Ah merci pour cette réponse!
Ci dessous le rapport Combofix : (par contre spybot se remet automatiquement en route au démarrage et signale des modifications, j'espere que ça n'altère pas la démarche)
ComboFix 08-02-12.1 - Muriel 2008-02-12 11:41:40.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.609 [GMT 1:00]
Endroit: C:\Documents and Settings\Muriel\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\microsoft 0ffice
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\isgTi19
C:\Temp\isgTi19\lPig.log
C:\WINDOWS\pack.epk
C:\WINDOWS\system32\knnmp.ini
C:\WINDOWS\system32\knnmp.ini2
C:\WINDOWS\system32\lmllm.ini
C:\WINDOWS\system32\lmllm.ini2
C:\WINDOWS\system32\nGpxx01
C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\u1
C:\WINDOWS\system32\u1\hiba3133.exe
C:\WINDOWS\system32\urqqoon.dll
C:\WINDOWS\system32\x8
C:\WINDOWS\system32\x8\liopud89104.exe
C:\WINDOWS\system32\z2
D:\Autorun.inf
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-12 to 2008-02-12 ))))))))))))))))))))))))))))))))))))
.
2008-02-12 00:16 . 2008-02-12 00:21 <REP> d-------- C:\Program Files\Trend Micro
2008-02-11 23:48 . 2008-02-12 10:36 <REP> d-------- C:\VundoFix Backups
2008-02-08 02:35 . 2008-02-08 02:35 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-08 02:35 . 2008-02-08 03:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-08 02:33 . 2008-02-08 02:33 7,467,056 --a------ C:\Program Files\spybotsd15.exe
2008-02-07 19:35 . 2008-02-07 19:35 <REP> d--hs---- C:\wide
2008-02-07 19:35 . 2008-02-07 19:35 <REP> d-------- C:\Documents and Settings\Muriel\Application Data\wide
2008-02-07 19:35 . 2008-02-07 19:35 <REP> dr------- C:\Documents and Settings\All Users\Application Data\SalesMon
2008-02-07 19:34 . 2008-02-07 23:30 <REP> d-------- C:\Program Files\wide
2008-02-07 19:20 . 2008-02-12 11:41 <REP> d-------- C:\Temp
2008-02-07 19:20 . 2008-02-07 19:20 36,864 --a------ C:\WINDOWS\mrofinu572.exe.tmp
2008-02-01 22:35 . 2008-02-01 22:36 <REP> d-------- C:\Program Files\PDFCreator
2008-02-01 22:35 . 2008-02-01 22:35 253,116 --a------ C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_5984.exe
2008-02-01 22:35 . 2005-10-15 12:32 196,608 --a------ C:\WINDOWS\system32\pdfcmnnt.dll
2008-02-01 22:35 . 1998-07-13 01:08 141,312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL
2008-02-01 22:35 . 1998-06-24 00:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX
2008-02-01 22:35 . 1998-07-13 01:08 59,904 --a------ C:\WINDOWS\system32\MSCC2FR.DLL
2008-02-01 22:35 . 1998-07-06 00:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL
2008-02-01 22:35 . 2008-02-01 22:35 15,397 --a------ C:\Program Files\settings.dat
2008-02-01 22:34 . 2008-02-01 22:35 15,895,117 --a------ C:\Program Files\PDFCreator-0_9_5_setup.exe
2008-01-22 23:05 . 2008-01-22 23:05 <REP> d-------- C:\Program Files\DivX
2008-01-22 23:05 . 2008-01-22 23:05 <REP> d-------- C:\Documents and Settings\Muriel\Application Data\DivX
2008-01-22 23:05 . 2008-01-04 22:58 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2008-01-22 23:05 . 2008-01-04 22:58 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe
2008-01-22 23:05 . 2008-01-04 22:58 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe
2008-01-22 23:05 . 2008-01-04 22:58 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-01-22 23:05 . 2008-01-04 22:58 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-01-22 23:02 . 2008-01-22 23:02 17,021,984 --a------ C:\Program Files\DivXInstaller.exe
2008-01-12 11:55 . 2008-02-02 13:23 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-12 11:55 . 2008-01-12 11:55 1,409 --a------ C:\WINDOWS\QTFont.for
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-12 10:47 --------- d-----w C:\Program Files\Wanadoo
2008-02-09 17:27 --------- d-----w C:\Program Files\BoontyGames
2008-02-07 17:24 --------- d-----w C:\Program Files\eMule
2008-01-09 17:15 9,071,216 ----a-w C:\Program Files\deskPDF25-Setup.exe
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 -c----w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-17 16:31 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-12-17 16:30 --------- d-----w C:\Documents and Settings\Muriel\Application Data\AdobeUM
2007-12-09 17:03 1,140 ----a-w C:\Program Files\avast virus cleaner.log
2007-12-09 16:28 407,680 ----a-w C:\Program Files\avast virus cleaner.exe
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-12-02 21:15 59,496 ----a-w C:\Documents and Settings\Muriel\Application Data\GDIPFONTCACHEV1.DAT
