PC infecté à nettoyer complètement

re,

Sélectionne le contenu du cadre ci dessous (en dessous du mot code: ), puis tu le copies avec un ctrl+c
ouvre ensuite le Bloc-Notes puis colle le texte ( ctrl+v )
(Démarrer\Tous les programmes\Accessoires\Bloc notes.) (notepad.exe )
Sauvegarde ce fichier sous le nom de CFScript.txt sur le bureau.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :



Cela va relancer Combofix.
Après redémarrage, poste le contenu du rapport Combofix.txt
S'il n'y a pas de rédémarrage, poste quand même le rapport.

ComboFix 10-07-24.03 - Puns thomas 28/07/2010 23:33:12.5.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.3583.3116 [GMT 2:00]
Lancé depuis: c:\documents and settings\Puns thomas\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Puns thomas\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\documents and settings\Puns thomas\errorlog.tmp"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Puns thomas\Application Data\TorrentBitch
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\GeoIP.dat
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\GeoIPASNum.dat
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\LibTorrentFlat.log
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\session.dht_state
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\session.ses_state
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\settings\TAddTorrentParamsObj.bin
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\settings\TBrowserSettingsObj.bin
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\settings\TDhtSettingsObj.bin
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\settings\TPeSettingsObj.bin
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\settings\TProxySettingsObj.bin
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\settings\TRSSFeedsSettingsObj.bin
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\settings\TSchedulerSettingsObj.bin
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\settings\TSessionParamsObj.bin
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\settings\TSessionSettingsObj.bin
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\tb_error.log
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\torrents\742ba4fde94f940448b41fbf0f524996542953d5.fastresume
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\torrents\742ba4fde94f940448b41fbf0f524996542953d5.torrent
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\torrents\9eb847422177360cd91ce7e29fd8b878955bc978.fastresume
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\torrents\9eb847422177360cd91ce7e29fd8b878955bc978.torrent
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\torrents\b33526e024f7fcd03a3020a83b8d4025ad0a92d9.fastresume
c:\documents and settings\Puns thomas\Application Data\TorrentBitch\torrents\b33526e024f7fcd03a3020a83b8d4025ad0a92d9.torrent
c:\documents and settings\Puns thomas\errorlog.tmp
c:\program files\TorrentBitch
c:\program files\TorrentBitch\bg-main.png
c:\program files\TorrentBitch\bg-top.png
c:\program files\TorrentBitch\libtorrent.rtf
c:\program files\TorrentBitch\LibTorrentFlat.dll
c:\program files\TorrentBitch\license.rtf
c:\program files\TorrentBitch\TorrentBitch.en.chm
c:\program files\TorrentBitch\TorrentBitch.exe
c:\program files\TorrentBitch\TorrentBitchLib.dll
c:\program files\TorrentBitch\unins000.dat
c:\program files\TorrentBitch\unins000.exe
c:\program files\TorrentBitch\welcome.htm
c:\program files\TorrentBitch\whats_new.htm

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-06-28 au 2010-07-28 ))))))))))))))))))))))))))))))))))))
.

