Bonjour à tous. Je viens de trouver ce troyan avec Antivir mais impossible de s'en débarasser, il revient à chaque fois.
Je vous remercie d'avance

SVP

Essaye HijackThis qui est un très bon logiciel

Et puis? Je fais quoi?

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Bruno Maia\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free2article.info
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Int
ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {2EE79A0F-CA8F-43AE-948B-6E67BC226FE4} - C:\WINDOWS\system32\efcYPgff.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A7DB3B47-23B6-422F-9C9D-EB9C4CBA3EF6} - C:\WINDOWS\system32\awtUmnKB.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: awtUmnKB - C:\WINDOWS\SYSTEM32\awtUmnKB.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

Voila le rapport

salut

Désactives ta restauration systeme :

Clic droit poste de travail / propriétés / onglet restauration du systeme : COCHES la case "désactiver la restauration systeme sur tous les lecteurs."
Clic sur "Appliquer", et "ok".

Puis,
Réactives ta restauration systeme :

Clic droit poste de travail / propriétés / onglet restauration du systeme : DECOCHES la case "désactiver la restauration systeme sur tous les lecteurs."
Clic sur "Appliquer", et "ok".

Ensuite,
Crée un nouveau point de restauration :
Menu démarrer / tous les programmes / accessoires / outils système / restauration du système / "créer un nouveau point de restauration"

plus de souci ?

Salut,

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingccomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

Ok merci je vais essayer. Par contre avec la restauration, ça fonctionne pas...

Voici le compte rendu:
ComboFix 08-07-11.1 - Bruno Maia 2008-07-12 18:05:43.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.268 [GMT 2:00]
Endroit: C:\Documents and Settings\Bruno Maia\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\awtUmnKB.dll
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\ffgPYcfe.ini
C:\WINDOWS\system32\ffgPYcfe.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\oeminfo.ini
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services
)))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_NPF

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-12 to 2008-07-12 ))))))))))))))))))))))))))))))))))))
.

2008-07-12 15:29 . 2008-07-12 15:29 <REP> d-------- C:\VundoFix Backups
2008-07-11 22:27 . 2008-07-11 22:27 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AdobeUM
2008-07-11 22:13 . 2008-07-11 22:13 <REP> d-------- C:\Program Files\Avira
2008-07-11 22:13 . 2008-07-11 22:13 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-11 21:14 . 2008-07-11 21:14 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-07-11 21:07 . 2008-07-11 21:08 <REP> d-------- C:\Documents and Settings\Bruno Maia\.housecall6.6
2008-07-11 20:47 . 2008-07-11 20:47 <REP> d-------- C:\Program Files\Fichiers communs\Macrovision Shared
2008-07-11 20:15 . 2008-07-11 20:15 <REP> d-------- C:\Documents and Settings\Bruno Maia\Application Data\Mozilla(2)
2008-07-11 15:07 . 2008-07-11
20:05 110,496 --a------ C:\WINDOWS\BM313e2b3d.xml

