Enlever le ver Kavo.exe 5 [Résolu]

depuis environ une semaine j'ai un message d'erreur au démarage de windows : kavo.exe j'ai appris que c'était un ver j'aimerais savoir comment l'enlever, puisque j'ai cru comprendre en le supprimant qu'il se "reproduisait".
Plusieurs forums ont déja traité ce sujet mais je pense que c'est du cas par cas Laughing

merçi de m'aider svp j'ai peur de faire des bétises sur mon ordi.

Bonjour Charbonne
je vais t'aider dans la procédure de désinfection de ce ver.

- Télécharge HiJackThis de Merijn sur ton bureau.
- Double-clic sur HijackThis
- Génère un rapport en suivant ces indications :
- Exécute le et clique sur Do a scan and save log file.
- Le rapport s'ouvre sur le Bloc-Note
- Colle le rapport ici, pour cela :
- Menu Edition / Selectionner Tout
- Menu Edition / copier
- Ici dans un nouveau message : clic droit / coller

Merçi de m'aider Smile

voici le rapport de hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:01:42, on 22/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\VPro500.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Related Page - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\WinNB58.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\WinNB58.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BDSwitchAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Nikon Monitor.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: VPro500.lnk = C:\WINDOWS\VPro500.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bl116fd.blu116.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ucopia.mobile
O17 - HKLM\Software\..\Telephony: DomainName = ucopia.mobile
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ucopia.mobile
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ucopia.mobile
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 7311 bytes

Kavo se propage par disques amovibles, utilises tu une clé usb ou un disque dur externe sur ton PC car il faudra que nous nous occupons pour eviter une réinfection.

Si tu as des supports amovibles branchés, débranches les (disques durs externes, clés usb)

Télécharge Combofix sUBs : combofix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Désactive tes protections résidentes : antivirus, antipsyware, fermes toutes les applications en cours de fonction y compris le navigateur internet.

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Aide :
http://www.bibou0007.com/outils-specifiques-f78/tutorial-combofix-t121.htm

Copie/colle un nouveau rapport HiJackThis avec.

"La longueur de votre message dépasse la limite autorisée" j'ai les rapport mais ils sont trop long a ce qui parait Exclamation

1ere partie du rapport combofix Smile

ComboFix 08-05-20.5 - Charbonné 2008-05-22 10:17:03.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1658 [GMT 2:00]
Endroit: C:\Documents and Settings\Charbonné\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\m.exe
C:\WINDOWS\system32\kavo.exe
C:\WINDOWS\system32\kavo1.dll
C:\WINDOWS\system32\UpMedia
C:\WINDOWS\system32\UpMedia\ContentTool.dll
C:\WINDOWS\system32\UpMedia\SearchTool.dll
C:\WINDOWS\system32\winnb58.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_NWSAPAGENT
-------\Service_6to4
-------\Service_NwSapAgent

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-22 to 2008-05-22 ))))))))))))))))))))))))))))))))))))
.

2008-05-21 21:17 . 2008-05-21 21:17 d-------- C:\Program Files\Trend Micro
2008-05-21 21:16 . 2008-05-21 21:16 812,344 --a------ C:\Program Files\hijackthis.exe
2008-05-21 13:37 . 2008-05-12 10:32 117,833 -r-hs---- C:\uqb0julr.bat
2008-05-18 10:32 . 2008-05-18 10:32 117,655 -r-hs---- C:\lgnaqil.exe
2008-05-15 09:50 . 2008-05-17 23:39 117,831 -r-hs---- C:\w2qagd.com
2008-05-14 12:19 . 2008-05-14 12:18 117,466 -r-hs---- C:\2jqj.bat
2008-05-13 15:51 . 2008-05-13 15:51 d-------- C:\Program Files\Audacity
2008-05-12 22:55 . 2008-05-13 18:59 117,926 -r-hs---- C:\w3dn9f.bat
2008-05-10 14:26 . 2008-05-21 11:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-10 14:26 . 2008-05-10 14:26 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-09 01:11 . 2008-05-09 21:09 117,386 -r-hs---- C:\ka1nk.bat
2008-05-07 13:45 . 2008-05-07 13:45 0 --a------ C:\WINDOWS\optiflash.INI
2008-05-05 20:19 . 2008-05-05 20:19 d-------- C:\Program Files\Google Hacks
2008-05-04 11:16 . 2008-05-06 12:42 119,007 -r-hs---- C:\qpe6.com
2008-05-02 22:14 . 2008-05-03 15:14 119,274 -r-hs---- C:\x.bat
2008-05-01 11:59 . 2008-05-01 11:58 119,181 -r-hs---- C:\imt8.cmd
2008-04-30 09:27 . 2008-04-30 12:32 117,141 -r-hs---- C:\930jn.bat
2008-04-27 21:59 . 2008-04-27 21:59 d-------- C:\Program Files\Teamspeak2_RC2
2008-04-27 21:59 . 2008-04-27 21:59 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-04-26 17:57 . 2008-04-28 11:38 118,688 -r-hs---- C:\mka.bat
2008-04-24 12:33 . 2008-04-25 12:15 117,357 -r-hs---- C:\8386nac.com
2008-04-23 11:49 . 2008-04-23 11:49 116,871 -r-hs---- C:\0.com

