Svchost infecté rapport HijackThis

si tu as recréé un point de restauration,au moins bagle n'est plus dedans

un piti up
Si quelqu'un peut m'aider svp...
Merci d'avance.

Personne pour mon rapport?...
Pitié...

/!\IMPORTANT/!\
Désactive l'UAC (User Account Control ou Contrôle de Compte Utilisateur) le temps de la désinfection,tu le réactiveras après ta désinfection:
• Va dans Panneau de Configuration puis Comptes d'Utilisateurs.
• Clique sur Activer ou désactiver le contrôle des comptes utilisateurs.
• Décoche la case Utiliser le contrôle des comptes utilisateurs pour vous aider à protéger votre ordinateur.
• Clique sur OK pour enregistrer la modification et redémarre ton PC lorsque cela t'est demandé.

aide en cas de problèmes

ensuite

c'est important

Lancer Spybot-S&D, Mode avancé, Outils, Résident, décocher la case située devant TeaTimer.
Fermer Spybot-S&D.
aide

Tu le réactiveras une fois que nous auront terminé la désinfection ( et pas avant ! ) .
Attention , à ce moment là, Spybot te demandera des modifs de registres :
tu les accepteras toutes ! ...

ensuite

Télécharge Malwarebytes' Anti-Malware et enregistre le sur ton Bureau.
https://www.malwarebytes.com/

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharges le ici : https://www.malekal.com/tutorial-aboutbuster/ )

A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.
Double-clique sur l'icône "Download_mbam-setup.exe" sur ton bureau pour démarrer le programme d'installation.

Pendant l'installation, suis les indications n'apporte aucune modification aux réglages par défaut et en fin d'installation, vérifie que les options "Update Malwarebytes' Anti-Malware" et "Launch Malwarebytes' Anti-Malware" soit cochées.
MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue.
La fenêtre principale de MBAM s'affiche :
Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.
MBAM analyse ton ordinateur.
L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.
A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.
Si des malwares sont détectés, leur liste s'affiche.
***EN CLIQUANT SUR SUPPRESSION(?)FAIT LE*** , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)
Ferme MBAM en cliquant sur Quitter.
Poste le rapport dans ta réponse

Merci Chimay8, je m'y mets de suite... Je posterai le rapport MBAM dès que terminé.

Voici le rapport MBAM:

Malwarebytes' Anti-Malware 1.32
Version de la base de données: 1643
Windows 6.0.6001 Service Pack 1

11/01/2009 22:40:53
mbam-log-2009-01-11 (22-40-53).txt

Type de recherche: Examen complet (C:\|D:\|F:\|)
Eléments examinés: 262813
Temps écoulé: 2 hour(s), 18 minute(s), 48 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sk9ou0s (Worm.Bagel) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sk9ou0s (Worm.Bagel) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sk9ou0s (Worm.Bagel) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mule_st_key (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Users\Ordi1\AppData\Roaming\m (Trojan.Agent) -> Delete on reboot.

Fichier(s) infecté(s):
C:\Users\Ordi1\AppData\Roaming\drivers\srosa2.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\Users\Ordi1\AppData\Roaming\m\data.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Ordi1\AppData\Roaming\m\list.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Ordi1\AppData\Roaming\m\srvlist.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\system\ieudinit.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\system\mstsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\mdelk.exe (Trojan.Spammer) -> Quarantined and deleted successfully.
C:\Windows\System32\wintems.exe (Trojan.Spammer) -> Delete on reboot.
C:\Users\Ordi1\AppData\Roaming\m\flec006.exe (Trojan.Agent) -> Delete on reboot.

Encore merci.

Télécharge FindyKill de Chiquitine29

****Notes importantes****
* si tu as le programme "Elibagla" sur ton PC , supprime le ( risque de conflit entre les deux outils ) .