2007-11-04 17:58 641,250 ----a-w C:\Program Files\videoinspector.rar
2007-11-04 17:34 867,146 ----a-w C:\Program Files\xvidcore-1.1.0-beta2.zip
2007-10-31 16:04 64,863 ----a-w C:\WINDOWS\Fonts\a_lolita_scorned.zip
2007-07-30 23:03 12,539,729 ----a-w C:\Program Files\neodivx2006.zip
2007-07-08 16:01 15,333,040 ----a-w C:\Program Files\setupfre.exe
2007-07-07 21:09 67,483 ----a-w C:\WINDOWS\Fonts\cup_and_talon.zip
2007-07-07 21:08 23,109 ----a-w C:\WINDOWS\Fonts\hooked_on_booze.zip
2007-07-07 21:07 15,218 ----a-w C:\WINDOWS\Fonts\ardagh.zip
2007-07-07 21:02 135,893 ----a-w C:\WINDOWS\Fonts\aon_cari_celtic.zip
2007-07-07 20:59 9,863 ----a-w C:\WINDOWS\Fonts\rane_insular.zip
2007-07-03 16:59 6,652,812 ----a-w C:\Program Files\sld.codec.pack.2.2.exe
2007-06-29 22:30 3,858,985 ----a-w C:\Program Files\eMule0.48a-Installer.exe
2007-06-20 14:32 6,798,298 -c--a-w C:\Program Files\Photoshop_album_SE_3_0_FR.zip
2007-06-19 22:51 4,474,469 ----a-w C:\Program Files\quickzip.exe
2007-06-09 21:40 1,657,954 ----a-w C:\Program Files\pf-setup.exe
2007-06-07 00:38 20,006,472 ----a-w C:\Program Files\QuickTimeInstaller.exe
2007-05-03 19:35 12,550,328 ----a-w C:\Program Files\Install_NeoDivXSuite.exe
2007-04-22 15:36 1,489,855 ----a-r C:\Program Files\UnzipThemAll.exe
2005-09-24 06:49 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
2007-04-17 17:56 22 -csha-w C:\WINDOWS\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8449936B-D1D2-4A06-9B70-CE47109DFF8A}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B130293F-30E9-4B6B-BC3C-26B87FAD3DF8}]
C:\WINDOWS\system32\pmkji.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E180F496-8A4B-44E2-9FE0-0364E345DB7F}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-25 05:00 15360]
"WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-17 15:30 68856]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 20:34 64512]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 21:58 458752]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-22 21:17 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-22 21:13 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-22 21:17 118784]
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 16:02 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 06:22 794713]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-07-19 14:14 102400]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11 49152]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 10:33 163840]
"Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 09:50 40960]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 09:23 1187840]
"SP00LSV.EXE"="SP00LSV.EXE" []
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-06-14 15:24 278528]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 23:50 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 23:50 81920]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"bm"="C:\Program Files\Fichiers communs\wide\bm.exe" [ ]
"ptask"="C:\Program Files\wide\ptask.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-25 05:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-02 19:25]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-09-02 01:17]
S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-04 18:50]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0deefaa4-a680-11dc-aeea-0018de7ed77a}]
\Shell\AutoRun\command - wd_windows_tools\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2003dd69-0874-11dc-ad40-0018de7ed77a}]
\Shell\Auto\command - MSOCache\doWTP_RESTORE_0.exe -autorun
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28d01fb1-fe3d-11db-ad1a-0018de7ed77a}]
\Shell\Auto\command - F:\MSOCache\doWTP_RESTORE_0.exe -autorun
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{440d11da-2b19-11dc-ada4-0018de7ed77a}]
\Shell\Auto\command - MSOCache\doWTP_RESTORE.exe -autorun
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE.exe -autorun
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-11 20:53:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-12 11:47:29
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ???`???????`?@?????L?@
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\msdtc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\dllhost.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-12 11:49:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-12 10:49:19
Voila où j'en suis, mais lamontagne du desespoir s'effrite c'est bon signe!
Muriel