppData\Roaming\???????sAppData

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 21:12 --------- d-----w C:\ProgramData\Symantec
2008-03-04 21:13 --------- d-----w C:\Users\sandrine\AppData\Roaming\uTorrent
2008-03-04 21:13 --------- d-----w C:\ProgramData\Microsoft Help
2008-03-04 21:13 --------- d-----w C:\Program Files\Microsoft Works
2008-03-04 21:13 --------- d-----w C:\Program Files\Google
2008-03-04 21:13 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2008-03-04 20:55 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-04 20:54 --------- d-----w C:\ProgramData\Nero
2008-03-02 09:59 --------- d-----w C:\Users\sandrine\AppData\Roaming\Shareaza
2008-03-01 10:28 --------- d-----w C:\Users\sandrine\AppData\Roaming\Ahead
2008-02-25 10:21 --------- d-----w C:\Program Files\Nero
2008-02-15 14:00 --------- d-----w C:\Program Files\Norton Security Scan
2008-02-14 02:05 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 02:05 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 02:05 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 02:05 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 02:02 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-14 02:02 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-14 02:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-14 02:02 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-11 22:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-09 11:31 --------- d-----w C:\ProgramData\Roxio
2008-02-09 11:17 --------- d-----w C:\Users\sandrine\AppData\Roaming\???????sAppData
2008-02-09 10:47 --------- d-----w C:\Users\sandrine\AppData\Roaming\Roxio
2008-02-06 19:28 --------- d-----w C:\ProgramData\DVD Shrink
2008-02-05 19:06 97,216 ----a-w C:\Windows\system32\drivers\AnyDVD.sys
2008-02-03 19:07 --------- d-----w C:\Users\sandrine\AppData\Roaming\Elaborate Bytes
2008-02-03 19:03 --------- d-----w C:\Program Files\Elaborate Bytes
2008-02-03 18:26 --------- d-----w C:\Program Files\SlySoft
2008-02-03 17:44 --------- d-----w C:\ProgramData\Elaborate Bytes
2008-02-03 09:17 --------- d-----w C:\Users\sandrine\AppData\Roaming\Nero
2008-02-02 19:02 --------- d-----w C:\ProgramData\Ahead
2008-02-02 09:39 --------- d-----w C:\Program Files\uTorrent
2008-02-02 09:21 --------- d-----w C:\Program Files\Azureus
2008-02-01 15:36 --------- d-----w C:\Program Files\HomePlayer1.5
2008-02-01 14:20 --------- d-----w C:\ProgramData\LightScribe
2008-02-01 14:16 --------- d-----w C:\Users\sandrine\AppData\Roaming\Azureus
2008-02-01 09:49 --------- d-----w C:\Program Files\Norton Internet Security
2008-02-01 09:34 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-02-01 09:34 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
2008-02-01 09:34 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-02-01 09:34 --------- d-----w C:\Program Files\Symantec
2008-01-31 18:03 --------- d-----w C:\Program Files\DivX
2008-01-31 18:00 --------- d-----w C:\Users\sandrine\AppData\Roaming\DivX
2008-01-31 17:56 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-01-31 13:28 32,390 ----a-w C:\Windows\king-uninstall.exe
2008-01-31 12:58 --------- d-----w C:\ProgramData\Azureus
2008-01-31 12:02 --------- d-----w C:\ProgramData\SlySoft
2008-01-31 11:37 --------- d-----w C:\Program Files\DVD Shrink
2008-01-31 11:27 --------- d-----w C:\Program Files\MSBuild
2008-01-31 11:26 --------- d-----w C:\Program Files\Microsoft.NET
2008-01-31 11:24 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-01-31 10:19 --------- d-----w C:\Users\sandrine\AppData\Roaming\Symantec
2008-01-31 10:09 174 --sha-w C:\Program Files\desktop.ini
2008-01-31 10:06 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-31 10:06 --------- d-----w C:\Program Files\Windows Mail
2008-01-31 10:06 --------- d-----w C:\Program Files\Windows Calendar
2008-01-31 10:00 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-01-31 10:00 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-01-31 10:00 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-01-31 10:00 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-01-31 10:00 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-01-31 10:00 297,984 ----a-w C:\Windows\System32\wlansec.dll
2008-01-31 10:00 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2008-01-31 10:00 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-01-31 10:00 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-01-31 10:00 2,923,520 ----a-w C:\Windows\explorer.exe
2008-01-31 10:00 2,028,544 ----a-w C:\Windows\System32\win32k.sys
2008-01-31 09:58 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-01-31 09:58 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-01-31 09:58 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-01-31 09:58 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-01-31 09:56 8,704 ----a-w C:\Windows\System32\hcrstco.dll
2008-01-31 09:56 8,704 ----a-w C:\Windows\System32\hccoin.dll
2008-01-31 09:56 73,216 ----a-w C:\Windows\system32\drivers\usbccgp.sys
2008-01-31 09:56 5,888 ----a-w C:\Windows\system32\drivers\usbd.sys
2008-01-31 09:56 38,400 ----a-w C:\Windows\system32\drivers\usbehci.sys
2008-01-31 09:56 23,040 ----a-w C:\Windows\system32\drivers\usbuhci.sys
2008-01-31 09:56 224,768 ----a-w C:\Windows\system32\drivers\usbport.sys
2008-01-31 09:56 193,536 ----a-w C:\Windows\system32\drivers\usbhub.sys
2008-01-31 09:56 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-01-31 09:55 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-01-31 09:55 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-01-31 09:54 61,440 ----a-w C:\Windows\System32\ntprint.exe
2008-01-31 09:54 269,824 ----a-w C:\Windows\System32\schannel.dll
2008-01-31 09:54 220,160 ----a-w C:\Windows\System32\ntprint.dll
2008-01-31 09:54 120,320 ----a-w C:\Windows\System32\dhcpcsvc6.dll
2008-01-31 09:54 10,240 ----a-w C:\Windows\System32\dhcpcmonitor.dll
2008-01-31 09:54 1,984,512 ----a-w C:\Windows\System32\authui.dll
2008-01-31 09:52 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-01-31 09:50 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-01-31 09:50 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-01-31 09:50 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-01-31 09:50 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-01-31 09:50 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-01-31 09:50 --------- d-----w C:\Program Files\MSXML 4.0
2008-01-31 09:49 750,080 ----a-w C:\Windows\System32\qmgr.dll
2008-01-31 09:48 --------- d--h--w C:\ProgramData\CanonBJ
2008-01-31 09:47 --------- d-----w C:\Users\sandrine\AppData\Roaming\Hewlett-Packard
2008-01-31 09:47 --------- d-----w C:\ProgramData\Hewlett-Packard
.