2008-07-11 09:39 . 2008-07-11 09:39 <REP> d-------- C:\Documents and Settings\Bruno Maia\Application Data\Download Manager
2008-07-08 14:13 . 2008-07-08 14:13 <REP> d--hs---- C:\FOUND.002
2008-06-30 19:14 . 2008-06-30 19:14 <REP> d-------- C:\Program Files\Wide Angle Software
2008-06-30 15:57 . 2008-06-30 15:57 <REP> d-------- C:\Program Files\dfsdfsd
2008-06-29 22:18 . 2008-06-29 22:18 <REP> d-------- C:\WINDOWS\Sun
2008-06-29 15:49 . 2008-06-29 15:49 1,025 --a------ C:\dfjs.exe
2008-06-28 20:58 . 2008-06-28 20:58 <REP> d-------- C:\Program Files\WinSCP
2008-06-23 15:58 . 2008-06-28 12:54 38 --a------ C:\WINDOWS\avisplitter.INI
2008-06-23 14:36 . 2008-06-23 14:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-06-18 06:12 . 2008-06-18
06:12 <REP> d-------- C:\WINDOWS\system32\XPSViewe
r
2008-06-18 06:12 . 2008-06-18 06:12 <REP> d-------- C:\Program Files\Reference Assemblies
2008-06-18 06:12 . 2008-06-18 06:12 <REP> d-------- C:\Program Files\MSBuild
2008-06-18 06:11 . 2006-06-29
13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.
dll
2008-06-18 06:07 . 2008-06-18 06:07 <REP> d-------- C:\Program Files\MSXML 6.0
2008-06-16 20:24 . 2008-06-16 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\vsosdk
2008-06-15 18:50 . 2004-08-04
00:54 159,232 --a------ C:\WINDOWS\system32\ptpusd
.dll
2008-06-15 18:50 . 2004-08-03
22:58 15,104 --a------ C:\WINDOWS\system32\drivers
\usbscan.sys
2008-06-15 18:50 . 2004-08-03
22:58 15,104 --a------ C:\WINDOWS\system32\dllcach
e\usbscan.sys
2008-06-15 18:50 . 2001-08-23
17:47 5,632 --a------ C:\WINDOWS\system32\ptpusb.d
ll
2008-06-14 13:45 . 2008-06-14 13:45 <REP> d-------- C:\Program Files\iTunes
2008-06-14 13:45 . 2008-06-14 13:45 <REP> d-------- C:\Program Files\iPod
2008-06-14 13:45 . 2008-06-14 13:45 <REP> d-------- C:\Program Files\Bonjour
2008-06-14 13:45 . 2008-06-14 13:46 <REP> d-------- C:\Documents and Settings\Bruno Maia\Application Data\Apple Computer
2008-06-14 13:44 . 2008-06-14 13:44 <REP> d-------- C:\Program Files\QuickTime
2008-06-14 13:44 . 2008-06-14 13:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-14 13:43 . 2008-06-14 13:43 <REP> d-------- C:\Program Files\Fichiers communs\Apple
2008-06-14 13:43 . 2008-06-14 13:44 <REP> d-------- C:\Program Files\Apple Software Update
2008-06-14 13:43 . 2008-06-14 13:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-06-14 13:43 . 2008-02-18
11:16 30,464 --a------ C:\WINDOWS\system32\drivers
\usbaapl.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14
17:59 272,768 ------w C:\WINDOWS\system32\drivers\
bthport.sys
2008-06-14
17:59 272,768 ------w C:\WINDOWS\system32\dllcache
\bthport.sys
2008-06-09
19:58 717,296 ----a-w C:\WINDOWS\system32\drivers\
sptd.sys
2008-06-09 19:58 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\DAEMON Tools
2008-06-03 17:40 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\Media Player Classic
2008-05-31 16:05 --------- d-----w C:\Program Files\Easy CD-DA Extractor 11
2008-05-28
10:45 99,264 ----a-w C:\WINDOWS\system32\drivers\A
nyDVD.sys
2008-05-24 21:24 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\Talkback
2008-05-24 19:45 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-05-24 16:07 --------- d-----w C:\Program Files\Winamp
2008-05-24 16:07 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\Winamp
2008-05-24 11:24 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\AdobeUM
2008-05-23 18:26 --------- d-----w C:\Program Files\SlySoft
2008-05-23 18:23 87,608 ----a-w C:\Documents and Settings\Bruno Maia\Application Data\inst.exe
2008-05-23
18:23 47,360 ----a-w C:\WINDOWS\system32\drivers\p
couffin.sys
2008-05-23 18:23 47,360 ----a-w C:\Documents and Settings\Bruno Maia\Application Data\pcouffin.sys
2008-05-23 18:23 --------- d-----w C:\Program Files\VSO
2008-05-23 18:23 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\Vso
2008-05-23 18:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
2008-05-23 17:30 --------- d-----w C:\Program Files\Total Video Converter
2008-05-23 17:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft
2008-05-23 17:11 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\skypePM
2008-05-23 17:08 --------- d-----w C:\Program Files\Skype
2008-05-23 17:08 --------- d-----w C:\Program Files\Fichiers communs\Skype
2008-05-23 17:08 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\Skype
2008-05-23 17:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-05-23 17:01 --------- d-----w C:\Program Files\PowerISO
2008-05-23 16:43 --------- d-sh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-05-23 16:43 --------- d-----w C:\Program Files\Windows Live
2008-05-23 16:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-23 16:33 --------- d-----w C:\Program Files\VLCPortable
2008-05-23 16:29 --------- d-----w C:\Program Files\VS Revo Group
2008-05-23 16:27 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-05-23 14:52 --------- d-----w C:\Program Files\OpenOffice.org 2.4
2008-05-23 14:52 --------- d-----w C:\Program Files\Java
2008-05-23 14:52 --------- d-----w C:\Program Files\Fichiers communs\Java
2008-05-22 20:10 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\OpenOffice.org2
2008-05-22 19:51 --------- d-----w C:\Program Files\DVD Shrink
2008-05-22 19:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-05-22 19:40 --------- d-----w C:\Program Files\uTorrent
2008-05-22 19:40 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\uTorrent
2008-05-22 19:33 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-22 19:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-22 19:29 --------- d-----w C:\Program Files\CCleaner
2008-05-22 19:26 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-22 18:27 --------- d-----w C:\Program Files\Alwil Software
2008-05-22 18:24 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\U3
2008-05-22 18:24 --------- d-----w C:\Documents and Settings\Bruno Maia\Application Data\CyberLink
2008-05-22 18:10 --------- d-----w C:\Program Files\Launch Manager
2008-05-22
18:08 17,119 ----a-w C:\WINDOWS\system32\drivers\A
egisP.sys
2008-05-22 18:08 --------- d-----w C:\Program Files\WinPCap
2008-05-22 18:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Intel
2008-05-08
12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache
\rmcast.sys
2008-05-07
05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz
.dll
2008-05-07
05:15 1,293,824 ----a-w C:\WINDOWS\system32\dllcac
he\quartz.dll
2008-04-23
20:16 3,591,680 ------w C:\WINDOWS\system32\dllcac
he\mshtml.dll
2008-04-22
07:41 70,656 ------w C:\WINDOWS\system32\dllcache\
ie4uinit.exe
2008-04-22
07:41 625,664 ------w C:\WINDOWS\system32\dllcache
\iexplore.exe
2008-04-22
07:39 13,824 ------w C:\WINDOWS\system32\dllcache\
ieudinit.exe
2008-04-20
05:07 161,792 ------w C:\WINDOWS\system32\dllcache
\ieakui.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg
)))))))))))))))))))))))))))))))))))))))))))))))))