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-21 07:06 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-20 08:18 --------- d-----w C:\Program Files\Incomplete
2008-05-20 08:02 --------- d-----w C:\Program Files\LimeWire
2008-05-14 08:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-06 13:19 5,632 ----a-w C:\WINDOWS\system32\drivers\StarOpen.sys
2008-04-23 11:37 --------- d-----w C:\Program Files\ProtectDisc Driver Installer
2008-04-23 07:59 117,594 --sh--r C:\1.bat
2008-04-20 17:42 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-04-19 22:03 115,878 --sh--r C:\h8i.com
2008-04-19 08:27 116,736 --sh--r C:\dp.cmd
2008-04-17 09:46 --------- d-----w C:\Program Files\Tetris
2008-04-17 09:07 116,606 --sh--r C:\x1dg.exe
2008-04-16 11:14 117,944 --sh--r C:\bqk.bat
2008-04-15 21:01 --------- d-----w C:\Program Files\The All-Seeing Eye
2008-04-14 17:47 116,221 --sh--r C:\vt6e.cmd
2008-04-14 09:59 --------- d-----w C:\Program Files\Yahoo!
2008-04-13 19:05 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-04-09 09:25 117,020 --sh--r C:\co.com
2008-04-09 06:08 118,515 --sh--r C:\uuhgt.bat
2008-04-08 06:24 116,940 --sh--r C:\mtlhieej.cmd
2008-04-06 14:16 --------- d-----w C:\Program Files\Microsoft Games
2008-04-04 03:08 117,465 --sh--r C:\u9.com
2008-04-03 16:52 --------- d-----w C:\Program Files\BlueSquad
2008-04-02 18:50 117,817 --sh--r C:\ermvu8.cmd
2008-03-29 17:32 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
2008-03-29 15:56 117,622 --sh--r C:\op.bat
2008-03-28 12:22 116,653 --sh--r C:\u3dsc.com
2008-03-28 08:19 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-28 04:30 118,116 --sh--r C:\lhwdcgcb.bat
2008-03-27 03:06 114,977 --sh--r C:\ff1q0gw.bat
2008-03-26 03:16 114,201 --sh--r C:\diox3j.com
2008-03-24 20:35 117,067 --sh--r C:\gicchk2s.exe
2008-03-22 07:42 --------- d-----w C:\Program Files\Nikon
2008-03-22 07:42 --------- d-----w C:\Program Files\Fichiers communs\Nikon
2008-03-22 07:42 --------- d-----w C:\Program Files\Fichiers communs\muvee Technologies
2008-03-22 07:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ultima_T15
2008-03-22 07:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nikon
2008-03-22 07:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\EnterNHelp
2008-03-22 07:39 --------- d-----w C:\Program Files\QuickTime
2008-03-22 07:39 --------- d-----w C:\Program Files\ArcSoft
2008-03-22 07:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-22 07:17 114,602 --sh--r C:\tgtighg.cmd
2008-03-21 16:32 114,250 --sh--r C:\6w1x.com
2008-03-20 15:34 113,276 --sh--r C:\af9rgm8h.bat
2008-03-19 17:51 113,538 --sh--r C:\k2.cmd
2008-03-17 15:01 113,973 --sh--r C:\e6ieg.exe
2008-03-14 15:41 113,439 --sh--r C:\fufb6tq3.cmd
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Configuration de la neuf Box"="C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe" [ ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"C-Media Mixer"="Mixer.exe" [2002-07-12 18:33 1581056 C:\WINDOWS\mixer.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-02 23:41 7557120]
"nwiz"="nwiz.exe" [2006-03-02 23:41 1519616 C:\WINDOWS\system32\nwiz.exe]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 13:12 135168]
"mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 13:12 53248]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINDOWS\KHALMNPR.Exe]
"SoundMan"="SOUNDMAN.EXE" [2006-03-02 08:22 577536 C:\WINDOWS\SOUNDMAN.EXE]
"BDSwitchAgent"="C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 10:41 282624]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1700:TCP"= 1700:TCP:MioNet Remote Drive Access
"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification
"16839:TCP"= 16839:TCP:*:Disabled:NortonAV