2010-07-25 19:28 . 2010-07-25 19:28 -------- d-----w- c:\program files\Fichiers communs\Skype
2010-07-22 16:42 . 2010-07-22 16:42 -------- d-----w- c:\program files\CCleaner
2010-07-15 15:18 . 2010-07-15 15:19 -------- d-----w- c:\program files\jv16 PowerTools
2010-07-14 05:54 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-13 19:26 . 2010-07-22 13:07 76800 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-07-13 19:24 . 2010-07-13 19:24 -------- d-----w- C:\_OTM
2010-07-12 12:16 . 2010-07-13 10:43 -------- d-----w- c:\program files\trend micro
2010-07-09 21:50 . 2010-07-09 21:50 -------- d-----w- C:\VundoFix Backups
2010-07-09 16:06 . 2010-05-03 12:49 225232 ----a-w- c:\windows\system32\drivers\Rtenicxp.sys
2010-07-09 16:06 . 2010-01-12 11:35 100896 ----a-w- c:\windows\system32\RTNUninst32.dll
2010-07-09 16:06 . 2010-01-12 11:35 80416 ----a-w- c:\windows\system32\RtNicProp32.dll
2010-07-09 15:32 . 2010-07-09 15:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Driver Whiz
2010-07-09 14:40 . 2010-07-09 20:18 -------- d-----w- c:\program files\devolo
2010-07-04 14:43 . 2010-07-04 14:43 -------- d-----w- c:\program files\iPod
2010-07-04 14:41 . 2010-07-04 14:41 -------- d-----w- c:\program files\Bonjour
2010-07-04 14:32 . 2010-07-04 14:32 72504 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-28 21:45 . 2008-11-10 22:10 -------- d-----w- c:\program files\Mobistar
2010-07-28 21:45 . 2009-03-09 22:58 -------- d-----w- c:\documents and settings\Puns thomas\Application Data\Skype
2010-07-28 21:45 . 2009-03-09 23:04 -------- d-----w- c:\documents and settings\Puns thomas\Application Data\skypePM
2010-07-27 20:05 . 2008-11-11 13:09 -------- d-----w- c:\program files\World of Warcraft
2010-07-25 19:28 . 2009-03-09 22:57 -------- d-----r- c:\program files\Skype
2010-07-25 19:28 . 2009-03-09 22:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-07-16 02:18 . 2010-06-21 14:02 -------- d-----w- c:\program files\JDownloader
2010-07-13 19:24 . 2006-03-02 12:00 80920 ----a-w- c:\windows\system32\perfc00C.dat
2010-07-13 19:24 . 2006-03-02 12:00 501252 ----a-w- c:\windows\system32\perfh00C.dat
2010-07-11 22:11 . 2009-08-18 07:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2010-07-09 20:12 . 2010-06-06 03:39 -------- d-----w- c:\program files\Internet Download Manager
2010-07-09 20:00 . 2008-11-11 00:42 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-07-09 20:00 . 2008-11-11 00:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-09 16:06 . 2008-11-11 01:44 -------- d-----w- c:\program files\Realtek
2010-07-09 16:06 . 2008-11-10 23:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-09 16:01 . 2008-11-11 00:04 -------- d-----w- c:\program files\Lavalys
2010-07-09 15:28 . 2008-12-23 15:31 -------- d-----w- c:\program files\ma-config.com
2010-07-09 15:28 . 2008-12-23 15:31 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2010-07-06 13:23 . 2008-12-29 09:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-04 15:59 . 2008-11-28 02:32 -------- d-----w- c:\program files\LimeWire
2010-07-04 15:52 . 2010-01-24 19:11 -------- d-----w- c:\documents and settings\Puns thomas\Application Data\vlc
2010-07-04 14:44 . 2010-05-06 14:05 -------- d-----w- c:\program files\iTunes
2010-07-04 14:43 . 2009-10-28 02:49 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-06-30 00:19 . 2009-08-31 19:26 1 ----a-w- c:\documents and settings\Puns thomas\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-06-22 09:54 . 2008-11-10 23:15 24448 ----a-w- c:\documents and settings\Puns thomas\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-21 13:58 . 2010-06-21 13:58 -------- d-----w- c:\program files\JRE
2010-06-21 13:58 . 2009-08-31 19:24 -------- d-----w- c:\program files\OpenOffice.org 3
2010-06-15 18:03 . 2010-06-15 18:03 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-14 14:31 . 2008-11-10 18:44 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 01:01 . 2010-06-06 03:39 -------- d-----w- c:\documents and settings\Puns thomas\Application Data\IDM
2010-06-14 00:44 . 2010-06-06 03:39 -------- d-----w- c:\documents and settings\Puns thomas\Application Data\DMCache
2010-06-09 03:26 . 2008-11-24 03:35 -------- d-----w- c:\program files\JAP
2010-06-09 03:25 . 2010-06-09 03:25 -------- d-----w- c:\documents and settings\Puns thomas\Application Data\JonDo
2010-06-06 23:15 . 2010-06-06 23:15 -------- d-----w- c:\program files\BreakPoint Software
2010-06-06 22:13 . 2010-06-06 22:13 -------- d-----w- c:\program files\Hushpage
2010-06-06 07:13 . 2010-05-20 22:35 -------- d-----w- c:\program files\FOnline
2010-06-04 02:34 . 2010-06-04 02:34 -------- d-----w- c:\program files\SkipScreen
2010-06-04 01:16 . 2010-06-04 01:16 -------- d-----w- c:\program files\Machinarium
2010-05-31 12:16 . 2010-04-20 12:15 443912 ----a-w- c:\documents and settings\Puns thomas\Application Data\Real\Update\setup3.10\setup.exe
2010-05-23 00:01 . 2010-05-23 00:01 503808 ----a-w- c:\documents and settings\Puns thomas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2b28f6d9-n\msvcp71.dll
2010-05-23 00:01 . 2010-05-23 00:01 499712 ----a-w- c:\documents and settings\Puns thomas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2b28f6d9-n\jmc.dll
2010-05-23 00:01 . 2010-05-23 00:01 348160 ----a-w- c:\documents and settings\Puns thomas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2b28f6d9-n\msvcr71.dll
2010-05-23 00:01 . 2010-05-23 00:01 61440 ----a-w- c:\documents and settings\Puns thomas\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1bccd603-n\decora-sse.dll
2010-05-23 00:01 . 2010-05-23 00:01 12800 ----a-w- c:\documents and settings\Puns thomas\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1bccd603-n\decora-d3d.dll
2010-05-18 14:35 . 2010-05-18 14:35 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 14:35 . 2010-05-18 14:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-05-12 12:39 . 2010-02-28 03:01 18212 ---ha-w- c:\windows\system32\mlfcache.dat
2010-05-06 10:33 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:08 . 2006-03-02 12:00 1851392 ----a-w- c:\windows\system32\win32k.sys
2008-11-10 22:04 . 2008-11-10 22:04 278528 ----a-w- c:\program files\Fichiers communs\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MOBKIT"="c:\progra~1\Mobistar\Shell.exe" [2004-08-23 122880]
"LightScribe Control Panel"="c:\program files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-10-18 455968]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-11-21 3297280]
"Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-02-28 180224]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Puns thomas\Menu D‚marrer\Programmes\D‚marrage\
CurseClientStartup.ccip [2010-7-26 0]
Notification de cadeaux MSN.lnk - c:\qoobox\Quarantine\C\Documents and Settings\Puns thomas\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe.vir [2009-7-19 135680]

