Cheval de troie au secour!!!!!

Bonsoir

1
Télécharge DDS et sauvegarde-le sur ton bureau.

Désactive tout script bloquant, tel q'un antivirus, un logiciel comme ad-block, noscript etc.

Double-clique sur dds.scr pour lancer l'outil.

Une fois le scan fini, un document texte, DDS.txt, va s'ouvrir .

Clique Oui à la prochaine invite Optional Scan.

Sauvegarde les deux rapports sur ton bureau et poste-moi uniquement le DDS.txt.

2

Télécharge Catchme ([#ff0000]Gmer[/#f]) sur ton Bureau.

Double clique sur catchme.exe (le .exe n'est pas forcément visible) afin de le lancer.

Lorsque la recherche sera terminée, poste le rapport catchme.log dans ta prochaine réponse. (Ce rapport est sur ton bureau.)

Merci mai dds ne marche il me dit que c'est un scrensaver!
et il m'ouvre l'administrateur de dds

re
tu as fais ça?

sinon, c'est normal que ça coince...

tu vas me trouver bete mais j'ai le fichier DDS.txt mais je suis nouveau sur le forum et je sais pas comment le poster?

re
pas grave, je vais te guider.  

clique dessus pour l'ouvrir, puis édition "sélectionner tout", édition "copier"

viens sur le forum et édition "coller"

ok pas de souci!!  

voila le DDS.txt

DDS (Ver_09-01-19.01) - NTFSx86
Run by cyrann at 22:11:55,54 on 27/01/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_11
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3062.1745 [GMT 1:00]

AV: AVG 7.5.552 *On-access scanning enabled* (Updated)
FW: Pare Feu AVG 7.5.500 *enabled*

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\rundll32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\Windows\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\IoctlSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\PSIService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~1\Grisoft\AVG7\avgfw2kv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\vssvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\cyrann\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://go.packardbell.com/?id=9136
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://home.sweetim.com
uURLSearchHooks: Search Class: {08c06d61-f1f3-4799-86f8-be1a89362c85} - c:\program files\orangehss\searchurlhook\SearchPageURL.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: NoExplorer - No File
BHO: Aide pour le lien d'Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\google\google_bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
TB: {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
uRun: [SmpcSys] c:\program files\packard bell\setupmypc\SmpSys.exe
uRun: [Extrafirst] "c:\programdata\hole ref ref.xwtyjqm"
uRun: [Amok Mode Dupe Platform] "c:\programdata\proc gram mfcd.uqoan53"
uRun: [IncrediMail] c:\program files\incredimail\bin\IncMail.exe /c
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ycgwgwm] "c:\users\cyrann\appdata\local\ycgwgwm.exe" ycgwgwm
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [toolbar_eula_launcher] c:\program files\packard bell\google_eula\EULALauncher.exe
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
mRun: [SystrayORAHSS] "c:\program files\orangehss\systray\SystrayApp.exe"
mRun: [AVG7_CC] c:\progra~1\grisoft\avg7\avgcc.exe /STARTUP
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
dRun: [AVG7_Run] c:\progra~1\grisoft\avg7\avgw.exe /RUNONCE
StartupFolder: c:\users\cyrann\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xporter vers Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Notify: a82ea659517 - c:\windows\system32\FWPUCLNT32.dll
Notify: avgwlntf - avgwlntf.dll
AppInit_DLLs: c:\progra~1\google\google~3\goec62~1.dll,c:\windows\system32\FWPUCLNT32.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\cyrann\appdata\roaming\mozilla\firefox\profiles\71at74h7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - SweetIM Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - plugin: c:\users\cyrann\appdata\roaming\mozilla\plugins\npPxPlay.dll

============= SERVICES / DRIVERS ===============

R3 AvgWFP;AVG7 Firewall Driver x86;c:\windows\system32\drivers\avgwfp.sys [2008-10-10 53768]
R4 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\adobe\photoshop elements 6.0\PhotoshopElementsFileAgent.exe [2007-9-10 124832]
R4 AVGFw2kv;AVG Firewall Service;c:\progra~1\grisoft\avg7\avgfw2kv.exe [2008-10-10 793600]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\drivers\PCAMp50.sys [2008-10-5 28224]