"15948:TCP"= 15948:TCP:*:Disabled:NortonAV
"18474:TCP"= 18474:TCP:*:Disabled:NortonAV
"17363:TCP"= 17363:TCP:*:Disabled:NortonAV
"15583:TCP"= 15583:TCP:*:Disabled:NortonAV
"12506:TCP"= 12506:TCP:*:Disabled:NortonAV
"16550:TCP"= 16550:TCP:*:Disabled:NortonAV
"15044:TCP"= 15044:TCP:*:Disabled:NortonAV
"15620:TCP"= 15620:TCP:*:Disabled:NortonAV
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"18117:TCP"= 18117:TCP:*:Disabled:NortonAV
"13024:TCP"= 13024:TCP:NortonAV
"14166:TCP"= 14166:TCP:NortonAV
"14850:TCP"= 14850:TCP:NortonAV
"18313:TCP"= 18313:TCP:NortonAV
"17969:TCP"= 17969:TCP:NortonAV
"15571:TCP"= 15571:TCP:NortonAV
"14008:TCP"= 14008:TCP:NortonAV
"17820:TCP"= 17820:TCP:NortonAV
"16058:TCP"= 16058:TCP:NortonAV
"15497:TCP"= 15497:TCP:NortonAV
"15589:TCP"= 15589:TCP:NortonAV
"13327:TCP"= 13327:TCP:NortonAV
"18475:TCP"= 18475:TCP:NortonAV
"12846:TCP"= 12846:TCP:NortonAV
"14656:TCP"= 14656:TCP:NortonAV
"13030:TCP"= 13030:TCP:NortonAV
"16680:TCP"= 16680:TCP:NortonAV
"18964:TCP"= 18964:TCP:NortonAV
"18683:TCP"= 18683:TCP:NortonAV
"18823:TCP"= 18823:TCP:NortonAV
"13072:TCP"= 13072:TCP:NortonAV
"18222:TCP"= 18222:TCP:NortonAV
"13545:TCP"= 13545:TCP:NortonAV
"16226:TCP"= 16226:TCP:NortonAV
"16188:TCP"= 16188:TCP:NortonAV
"13953:TCP"= 13953:TCP:NortonAV
"17818:TCP"= 17818:TCP:NortonAV
"17357:TCP"= 17357:TCP:NortonAV
"17076:TCP"= 17076:TCP:NortonAV
"13015:TCP"= 13015:TCP:NortonAV
"18104:TCP"= 18104:TCP:NortonAV
"14794:TCP"= 14794:TCP:NortonAV
"16483:TCP"= 16483:TCP:NortonAV
"13211:TCP"= 13211:TCP:NortonAV
"17409:TCP"= 17409:TCP:NortonAV
"13480:TCP"= 13480:TCP:NortonAV
"18941:TCP"= 18941:TCP:NortonAV
"14382:TCP"= 14382:TCP:NortonAV
"17951:TCP"= 17951:TCP:NortonAV
"15299:TCP"= 15299:TCP:NortonAV
"13118:TCP"= 13118:TCP:NortonAV
"13316:TCP"= 13316:TCP:NortonAV
"17631:TCP"= 17631:TCP:NortonAV
"14519:TCP"= 14519:TCP:NortonAV
"13848:TCP"= 13848:TCP:NortonAV
"15632:TCP"= 15632:TCP:NortonAV
"16650:TCP"= 16650:TCP:NortonAV
"17131:TCP"= 17131:TCP:NortonAV
"15721:TCP"= 15721:TCP:NortonAV
"18890:TCP"= 18890:TCP:NortonAV
"15429:TCP"= 15429:TCP:NortonAV
"13406:TCP"= 13406:TCP:NortonAV
"12797:TCP"= 12797:TCP:NortonAV
"14999:TCP"= 14999:TCP:NortonAV
"18781:TCP"= 18781:TCP:NortonAV
"17225:TCP"= 17225:TCP:NortonAV
"18784:TCP"= 18784:TCP:NortonAV
"16246:TCP"= 16246:TCP:NortonAV
"18167:TCP"= 18167:TCP:NortonAV
"17200:TCP"= 17200:TCP:NortonAV
"2300:UDP"= 2300:UDP:ASE
"6073:TCP"= 6073:TCP:aoe
"27244:UDP"= 27244:UDP:aoe 2
"17105:TCP"= 17105:TCP:NortonAV
"14204:TCP"= 14204:TCP:NortonAV
"16488:TCP"= 16488:TCP:NortonAV
"17722:TCP"= 17722:TCP:NortonAV
"13200:TCP"= 13200:TCP:NortonAV
"15975:TCP"= 15975:TCP:NortonAV
"14114:TCP"= 14114:TCP:NortonAV
"16130:TCP"= 16130:TCP:NortonAV
"13355:TCP"= 13355:TCP:NortonAV
"12547:TCP"= 12547:TCP:NortonAV
"17261:TCP"= 17261:TCP:NortonAV
"13128:TCP"= 13128:TCP:NortonAV
"12973:TCP"= 12973:TCP:NortonAV
"17416:TCP"= 17416:TCP:NortonAV
"13899:TCP"= 13899:TCP:NortonAV
"13045:TCP"= 13045:TCP:NortonAV
"16325:TCP"= 16325:TCP:NortonAV
"16080:TCP"= 16080:TCP:NortonAV
"15686:TCP"= 15686:TCP:NortonAV
"13017:TCP"= 13017:TCP:NortonAV
"12433:TCP"= 12433:TCP:NortonAV
"16930:TCP"= 16930:TCP:NortonAV
"18968:TCP"= 18968:TCP:NortonAV
"18701:TCP"= 18701:TCP:NortonAV
"13661:TCP"= 13661:TCP:NortonAV
"18003:TCP"= 18003:TCP:NortonAV
"12767:TCP"= 12767:TCP:NortonAV
"18031:TCP"= 18031:TCP:NortonAV
"12629:TCP"= 12629:TCP:NortonAV
"15409:TCP"= 15409:TCP:NortonAV
"18658:TCP"= 18658:TCP:NortonAV
"13736:TCP"= 13736:TCP:NortonAV
"14733:TCP"= 14733:TCP:NortonAV
"16266:TCP"= 16266:TCP:NortonAV
"17592:TCP"= 17592:TCP:NortonAV
"15302:TCP"= 15302:TCP:NortonAV
"15078:TCP"= 15078:TCP:NortonAV
"14265:TCP"= 14265:TCP:NortonAV
"13396:TCP"= 13396:TCP:NortonAV