Fais un clic droit sur le lien, enregistrer sous .....sur le bureau

http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

Dézippe le sur le bureau

Entre dans le dossier FindyKill

double clique sur FindyKill.exe

choisis l'option 1 (recherche)

un rapport va s'ouvrir, poste le dans ta prochaine réponse s-t-p

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque

Juste un petit souci. Pour FindyKill, le lein que tu m'as donné ne pointe pas sur une archive mais sur un installeur, et celui-ci me propose par défaut de faire l'install de Findy dans c:\program files\FindyKill.
Hors tu m'as demandé de dézipper l'archive sur le bureau.
Donc je fais quoi?

arff
oui,c'est nouveau

tu peux l'installer par défaut dans program files

Oups, ne sachant si tu serais encore là j'ai pris la liberté de lui dire de faire l'install sur le bureau, c'est bon quand même?

Dans tout les cas, voici le rapport findyKill, dis moi s'il faut refaire l'install au cas où...

----------------- FindyKill V4.711 ------------------

*
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 05/01/09 par Chiquitine29
* Recherche effectuée à 23:35:28 le 11/01/2009
* Windows Vista - Internet Explorer 7.0.6001.18000

((((((((((((((((( *** Recherche *** ))))))))))))))))))

--------------- [ Processus actifs ] ----------------

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\crypserv.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ASUS\AASP\1.00.59\aaCenter.exe
C:\Users\Ordi1\AppData\Roaming\MICROS~1\esentutl.exe
C:\Program Files\Razer\Krait\razerhid.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\SimpleComm\ngssc.exe
C:\Users\Ordi1\AppData\Roaming\drivers\winupgro.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Razer\Krait\razertra.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Razer\Krait\razerofa.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe

--------------- [ Processus infectieux stoppés ] ----------------

"C:\Users\Ordi1\AppData\Roaming\drivers\winupgro.exe" (3552)

--------------- [ Fichiers/Dossiers infectieux ] ----------------

»»»» Presence des fichiers dans C:

»»»» Presence des fichiers dans C:\Windows

»»»» Presence des fichiers dans C:\Windows\Prefetch

Found ! - C:\Windows\prefetch\79451.EXE-00FF16E1.pf
Found ! - C:\Windows\Prefetch\PC GAME - CRACK.EXE-8C7C758C.pf
Found ! - C:\Windows\Prefetch\PC GAME - CRACK.EXE-8C7C758C.pf
Found ! - C:\Windows\Prefetch\SERIAL.EXE-7D7C6E44.pf

»»»» Presence des fichiers dans C:\Windows\system32

Found ! [11/01/2009 22:44] - C:\Windows\system32\mdelk.exe
Found ! [11/01/2009 22:44] - C:\Windows\system32\wintems.exe
Found ! [11/01/2009 22:44] - C:\Windows\system32\ban_list.txt

»»»» Presence des fichiers dans C:\Windows\system32\drivers

»»»» Presence des fichiers dans C:\Users\Ordi1\AppData\Roaming

Found ! [11/01/2009 22:43] - "C:\Users\Ordi1\AppData\Roaming\drivers"
Found ! [11/01/2009 22:43] - "C:\Users\Ordi1\AppData\Roaming\drivers\srosa.sys"
Found ! [11/01/2009 22:43] - "C:\Users\Ordi1\AppData\Roaming\drivers\srosa2.sys"
Found ! [18/08/2004 10:06] - "C:\Users\Ordi1\AppData\Roaming\drivers\winupgro.exe"
Found ! [11/01/2009 22:47] - "C:\Users\Ordi1\AppData\Roaming\drivers\downld"

»»»» Presence des fichiers dans C:\Users\Ordi1\AppData\Local\Temp

»»»» Presence des fichiers dans C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5