=============== Created Last 30 ================

2009-01-26 21:55 <DIR> --d----- c:\program files\a-squared Anti-Malware
2009-01-26 19:56 <DIR> --d----- c:\users\cyrann\appdata\roaming\Malwarebytes
2009-01-26 19:56 <DIR> --d----- c:\programdata\Malwarebytes
2009-01-26 19:56 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-01-26 19:56 <DIR> --d----- c:\progra~2\Malwarebytes
2009-01-26 19:47 <DIR> a-d----- c:\programdata\TEMP
2009-01-26 19:24 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-01-15 08:11 88 ---shr-- c:\windows\system32\69B49C235F.sys
2009-01-15 08:09 <DIR> --d----- c:\programdata\Corel
2009-01-15 08:09 <DIR> --d----- c:\progra~2\Corel
2009-01-15 07:59 2,828 a--sh--- c:\windows\system32\KGyGaAvL.sys
2009-01-15 07:58 <DIR> --d----- c:\program files\Corel
2009-01-14 15:00 <DIR> --d----- c:\program files\common files\Jasc Software Inc
2009-01-14 13:58 135,168 a------- c:\windows\system32\FWPUCLNT32.dll
2009-01-14 07:39 288,768 a------- c:\windows\system32\drivers\srv.sys
2009-01-12 20:44 <DIR> --d----- c:\programdata\Macrovision
2009-01-12 20:44 <DIR> --d----- c:\program files\common files\Macromedia Shared
2008-12-29 19:03 410,984 a------- c:\windows\system32\deploytk.dll

==================== Find3M ====================

2009-01-27 20:09 42,654 a------- c:\programdata\nvModes.dat
2009-01-27 20:09 42,654 a------- c:\progra~2\nvModes.dat
2009-01-26 19:49 669,566 a------- c:\windows\system32\perfh00C.dat
2009-01-26 19:49 123,556 a------- c:\windows\system32\perfc00C.dat
2009-01-12 20:44 550 a------- c:\users\cyrann\appdata\roaming\wklnhst.dat
2008-11-01 04:44 52,736 a------- c:\windows\apppatch\iebrshim.dll
2008-11-01 04:44 2,154,496 a------- c:\windows\apppatch\AcGenral.dll
2008-11-01 04:44 541,696 a------- c:\windows\apppatch\AcLayers.dll
2008-11-01 04:44 460,288 a------- c:\windows\apppatch\AcSpecfc.dll
2008-11-01 04:44 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2008-11-01 04:44 28,672 a------- c:\windows\system32\Apphlpdm.dll
2008-11-01 02:21 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2008-10-10 19:18 86,016 a------- c:\windows\inf\infstrng.dat
2008-10-10 19:18 86,016 a------- c:\windows\inf\infstor.dat
2008-10-10 19:18 51,200 a------- c:\windows\inf\infpub.dat
2008-06-20 21:37 665,600 a------- c:\windows\inf\drvindex.dat
2008-06-20 21:31 340,236 a------- c:\windows\inf\perflib\040c\perfi.dat
2008-06-20 21:31 340,236 a------- c:\windows\inf\perflib\040c\perfh.dat
2008-06-20 21:31 37,390 a------- c:\windows\inf\perflib\040c\perfd.dat
2008-06-20 21:31 37,390 a------- c:\windows\inf\perflib\040c\perfc.dat
2008-01-21 03:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
2008-06-20 21:36 8,192 a--sh--- c:\windows\users\default\NTUSER.DAT

============= FINISH: 22:13:28,87 ===============

re

Désactive ton antivirus et tout autre type de protection.
Télécharge ComboFix de sUBs :
ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur ComboFix, Il va te poser une question, suis les invites puis attends que combofix ait terminé, il est possible que ton PC reboot, c’est normal, un rapport sera créé.Poste le rapport:C:\Combofix.txt
clique dessus pour l'ouvrir, puis édition "sélectionner tout", édition "copier"

viens sur le forum et édition "coller"

AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
* le nom de la partition peut changer

et la le rapport catchme

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

re

Désactive ton antivirus et tout autre type de protection.
Télécharge ComboFix de sUBs :
ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur ComboFix, Il va te poser une question, suis les invites puis attends que combofix ait terminé, il est possible que ton PC reboot, c’est normal, un rapport sera créé.Poste le rapport:C:\Combofix.txt
clique dessus pour l'ouvrir, puis édition "sélectionner tout", édition "copier"

viens sur le forum et édition "coller"

AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
* le nom de la partition peut changer

voici le raport de combo

ComboFix 09-01-21.04 - cyrann 2009-01-28 22:10:51.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.3062.2029 [GMT 1:00]
Lancé depuis: c:\users\cyrann\Desktop\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\cyrann\AppData\Local\yumqq.dat
c:\users\cyrann\AppData\Local\yumqq_nav.dat
c:\users\cyrann\AppData\Local\yumqq_navps.dat
c:\users\cyrann\AppData\Roaming\020000006ef532ee517C.manifest
c:\users\cyrann\AppData\Roaming\020000006ef532ee517O.manifest
c:\users\cyrann\AppData\Roaming\020000006ef532ee517P.manifest
c:\users\cyrann\AppData\Roaming\020000006ef532ee517S.manifest

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-28 au 2009-01-28 ))))))))))))))))))))))))))))))))))))
.

2009-01-27 21:24 . 2009-01-27 21:24 <REP> d-------- c:\users\cyrann\AppData\Roaming\Nero
2009-01-26 21:55 . 2009-01-28 22:05 <REP> d-------- c:\program files\a-squared Anti-Malware
2009-01-26 19:56 . 2009-01-26 19:56 <REP> d-------- c:\users\cyrann\AppData\Roaming\Malwarebytes
2009-01-26 19:56 . 2009-01-26 19:56 <REP> d-------- c:\users\All Users\Malwarebytes
2009-01-26 19:56 . 2009-01-26 19:56 <REP> d-------- c:\programdata\Malwarebytes
2009-01-26 19:56 . 2009-01-27 05:08 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-26 19:47 . 2009-01-26 20:16 <REP> d-a------ c:\users\All Users\TEMP
2009-01-26 19:47 . 2009-01-26 20:16 <REP> d-a------ c:\programdata\TEMP
2009-01-26 19:24 . 2009-01-26 19:24 <REP> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-01-15 08:11 . 2009-01-15 08:17 88 -r-hs---- c:\windows\System32\69B49C235F.sys
2009-01-15 08:10 . 2009-01-15 08:11 <REP> d-------- c:\users\cyrann\AppData\Roaming\Corel
2009-01-15 08:09 . 2009-01-15 08:09 <REP> d-------- c:\users\All Users\Corel
2009-01-15 08:09 . 2009-01-15 08:09 <REP> d-------- c:\programdata\Corel
2009-01-15 07:59 . 2009-01-15 08:17 2,828 --ahs---- c:\windows\System32\KGyGaAvL.sys
2009-01-15 07:58 . 2009-01-15 13:17 <REP> d-------- c:\program files\Corel
2009-01-14 15:00 . 2009-01-14 15:00 <REP> d-------- c:\users\cyrann\AppData\Roaming\Jasc Software Inc
2009-01-14 15:00 . 2009-01-14 15:01 <REP> d-------- c:\program files\Common Files\Jasc Software Inc
2009-01-14 13:58 . 2009-01-14 13:58 135,168 --a------ c:\windows\System32\FWPUCLNT32.dll
2009-01-14 11:02 . 2009-01-14 11:05 <REP> d-------- c:\program files\Windows Live Safety Center
2009-01-14 07:39 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-12 20:44 . 2009-01-12 20:44 <REP> d-------- c:\users\All Users\Macrovision
2009-01-12 20:44 . 2009-01-12 20:44 <REP> d-------- c:\programdata\Macrovision
2009-01-12 20:44 . 2009-01-12 20:44 <REP> d-------- c:\program files\Common Files\Macromedia Shared
2008-12-29 19:03 . 2008-12-29 19:03 410,984 --a------ c:\windows\System32\deploytk.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-28 21:06 --------- d-----w c:\programdata\avg7
2009-01-28 20:44 --------- d-----w c:\users\cyrann\AppData\Roaming\AVG7
2009-01-28 20:43 42,654 ----a-w c:\users\All Users\nvModes.dat
2009-01-28 20:43 42,654 ----a-w c:\programdata\nvModes.dat
2009-01-27 04:05 --------- d-----w c:\program files\eMule
2009-01-15 10:55 --------- d-----w c:\programdata\Spybot - Search & Destroy
2009-01-15 02:02 --------- d-----w c:\program files\Windows Mail
2009-01-14 22:31 --------- d-----w c:\users\cyrann\AppData\Roaming\LimeWire
2009-01-12 19:44 550 ----a-w c:\users\cyrann\AppData\Roaming\wklnhst.dat
2008-12-30 21:32 --------- d-----w c:\program files\SweetIM
2008-12-29 18:07 --------- d-----w c:\program files\CCleaner
2008-12-29 18:03 --------- d-----w c:\program files\Java
2008-12-14 08:07 --------- d-----w c:\programdata\Microsoft Help
2008-12-10 18:38 --------- d-----w c:\programdata\Carbonite
2008-12-10 18:38 --------- d-----w c:\program files\Carbonite
2008-11-28 07:32 --------- d-----w c:\users\cyrann\AppData\Roaming\Netscape
2008-11-28 07:32 --------- d-----w c:\program files\Photodex Presenter
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2008-08-18 09:51 527304 -ra------ c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2008-08-18 09:51 527304 -ra------ c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2008-08-18 09:51 527304 -ra------ c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Extrafirst"="c:\programdata\hole ref ref.xwtyjqm" [X]
"Amok Mode Dupe Platform"="c:\programdata\proc gram mfcd.uqoan53" [X]
"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2008-02-04 1038136]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2008-10-05 243072]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 894512]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-03 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-03 92704]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-06-20 29744]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-29 136600]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2008-08-18 600008]