c:\documents and settings\Puns thomas\Menu D‚marrer\Programmes\D‚marrage\
CurseClientStartup.ccip [2010-7-26 0]
Notification de cadeaux MSN.lnk - c:\qoobox\Quarantine\C\Documents and Settings\Puns thomas\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe.vir [2009-7-19 135680]

c:\documents and settings\Puns thomas\Menu D‚marrer\Programmes\D‚marrage\
CurseClientStartup.ccip [2010-7-26 0]
Notification de cadeaux MSN.lnk - c:\qoobox\Quarantine\C\Documents and Settings\Puns thomas\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe.vir [2009-7-19 135680]

c:\documents and settings\Puns thomas\Menu D‚marrer\Programmes\D‚marrage\
CurseClientStartup.ccip [2010-7-26 0]
Notification de cadeaux MSN.lnk - c:\qoobox\Quarantine\C\Documents and Settings\Puns thomas\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe.vir [2009-7-19 135680]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedAppl ications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MessengerDiscovery\\MessengerDiscovery Live.exe"=
"c:\\Program Files\\Inventel\\Gateway\\WLANCFG.EXE"=
"c:\\WINDOWS\\system32\\FTRTSVC.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jqs.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiapsrv.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-frFR-downloader.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\devolo\\informer\\devinf.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPo rts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [13/09/2009 18:43 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [13/09/2009 18:43 5248]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [15/11/2009 10:05 108289]
R2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\windows\system32\drivers\npf_devolo.sys [13/07/2009 17:57 35840]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt [18/08/2005 7168]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [10/06/2010 17:15 253808]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-10-18 14:25 451872 ----a-w- c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe
.
Contenu du dossier 'Tâches planifiées'