Found ! [06/10/2006 09:36] - C:\Program Files\Adobe\Adobe Flash CS3\fr\First Run\filelist.txt
Found ! [06/10/2006 09:36] - C:\Users\Ordi1\AppData\Local\Adobe\Flash CS3\fr\Configuration\filelist.txt
Found ! [10/01/2009 18:56] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2IT8GII6\b64[1].jpg
Found ! [11/01/2009 11:42] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2IT8GII6\b64[2].jpg
Found ! [11/01/2009 15:45] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2IT8GII6\b64_1[1].jpg
Found ! [10/01/2009 18:55] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2IT8GII6\b64_3[1].jpg
Found ! [11/01/2009 00:12] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2IT8GII6\b64_3[2].jpg
Found ! [10/01/2009 20:11] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2IT8GII6\b64_5[1].jpg
Found ! [11/01/2009 22:44] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2IT8GII6\file[1].txt
Found ! [10/01/2009 20:10] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\b64[1].jpg
Found ! [11/01/2009 00:13] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\b64[2].jpg
Found ! [11/01/2009 07:38] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\b64[3].jpg
Found ! [11/01/2009 19:55] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\b64[4].jpg
Found ! [10/01/2009 18:56] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\b64_1[1].jpg
Found ! [11/01/2009 15:47] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\b64_2[1].jpg
Found ! [11/01/2009 22:47] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\b64_2[2].jpg
Found ! [11/01/2009 11:41] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\b64_3[1].jpg
Found ! [11/01/2009 15:44] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\b64_3[2].jpg
Found ! [11/01/2009 19:54] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\b64_3[3].jpg
Found ! [11/01/2009 19:46] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3F411HPF\file[1].txt
Found ! [11/01/2009 15:45] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6LT99SJ\b64[1].jpg
Found ! [10/01/2009 18:58] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[1].jpg
Found ! [10/01/2009 20:10] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[2].jpg
Found ! [11/01/2009 00:13] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[3].jpg
Found ! [11/01/2009 00:15] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[4].jpg
Found ! [11/01/2009 19:55] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[5].jpg
Found ! [11/01/2009 19:58] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[6].jpg
Found ! [11/01/2009 22:46] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[7].jpg
Found ! [11/01/2009 22:44] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_3[1].jpg
Found ! [11/01/2009 07:38] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_1[1].jpg
Found ! [11/01/2009 07:40] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_1[2].jpg
Found ! [11/01/2009 11:44] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_1[3].jpg
Found ! [10/01/2009 18:59] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_2[1].jpg
Found ! [11/01/2009 00:15] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_2[2].jpg
Found ! [11/01/2009 07:40] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_2[3].jpg
Found ! [11/01/2009 20:00] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_2[4].jpg
Found ! [10/01/2009 20:09] - C:\Users\Ordi1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_3[1].jpg

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
Sidebar=C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
RocketDock="C:\Program Files\RocketDock\RocketDock.exe"
DAEMON Tools="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
WMPNSCFG=C:\Program Files\Windows Media Player\WMPNSCFG.exe
SimpleComm="C:\Program Files\SimpleComm\ngssc.exe" /min
IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AdobeUpdater=
<NO NAME>=
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AutorunsDisabled=
IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
Krait=C:\Program Files\Razer\Krait\razerhid.exe
RtHDVCpl=RtHDVCpl.exe
<NO NAME>=
StartCCC="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

[HKEY_CURRENT_USER\software\local appwizard-generated applications\DestComp]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\hprbui]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\Registrar]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\RocketDock]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\serial]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]

--------------- [ Registre / Clés infectieuses ] ----------------

Found ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\Local AppWizard-Generated Applications\serial
Found ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\serial
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_CURRENT_USER\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\FFC

/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1

--------------- [ Etat / Services ] ----------------

+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

EapHost - Type de démarrage = 3

Wlansvc - Type de démarrage = 3

/!\ SharedAccess - Type de démarrage = 4

/!\ wuauserv - Type de démarrage = 4

/!\ wscsvc - Type de démarrage = 4

/!\ WinDefend - Type de démarrage = 4

/!\ UAC is Disable

--------------- [ Recherche dans supports amovibles] ----------------

+- Informations :

C: - Lecteur fixe
D: - Lecteur fixe
F: - Lecteur fixe
H: - Lecteur de CD-ROM

+- Contenu de l'autorun : H:\autorun.inf

[autorun]
open=Autorun.exe
Icon=DS_48.ico
Name=Dead Space

[Special]
Disk=1
ProductGuiID={4D87DC92-C328-46EC-A7B4-9C88129DC696}

+- presence des fichiers :

Found ! [27/09/2008 23:45][-r-------] - H:\autorun.inf

--------------- [ Registre / Mountpoint2 ] ----------------

-> Not found !