c:\users\cyrann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-10-08 394856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\a82ea659517]
2009-01-14 13:58 135168 c:\windows\System32\FWPUCLNT32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\FWPUCLNT32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A392C350-8067-4E68-AB91-CF376F62432D}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{0C852C9E-E569-4EE7-927C-4525052F7E93}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{7E0C17D4-11FD-4572-BDAF-B337A15AD96E}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{775EB900-BD4D-4E0B-85C7-7FB04A067D56}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{743EBF5E-2AED-491C-A329-20AEC4289F4C}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{99C39F6C-2EAB-4344-B41A-A724C0105AB5}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{852CA83A-F059-494B-84BB-A928A6F99EA9}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{3B3CE128-7AEA-4691-A16B-467CDD58DCD5}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{ECFF744C-01CE-4893-B2A1-232711013889}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{31890EC1-5AD3-446A-B277-28C035752B40}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{230E921B-A01B-40F9-A869-2DAFF14047B5}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{F189EECD-366F-4B54-A135-1A7D9AA37A3B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{B94C69D0-A592-4FCE-96F5-6EAEDEB118C5}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

R4 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-10 124832]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [2008-10-05 28224]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - AvgClean
*Deregistered* - AvgWFP
.
Contenu du dossier 'Tâches planifiées'

2009-01-28 c:\windows\Tasks\Extension de garantie-cyrann.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2008-02-04 11:13]

2009-01-28 c:\windows\Tasks\Recovery DVD Creator-cyrann.job
- c:\program files\Packard Bell\SetupMyPc\MCDCheck.exe [2008-02-04 11:13]
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-ycgwgwm - c:\users\cyrann\appdata\local\ycgwgwm.exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://home.sweetim.com
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\cyrann\AppData\Roaming\Mozilla\Firefox\Profiles\71at74h7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - SweetIM Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\users\cyrann\AppData\Roaming\Mozilla\plugins\npPxPlay.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-28 22:14:17
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1292)
c:\windows\System32\FWPUCLNT32.dll

- - - - - - - > 'lsass.exe'(684)
c:\windows\System32\FWPUCLNT32.dll
.
Heure de fin: 2009-01-28 22:16:14
ComboFix-quarantined-files.txt 2009-01-28 21:16:12

Avant-CF: 93 736 214 528 octets libres
Après-CF: 93,741,486,080 octets libres

193 --- E O F --- 2009-01-26 18:23:35

voici le rapport combo


ComboFix 09-01-21.04 - cyrann 2009-01-28 22:10:51.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.3062.2029 [GMT 1:00]
Lancé depuis: c:\users\cyrann\Desktop\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\cyrann\AppData\Local\yumqq.dat
c:\users\cyrann\AppData\Local\yumqq_nav.dat
c:\users\cyrann\AppData\Local\yumqq_navps.dat
c:\users\cyrann\AppData\Roaming\020000006ef532ee517C.manifest
c:\users\cyrann\AppData\Roaming\020000006ef532ee517O.manifest
c:\users\cyrann\AppData\Roaming\020000006ef532ee517P.manifest
c:\users\cyrann\AppData\Roaming\020000006ef532ee517S.manifest

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-28 au 2009-01-28 ))))))))))))))))))))))))))))))))))))
.