2eme partie du rapport combo fix ^^ :

R2 acedrv09;acedrv09;C:\WINDOWS\system32\drivers\acedrv09.sys [2007-06-18 15:10]
R2 acedrv10;acedrv10;C:\WINDOWS\system32\drivers\acedrv10.sys [2007-07-24 09:45]
R2 acehlp09;acehlp09;C:\WINDOWS\system32\drivers\acehlp09.sys [2007-05-30 18:54]
R2 acehlp10;acehlp10;C:\WINDOWS\system32\drivers\acehlp10.sys [2007-07-11 10:20]
R3 SPC610NC;Philips SPC500NC Webcam;C:\WINDOWS\system32\DRIVERS\SPC610NC.SYS [2005-10-13 16:41]
R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 14:00]
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys [2005-06-20 10:12]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 17:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 17:59]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2795a4fe-8e99-11dc-9f6c-9c11013df964}]
\Shell\AutoRun\command - E:\k2.cmd
\Shell\explore\Command - E:\k2.cmd
\Shell\open\Command - E:\k2.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28d3f44e-a713-11dc-9fb7-e2ad01132065}]
\Shell\AutoRun\command - E:\mka.bat
\Shell\explore\Command - E:\mka.bat
\Shell\open\Command - E:\mka.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{42811ff8-0d84-11dc-9e5a-806d6172696f}]
\Shell\AutoRun\command - D:\wizard.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68e7117f-0ded-11dc-9e64-0015f2f371a7}]
\Shell\AutoRun\command - E:\diox3j.com
\Shell\explore\Command - E:\diox3j.com
\Shell\open\Command - E:\diox3j.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4acfee4-9914-11dc-9f91-909fe40efa64}]
\Shell\AutoRun\command - E:\k2.cmd
\Shell\explore\Command - E:\k2.cmd
\Shell\open\Command - E:\k2.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce0fd1ad-0ecd-11dc-9e6c-0015f2f371a7}]
\Shell\AutoRun\command - E:\qpe6.com
\Shell\explore\Command - E:\qpe6.com
\Shell\open\Command - E:\qpe6.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1967b2a-51a0-11dc-9e80-0015f2f371a7}]
\Shell\AutoRun\command - E:\uqb0julr.bat
\Shell\explore\Command - E:\uqb0julr.bat
\Shell\open\Command - E:\uqb0julr.bat