2010-07-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.cherche.us/Result.php?cx=partner-pub-0420647136319153%3A5n6ugpjrdrh&cof=GIMP%3ACCCCCC%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A10%3BDIV%3A%23FFFFF0%3B&q={searchTerms}
uDefault_Search_URL = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: { - c:\program files\Messenger\msmsgs.exe
Trusted Zone: chat-land.org
TCP: {0D229D3B-13B8-479D-A1AA-FE0D0DC6ACAE} = 193.43.210.200
TCP: {90B33F53-7A6C-4E64-ADFF-2C15BA46D0D7} = 212.65.63.145,212.65.63.10
FF - ProfilePath - c:\documents and settings\Puns thomas\Application Data\Mozilla\Firefox\Profiles\5lyvjrx7.default\
FF - prefs.js: browser.startup.homepage - hxxp://ogame.fr/
FF - prefs.js: keyword.URL - hxxp://www.cherche.us/Result.php?cx=partner-pub-0420647136319153%3A5n6ugpjrdrh&cof=GIMP%3ACCCCCC%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A10%3BDIV%3A%23FFFFF0%3B&q=
FF - component: c:\documents and settings\Puns thomas\Application Data\Mozilla\Firefox\Profiles\5lyvjrx7.default\extensions\{b905bc9d-6059-4517-a6b4-950d26299a2b}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Puns thomas\Application Data\Mozilla\Firefox\Profiles\5lyvjrx7.default\extensions\{b905bc9d-6059-4517-a6b4-950d26299a2b}\components\RadioWMPCore.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\documents and settings\Puns thomas\Application Data\Mozilla\Firefox\Profiles\5lyvjrx7.default\extensions\DeviceDetection@logitech.com\plugins\npLogitechDeviceDetection.dl l
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?t=Web&k=");
.
- - - - ORPHELINS SUPPRIMES - - - -

AddRemove-{0034E9B7-20C1-4700-815D-DEC1F1181142}_is1 - c:\program files\TorrentBitch\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-28 23:43
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8AA64518]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba10cf28
\Driver\ACPI -> ACPI.sys @ 0xb9f58cb8
\Driver\atapi -> 0x8aa64518
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Realtek PCIe GBE Family Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9df1bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9dfea21
SendHandler -> NDIS.sys @ 0xb9ddc87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(764)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4900)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\eappprxy.dll
c:\program files\Fichiers communs\Nero\Lib\NeroDigitalExt.dll
c:\program files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\CTsvcCDA.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\Inventel\Gateway\wlancfg.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
.
**************************************************************************
.
Heure de fin: 2010-07-28 23:49:44 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-07-28 21:49
ComboFix2.txt 2010-07-27 19:42
ComboFix3.txt 2010-07-27 19:22
ComboFix4.txt 2010-07-23 12:42
ComboFix5.txt 2010-07-28 21:26

Avant-CF: 217.183.649.792 octets libres
Après-CF: 217.162.547.200 octets libres

- - End Of File - - 68B4334EDBC65B4B1ADCAE2855DB1E17

re,
ça commence à s'éclaircir

supprimes manuellement ce dossier, c:\program files\LimeWire ça m'étonne que Revo ne l'a pas fait ?

c'est effacé

le programme était déjà supprimé apparemment, c'est peut être pour ca que revo ne l'a pas trouvé

re,

on avance, tu peux me dire comment fonctionne cette machine en ce moment ?

me revoilà après une petite absence, la machine tourne sans plus aucun soucis de pornographie dans google,ni d'antivirus s'installant tout seul, l'internet est encore un peu lent et de temps en temps j'ai une pub pour une assurance ou une banque qui pop et l'affichage des pages est toujours un peu lent (après cela dépend certainement de mon débit internet)

re,

installe- Adblock + dans Mozilla-Firefox, ça ne résout pas tous les problèmes de Pub non désirées mais c'est quand-même un sérieux+.

héhé merci de l'astuce! effectivement c'est un plus!

re,

On va désinstaller le service Bonjour, (inutile )
télécharger ce petit utilitaire sur le bureau
http://download.gizmoproject.com/jasmine/TurnOffBonjour.exe
Une fois celà fais, lance l'outil que tu viens de télécharger (double-clic dessus )
Le service est désinstallé.

ensuite:

JavaRa
===========
télécharge ceci:
http://raproducts.org/click/click.php?id=1
Enregistre le fichier sur le bureau,
Dézippe-le sur le bureau (décompresser )
Un dossier JavaRa est créé.
Double clic dessus.
Double-Clic alors sur l'icone de JavaRa.exe (un soleil )
Choisis "English" comme language.
coche la première case.
update using jucheck.exe
Un message va te dire si ta version est à jour ou pas.
Si tu as probablement des anciennes versions, utilise le bouton "Remove Older Versions" (effacer les anciennes Versions )
Si tu n'en sais rien, utilise le bouton quand même , si des anciennes Versions Java traînent sur le PC, il va les supprimer.