.
.
REGEDIT4

• Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curr
entVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00 15360]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-05-28 13:10 2120640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur
rentVersion\Run]
"LaunchApp"="Alaunch" [X]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-07 20:02 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-07 19:59 77824]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-07 20:03 114688]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 19:51 53248]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 14:44 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 14:43 688218]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 05:00 208952]

"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScI
nst.exe" [2004-08-05 05:00 59392]

"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT
\TINTSETP.EXE" [2004-08-05 05:00 455168]

"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TIN
TSETP.EXE" [2004-08-05 05:00 455168]
"PCMService"="C:\Program Files\Acer\Acer Arcade\PCMService.exe" [2005-08-11 11:48 143360]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-08-11 19:21 200704]
"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03 2893824]
"eRecoveryService"="C:\Program Files\Acer\eRecovery\Monitor.exe" [2005-08-18 19:38 352256]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 11:13 267048]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-08-09 15:17 14743552 C:\WINDOWS\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cu
rrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\cur
rentversion\run-]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe"

[HKLM\~\services\sharedaccess\parameters\firewallp
olicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Acer\\Acer Arcade\\PCMService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19 13:10]
R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07 18:08]
R2 int15.sys;int15.sys;C:\Program Files\Acer\eRecovery\int15.sys [2005-01-13 14:46]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 16:58]
R2
osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.s
ys [2005-01-14 15:57]

[HKEY_CURRENT_USER\software\microsoft\windows\curr
entversion\explorer\mountpoints2\{50ef1220-282c-11
dd-8d61-0013ce27f009}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-07-07 05:36:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{2EE79A0F-CA8F-43AE-948B-6E67BC226FE4} - C:\WINDOWS\system32\efcYPgff.dll

• • ***********************************************
  • *********************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-12 18:11:06
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

• • ***********************************************
  • *********************

.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\iPod\bin\iPodService.exe
.

• • ***********************************************
  • *********************

.
Temps d'accomplissement: 2008-07-12 18:13:57 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-12 16:13:50

Pre-Run: 4,901,470,208 octets libres
Post-Run: 5,158,256,640 octets libres

220 --- E O F --- 2008-06-20 04:41:55