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-22 10:21:30
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\VPro500.exe
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PAStiSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-05-22 10:24:52 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-22 08:24:49

Pre-Run: 238,778,798,080 octets libres
Post-Run: 239,694,811,136 octets libres

338

Et voici le rapport hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:52:32, on 22/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\VPro500.exe
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: (no name) - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BDSwitchAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Nikon Monitor.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: VPro500.lnk = C:\WINDOWS\VPro500.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bl116fd.blu116.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ucopia.mobile
O17 - HKLM\Software\..\Telephony: DomainName = ucopia.mobile
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ucopia.mobile
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ucopia.mobile
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 7269 bytes

Le temps d'analyser ton rapport

# Télécharger clean.zip (de Malekal_morte) :
# Décompressez le fichier sur le bureau (clic droit / extraire tout), afin d’obtenir un dossier nommé clean.

# Ouvrez le dossier Clean qui se trouve sur ton bureau et faire un double-clic sur clean.cmd.
# Une fenêtre noire va apparaitre, choisissez l'option 1, un rapport sera crée sous la racine : C:\rapport_clean.txt

C'est fait, on me demande d'envoyer un fichier zip et j'ai un rapport bizzare:

22/05/2008 a 11:01:17,40

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32

*** Recherche des fichiers dans C:\Program Files

C'est normal pour le zip c'est l'auteur de l'outil qui demande parfois qu'en lui envoie les fichiers infectés ne pretes pas attention.

Le rapport est normal rien détecté.

Tu n'as pas répondu me semble t il à la question posée : connectes tu des disques dur externes ou clés usb sur ton PC ? car ils sont sans doutes infectés

Passons à la suite :

télécharge MalwareByte's Anti-Malware et installe le.
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
- Assure toi qu'il se soit bien mis à jour avant de passer à la suite.

Aide : http://www.bibou0007.com/antivirus-sans-protection-en-temps-reel-f73/malwarebytes-anti-malware-t952.htm

- Redémarre en mode sans échec :

o Redémarre ton ordinateur
o Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
o A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
o Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
o Choisis ton compte.

* Lance MBAM et sélectionne "Exécuter un examen complet". Patiente le temps du scan.

* Une fois le scan terminé,clique sur "Supprimer la sélection".

Si MBAM a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok. Enregistre le rapport sur ton Bureau lorsqu'il s'affichera.

Ajoute un nouveau rapport hijackthis.

Ha sorry non, je n'ai pas de disques externes ni de usb que j'utilise actuellement. J'ai fais les manip , merçi Very Happy

Ok
J'entend tes rapports MBAM et hijackthis prochainement

Re

voici le rapport MBAM:

Malwarebytes' Anti-Malware 1.12
Version de la base de données: 775

Type de recherche: Examen complet (C:\|)
Eléments examinés: 106188
Temps écoulé: 28 minute(s), 59 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\nn_bar_dummy.nn_bardummy (Adware.Mirar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nn_bar_dummy.nn_bardummy.1 (Adware.Mirar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mirar_dummy_ats.mirar_dummy_ats1 (Adware.Mirar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8a0dcbdb-6e20-489c-9041-c1e8a0352e75} (Adware.Mirar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mirar_dummy_ats.mirar_dummy_ats1.1 (Adware.Mirar) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{9a9c9b68-f908-4aab-8d0c-10ea8997f37e} (Adware.Mirar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{9a9c9b68-f908-4aab-8d0c-10ea8997f37e} (Adware.Mirar) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\WinATS.dll (Adware.Mirar) -> Quarantined and deleted successfully.
C:\Documents and Settings\Charbonné\Bureau\NudgeMania\NudgeMania.exe (Trojan.Flooder) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\UpMedia\ContentTool.dll.vir (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\UpMedia\SearchTool.dll.vir (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEC693F0-B6D8-4C8E-9C0D-472F0711845D}\RP188\A0033400.dll (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FEC693F0-B6D8-4C8E-9C0D-472F0711845D}\RP188\A0033401.dll (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\WINDOWS\1-fe5e180d56ed9c233080898276c260cc.exe (Adware.SmartShopper) -> Quarantined and deleted successfully.

Et le rapport hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:03:30, on 22/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\VPro500.exe
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BDSwitchAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Nikon Monitor.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: VPro500.lnk = C:\WINDOWS\VPro500.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-