Merci pour ton aide, voilà le rapport :
ComboFix 08-11-30.02 - Propriétaire 2008-12-01 18:45:59.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.268 [GMT 1:00]
Lancé depuis: c:\documents and settings\Propriétaire\Bureau\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\fxstaller.exe
c:\windows\system32\fcccdEUL.dll
c:\windows\system32\jbtfqv.dll
c:\windows\system32\nnnmkLFx.dll
c:\windows\system32\QpWHPqss.ini
c:\windows\system32\QpWHPqss.ini2
c:\windows\system32\ssqPHWpQ.dll
c:\windows\system32\svgkrxdk.dll
c:\windows\Tasks\qizxlqer.job
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-01 au 2008-12-01 ))))))))))))))))))))))))))))))))))))
.
2008-11-30 21:44 . 2008-11-30 21:44 95 --a------ c:\windows\wininit.ini
2008-11-30 21:23 . 2008-11-30 21:29 <REP> d-------- c:\program files\Spybot - Search & Destroy
2008-11-30 21:23 . 2008-12-01 18:26 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-30 18:33 . 2008-11-30 18:33 <REP> d--h----- c:\windows\PIF
2008-11-30 18:32 . 2008-11-30 18:32 1,025 --a------ C:\wnxx.exe
2008-11-30 18:19 . 2008-11-30 18:19 1,025 --a------ C:\ous.exe
2008-11-25 21:04 . 2008-11-25 21:04 <REP> d-------- c:\windows\system32\LogFiles
2008-11-23 10:23 . 2008-11-23 10:23 268 --ah----- C:\sqmdata12.sqm
2008-11-23 10:23 . 2008-11-23 10:23 244 --ah----- C:\sqmnoopt12.sqm
2008-11-22 18:42 . 2008-11-22 18:42 244 --ah----- C:\sqmnoopt11.sqm
2008-11-22 18:42 . 2008-11-22 18:42 232 --ah----- C:\sqmdata11.sqm
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 17:35 --------- d-----w c:\program files\Mozilla Firefox 3 Beta 2
2008-11-29 08:08 --------- d-----w c:\documents and settings\Propriétaire\Application Data\OpenOffice.org2
2008-11-29 08:08 --------- d-----w c:\documents and settings\Propriétaire\Application Data\OpenOffice.org2
2008-11-29 08:08 --------- d-----w c:\documents and settings\Propriétaire\Application Data\OpenOffice.org2
2008-11-27 20:24 --------- d-----w c:\documents and settings\Propriétaire\Application Data\LimeWire
2008-11-27 20:24 --------- d-----w c:\documents and settings\Propriétaire\Application Data\LimeWire
2008-11-27 20:24 --------- d-----w c:\documents and settings\Propriétaire\Application Data\LimeWire
2008-11-27 20:16 --------- d-----w c:\program files\Microsoft Picture It! 9
2008-10-28 10:35 --------- d-----w c:\program files\LimeWire
2008-10-26 13:59 --------- d-----w c:\program files\Zylom Games
2008-10-26 13:58 --------- d-----w c:\program files\Google
2008-10-26 13:58 --------- d-----w c:\documents and settings\All Users\Application Data\agi
2008-10-25 16:56 --------- d-----w c:\documents and settings\LocalService\Application Data\agi
2008-10-25 16:54 339,968 ----a-w c:\windows\system32\pythoncom25.dll
2008-10-25 16:54 2,117,632 ----a-w c:\windows\system32\python25.dll
2008-10-25 16:54 114,688 ----a-w c:\windows\system32\pywintypes25.dll
2008-10-15 11:36 --------- d-----w c:\documents and settings\All Users\Application Data\Zylom
2008-10-12 16:05 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Apple Computer
2008-10-12 16:05 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Apple Computer
2008-10-12 16:05 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Apple Computer
2008-10-01 18:36 --------- d-----w c:\program files\iTunes
2008-10-01 18:36 --------- d-----w c:\program files\iPod
2008-10-01 18:36 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-01 18:35 --------- d-----w c:\program files\QuickTime
2008-10-01 18:35 --------- d-----w c:\program files\Bonjour
2008-10-01 18:34 --------- d-----w c:\program files\Fichiers communs\Apple
2008-10-01 16:38 --------- d-----w c:\program files\Apple Software Update
2008-09-16 16:26 1,332,197 ----a-w c:\windows\system32\pythondll.zip
2008-08-18 18:32 842 ----a-w c:\program files\ravaudet.txt
2008-07-31 14:08 9 ----a-w c:\program files\nomutil.txt
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2008-07-03 190024]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
"Microsoft Works Update Detection"="c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 50688]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-04-05 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 28672]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=jbtfqv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.3.lnk]
path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.3.lnk
backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-09-10 16:40 289576 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2004-10-29 15:50 4620288 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2004-10-29 15:50 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 00:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2004-10-29 15:50 921600 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2003-02-27 13:29 47104 c:\windows\SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Documents and Settings\\Propriétaire\\Bureau\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-01 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-01 20560]
R3 P0630VID;Creative WebCam Live!;c:\windows\system32\DRIVERS\P0630Vid.sys [2008-07-09 91830]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);c:\windows\system32\DRIVERS\ss_bus.sys [2008-08-04 83592]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;c:\windows\system32\DRIVERS\ss_mdfl.sys [2008-08-04 15112]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;c:\windows\system32\DRIVERS\ss_mdm.sys [2008-08-04 109704]
.
Contenu du dossier 'Tâches planifiées'
2008-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2008-10-15 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1215865457.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 23:52]
.
- - - - ORPHELINS SUPPRIMES - - - -
BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - (no file)
BHO-{8ebda937-bf6e-42a2-ba61-c116a91bc939} - c:\windows\system32\jbtfqv.dll
BHO-{F9BD3000-3969-425E-B78F-29C1D7C70B84} - c:\windows\system32\ssqPHWpQ.dll
HKLM-Run-Windows UDP Control Center - fxstaller.exe
Notify-fcccdEUL - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\or5lcvhv.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.fr
FF -: plugin - c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 2\plugins\npnul32.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin2.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin3.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin4.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin5.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin6.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin7.dll
FF -: plugin - c:\program files\Mozilla Firefox 3 Beta 2\plugins\npzylomgamesplayer.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-01 18:50:28
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
.
**************************************************************************
.
Heure de fin: 2008-12-01 18:52:07 - La machine a redémarré [Propriétaire]
ComboFix-quarantined-files.txt 2008-12-01 17:52:04
Avant-CF: 58,926,587,904 octets libres
Après-CF: 59,888,840,704 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
192