2009-01-27 21:24 . 2009-01-27 21:24 <REP> d-------- c:\users\cyrann\AppData\Roaming\Nero
2009-01-26 21:55 . 2009-01-28 22:05 <REP> d-------- c:\program files\a-squared Anti-Malware
2009-01-26 19:56 . 2009-01-26 19:56 <REP> d-------- c:\users\cyrann\AppData\Roaming\Malwarebytes
2009-01-26 19:56 . 2009-01-26 19:56 <REP> d-------- c:\users\All Users\Malwarebytes
2009-01-26 19:56 . 2009-01-26 19:56 <REP> d-------- c:\programdata\Malwarebytes
2009-01-26 19:56 . 2009-01-27 05:08 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-26 19:47 . 2009-01-26 20:16 <REP> d-a------ c:\users\All Users\TEMP
2009-01-26 19:47 . 2009-01-26 20:16 <REP> d-a------ c:\programdata\TEMP
2009-01-26 19:24 . 2009-01-26 19:24 <REP> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-01-15 08:11 . 2009-01-15 08:17 88 -r-hs---- c:\windows\System32\69B49C235F.sys
2009-01-15 08:10 . 2009-01-15 08:11 <REP> d-------- c:\users\cyrann\AppData\Roaming\Corel
2009-01-15 08:09 . 2009-01-15 08:09 <REP> d-------- c:\users\All Users\Corel
2009-01-15 08:09 . 2009-01-15 08:09 <REP> d-------- c:\programdata\Corel
2009-01-15 07:59 . 2009-01-15 08:17 2,828 --ahs---- c:\windows\System32\KGyGaAvL.sys
2009-01-15 07:58 . 2009-01-15 13:17 <REP> d-------- c:\program files\Corel
2009-01-14 15:00 . 2009-01-14 15:00 <REP> d-------- c:\users\cyrann\AppData\Roaming\Jasc Software Inc
2009-01-14 15:00 . 2009-01-14 15:01 <REP> d-------- c:\program files\Common Files\Jasc Software Inc
2009-01-14 13:58 . 2009-01-14 13:58 135,168 --a------ c:\windows\System32\FWPUCLNT32.dll
2009-01-14 11:02 . 2009-01-14 11:05 <REP> d-------- c:\program files\Windows Live Safety Center
2009-01-14 07:39 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-12 20:44 . 2009-01-12 20:44 <REP> d-------- c:\users\All Users\Macrovision
2009-01-12 20:44 . 2009-01-12 20:44 <REP> d-------- c:\programdata\Macrovision
2009-01-12 20:44 . 2009-01-12 20:44 <REP> d-------- c:\program files\Common Files\Macromedia Shared
2008-12-29 19:03 . 2008-12-29 19:03 410,984 --a------ c:\windows\System32\deploytk.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-28 21:06 --------- d-----w c:\programdata\avg7
2009-01-28 20:44 --------- d-----w c:\users\cyrann\AppData\Roaming\AVG7
2009-01-28 20:43 42,654 ----a-w c:\users\All Users\nvModes.dat
2009-01-28 20:43 42,654 ----a-w c:\programdata\nvModes.dat
2009-01-27 04:05 --------- d-----w c:\program files\eMule
2009-01-15 10:55 --------- d-----w c:\programdata\Spybot - Search & Destroy
2009-01-15 02:02 --------- d-----w c:\program files\Windows Mail
2009-01-14 22:31 --------- d-----w c:\users\cyrann\AppData\Roaming\LimeWire
2009-01-12 19:44 550 ----a-w c:\users\cyrann\AppData\Roaming\wklnhst.dat
2008-12-30 21:32 --------- d-----w c:\program files\SweetIM
2008-12-29 18:07 --------- d-----w c:\program files\CCleaner
2008-12-29 18:03 --------- d-----w c:\program files\Java
2008-12-14 08:07 --------- d-----w c:\programdata\Microsoft Help
2008-12-10 18:38 --------- d-----w c:\programdata\Carbonite
2008-12-10 18:38 --------- d-----w c:\program files\Carbonite
2008-11-28 07:32 --------- d-----w c:\users\cyrann\AppData\Roaming\Netscape
2008-11-28 07:32 --------- d-----w c:\program files\Photodex Presenter
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2008-08-18 09:51 527304 -ra------ c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2008-08-18 09:51 527304 -ra------ c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2008-08-18 09:51 527304 -ra------ c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Extrafirst"="c:\programdata\hole ref ref.xwtyjqm" [X]
"Amok Mode Dupe Platform"="c:\programdata\proc gram mfcd.uqoan53" [X]
"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2008-02-04 1038136]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2008-10-05 243072]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 894512]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-03 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-03 92704]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-06-20 29744]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-29 136600]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2008-08-18 600008]