((((((((((((((((((((((((((((( snapshot@2008-03-05_21.40.35.30 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-05 20:38:38 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-03-06 06:29:32 67,584 --s-a-w C:\Windows\bootstat.dat
- 2008-03-05 20:38:52 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-03-06 06:31:09 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-03-06 06:31:09 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-03-05 20:38:52 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-03-06 06:38:47 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-03-06 06:38:47 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-03-05 19:19:43 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-03-05 21:12:11 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-03-05 19:19:43 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-03-05 21:12:11 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-03-05 19:19:43 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-03-05 21:12:11 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-03-05 20:24:39 103,726 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-03-06 06:34:06 103,726 ----a-w C:\Windows\System32\perfc009.dat
- 2008-03-05 20:24:39 117,366 ----a-w C:\Windows\System32\perfc00C.dat
+ 2008-03-06 06:34:06 117,366 ----a-w C:\Windows\System32\perfc00C.dat
- 2008-03-05 20:24:39 609,944 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-03-06 06:34:06 609,944 ----a-w C:\Windows\System32\perfh009.dat
- 2008-03-05 20:24:39 690,594 ----a-w C:\Windows\System32\perfh00C.dat
+ 2008-03-06 06:34:06 690,594 ----a-w C:\Windows\System32\perfh00C.dat
- 2008-03-05 20:21:49 5,792 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1017998519-953618848-1121065845-1000_UserData.bin
+ 2008-03-06 06:31:30 6,488 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1017998519-953618848-1121065845-1000_UserData.bin
- 2008-03-05 20:21:49 55,734 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-03-06 06:31:29 56,454 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-03-05 20:21:46 34,444 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-03-06 06:31:27 34,540 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C6C4BA2-1646-0F3A-1FAE-B393C162C92E}]
2007-12-30 21:48 1019904 --a------ C:\Program Files\ContextEnhancer\ContextEnhancer-1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
2007-08-24 20:51 316784 --a------ C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-01-31 11:41 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DDFA1356-E6ED-42a5-9D62-93211D424A90}]
2008-02-25 15:34 339968 --a------ C:\Windows\system32\mysidesearch_sidebar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [2007-08-24 20:51 316784]