c:\users\cyrann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-10-08 394856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\a82ea659517]
2009-01-14 13:58 135168 c:\windows\System32\FWPUCLNT32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\FWPUCLNT32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A392C350-8067-4E68-AB91-CF376F62432D}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{0C852C9E-E569-4EE7-927C-4525052F7E93}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{7E0C17D4-11FD-4572-BDAF-B337A15AD96E}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{775EB900-BD4D-4E0B-85C7-7FB04A067D56}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{743EBF5E-2AED-491C-A329-20AEC4289F4C}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{99C39F6C-2EAB-4344-B41A-A724C0105AB5}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{852CA83A-F059-494B-84BB-A928A6F99EA9}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{3B3CE128-7AEA-4691-A16B-467CDD58DCD5}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{ECFF744C-01CE-4893-B2A1-232711013889}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{31890EC1-5AD3-446A-B277-28C035752B40}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{230E921B-A01B-40F9-A869-2DAFF14047B5}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{F189EECD-366F-4B54-A135-1A7D9AA37A3B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{B94C69D0-A592-4FCE-96F5-6EAEDEB118C5}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

R4 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-10 124832]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [2008-10-05 28224]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - AvgClean
*Deregistered* - AvgWFP
.
Contenu du dossier 'Tâches planifiées'

2009-01-28 c:\windows\Tasks\Extension de garantie-cyrann.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2008-02-04 11:13]

2009-01-28 c:\windows\Tasks\Recovery DVD Creator-cyrann.job
- c:\program files\Packard Bell\SetupMyPc\MCDCheck.exe [2008-02-04 11:13]
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-ycgwgwm - c:\users\cyrann\appdata\local\ycgwgwm.exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://home.sweetim.com
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\cyrann\AppData\Roaming\Mozilla\Firefox\Profiles\71at74h7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - SweetIM Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\users\cyrann\AppData\Roaming\Mozilla\plugins\npPxPlay.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-28 22:14:17
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1292)
c:\windows\System32\FWPUCLNT32.dll

- - - - - - - > 'lsass.exe'(684)
c:\windows\System32\FWPUCLNT32.dll
.
Heure de fin: 2009-01-28 22:16:14
ComboFix-quarantined-files.txt 2009-01-28 21:16:12

Avant-CF: 93 736 214 528 octets libres
Après-CF: 93,741,486,080 octets libres

193 --- E O F --- 2009-01-26 18:23:35

Bonjour

Sélectionne l'intégralité du cadre ci-dessous :

Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)

Enregistre le sous sur ton bureau sous le nom de CFScript.txt

Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :

Cela va relancer Combofix.

Tu devras accepter la licence.

ComboFix créera ce fichier sur dans %SystemDrive%\Qoobox\Quarantine : [4]-Submit_Année-mois-jour@heure.minute.zip (%systemdrive% étant la partition où est installée Windows; C:\ en général)

ComboFix peut exiger un redémarrage pour compléter son travail. Accepte.

Lorsque l'outil aura terminé, un rapport ComboFix.log apparaîtra à l'écran.

Clique maintenant ICI

Sur la page Internet qui apparaît :
- A côté de Link to topic where this file was requested: , copie-colle le lien de notre discussion.
- Clique sur le bouton Parcourir et navigue vers le fichier créé précédemment évoqué.
- Clique sur le fichier afin de le sélectionner.

Soumets le fichier en cliquant "OK"

Poste le contenu du rapport ComboFix.txt après redémarrage s'il y en a un.

Le rapport se trouve ici : %SystemDrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

bonjour
je te remerci pour ton aide mais j'ai réussi à me débrouiller
et j'ai donc enlever le cheval de troie en désinstallant AVG et ensuit j'ai un scan avec avra antivir et il à réussi à me le retirer.
merci encore.

bye.  

hum...
reposte un log hijackthis stp.