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-02-06 11:06 1682368]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:36 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-09-15 07:20 1006264]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 16:01 65536]
"KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 17:16 65536]
"OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 12:59 118784]
"StartCCC"="c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35 90112]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 12:06 4669440 C:\Windows\RtHDVCpl.exe]
"HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 12:13 71176]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]
"SunJavaUpdateReg"="C:\Windows\system32\jureg.exe" [2007-04-07 01:56 54936]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 15:24 54840]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 13:15 51048]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 14:47 57344]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6C1F8FB3-8252-42B9-9296-69B1498CBE3F}"= UDP:6346:shareaza
"{2CAC91C3-EDA9-4206-AFA4-3B659C470058}"= TCP:6346:shareaza
"{68F9E2BD-B6BD-4CC5-B9EF-C527308B8FE4}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{8A0DDBA5-4777-42E8-B0A2-095F3C47A419}"= UDP:8080:homeplayer
"{8469D0AD-0ECD-4A40-849B-F90E8A41BE4D}"= TCP:8080:homeplayer
"{7E9A3FEC-223C-4ACA-9195-0D14B6B15300}"= UDP:62770:utorrent
"{BD703C1A-FFFB-4C51-AA26-70308700AAD8}"= TCP:62770:utorrent
"{47DF1BE7-CD51-43A8-ADA2-B65D6F3411FE}"= Disabled:UDP:4:82.243.170.2
"{A792F460-B2C4-4BED-AFF7-F7F29DCE1A4B}"= Disabled:UDP:3620:82.243.170.2
"{A39E1F71-C6D0-4CBF-B3F2-4D4F04A5AA80}"= Disabled:TCP:4:82.243.170.2
"{0A92365B-35E5-4CEF-9825-71F5FFE3975E}"= Disabled:TCP:1316:82.243.170.2
"TCP Query User{ECD4B7AF-55E3-4A0B-BD15-4A4C8ED47294}C:\program files\homeplayer1.5\homeplayer.exe"= UDP:C:\program files\homeplayer1.5\homeplayer.exe:HomePlayer|Desc=HomePlayer
"UDP Query User{9DCB4CC3-229F-4BEB-904F-4BC9F9B02357}C:\program files\homeplayer1.5\homeplayer.exe"= TCP:C:\program files\homeplayer1.5\homeplayer.exe:HomePlayer|Desc=HomePlayer
"{C72D4E48-EAA9-4BEE-BD51-97E97A70B085}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{E493CCC6-D9DD-43A0-B41E-574868DA9E09}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080305.001\IDSvix86.sys [2008-02-13 17:18]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-08-13 23:07]
R3 RTL8169;Realtek 8169 NT Driver;C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-03-05 22:28]
R3 SymIMMP;SymIMMP;C:\Windows\system32\DRIVERS\SymIM.sys [2007-08-09 17:27]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-08-13 13:50]
S3 COH_Mon;COH_Mon;C:\Windows\system32\Drivers\COH_Mon.sys [2008-01-12 18:32]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\Windows\system32\DRIVERS\SymIM.sys [2007-08-09 17:27]

*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-03-03 20:54:31 C:\Windows\Tasks\Norton Internet Security - Effectuer une analyse complète du système - sandrine.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeB/TASK:
"2008-02-15 14:51:42 C:\Windows\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-06 07:39:05
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-06 7:39:50
ComboFix-quarantined-files.txt 2008-03-06 06:39:47
ComboFix2.txt 2008-03-05 22:13:44
ComboFix3.txt 2008-03-05 21:52:23
ComboFix4.txt 2008-03-05 21:42:10
ComboFix5.txt 2008-03-05 20:46:58
.
2008-03-03 09:55:46 --- E O F ---

Arf, pas bon ça.

Je vois qu'il y a eu plusieurs essais, les rapports sont les suivants :
ComboFix2.txt 2008-03-05 22:13:44
ComboFix3.txt 2008-03-05 21:52:23
ComboFix4.txt 2008-03-05 21:42:10
ComboFix5.txt 2008-03-05 20:46:58

Il me faudrait le rapport (ça doit être un de ceux là) où se trouvent mentionnées les suppression de fichiers :

C:\Windows\System32\DcadsSocial-uninstall.exe
C:\Windows\System32\dcads-remove.exe
C:\Windows\System32\mysidesearch_sidebar_uninstall.exe
C:\Windows\System32\mysidesearch_sidebar.dll
C:\Windows\system32\nsd7918.dll
C:\Windows\system32\CddbPlaylist2Roxi.dll
C:\Windows\SMINST\launcher.exe

Je pense que le rapport ComboFix5.txt les contient. Si tu peux le poster j'aimerais jeter un coup d'oeil.

Ajoute un nouveau log HijackThis. stp.