------------------- ! Fin du rapport ! --------------------

oui,

mais parfois il beug parce qu'il n'est pas dans program files

lance le quand même comme ça

ok,c'est bon

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d'avoir été infectées sans les ouvrir
réouvre Findykill,

choisis cette fois ci l'option 2 (suppression)

il y aura 2 redémarrages, laisse travailler l'outils jusqu'a l'apparition du message "nettoyage effectué"

un rapport va s'ouvrir, poste le dans ta prochaine réponse s-t-p

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque
Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valides

ben là le process c'est bien passé, sauf qu'il mentionné à 3 reprises qu'il n'y avait pas de disque dans le lecteur G/ (virtuel), à chaque fois j'ai du cliquer sur continuer et finalement le process semble s'être terminé normalement.

ok,

poste le rapport stp
le rapport FindyKill.txt est sauvegardé à la racine du disque

Ok, bien ce fut laborieux mais la 1ere install de findykill devait poser problème car l'étape de suppression (option 2) ne s'était pas dérouler correctement, j'ai donc réinstaller findykill ds program files comme l'installeur le demande et ai refait toute la procédure.
Voici le rapport :
(mias à part qu'il y a eu effectivemment suppression de plusieurs choses, pour moi c'est du chinois)

----------------- FindyKill V4.711 ------------------

*
* executed from : C:\Program Files\FindyKill
* Update on 05/01/09 par Chiquitine29
* Start at 0:06:31 the 12/01/2009
* Windows Vista - Internet Explorer 7.0.6001.18000

((((((((((((((( *** deleting *** ))))))))))))))))))

--------------- [ Active Processes ] ----------------

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\runonce.exe
C:\Program Files\ASUS\AASP\1.00.59\aaCenter.exe
C:\Windows\system32\conime.exe

--------------- [ Infected files / folders ] ----------------

»»»» Supression files in C:

»»»» Supression files in C:\Windows

»»»» Supression files in C:\Windows\Prefetch

Deleted ! - C:\Windows\prefetch\79451.EXE-00FF16E1.pf
Deleted ! - C:\Windows\prefetch\PC GAME - CRACK.EXE-8C7C758C.pf
Deleted ! - C:\Windows\prefetch\SERIAL.EXE-7D7C6E44.pf

»»»» Supression files in C:\Windows\system32

Deleted ! - C:\Windows\system32\mdelk.exe
Deleted ! - C:\Windows\system32\wintems.exe
Deleted ! - C:\Windows\system32\ban_list.txt

»»»» Supression files in C:\Windows\system32\drivers

»»»» Supression files in C:\Users\Ordi1\AppData\Roaming

Deleted ! - "C:\Users\Ordi1\AppData\Roaming\m\flec006.exe"
Deleted ! - "C:\Users\Ordi1\AppData\Roaming\m\list.oct"
Deleted ! - "C:\Users\Ordi1\AppData\Roaming\m\data.oct"
Deleted ! - "C:\Users\Ordi1\AppData\Roaming\m\srvlist.oct"
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\3D Cartoon Icons Pack II -.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\3D Interactive Holiday Candles 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\70-272 Microsoft MCDST Windows XP 8.04.05.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\70-290 MCSE Windows Server Environment 8.08.05.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Absolute CHAOS 3.8.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\AdventureBoy_Nokia_S40_DP2_FR_EN_ES_DE_IT_1_0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Alert's icons pack 3.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Alive WMA MP3 Recorder 3.3.2.8.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\ALWIL.avast!.4.Anti-Virus.Professional.Edition.v4.7.827.Trial.BRASIL.+.Crack.(trial.to.full).zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Any To-Do List 2.02.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Aqua Deskperience 1.5.0.28.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\ASA Data Wizard 8.8.0.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Atlantis Word Processor 1.6.1.9.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Audubon Close Up - Birds and Flowers 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Barcode Prime Image Generator for Codabar 1.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\BarComp 3.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Biochem Lab Solutions 3.7.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Birthday Reminder 1.0.4.2.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\BizTalk Server 2006 R2.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\BruceLee ScreenMate 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\BSE-CBE Reminders (Vert) 1.0.0.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Cat Information Gadget 1.0.0.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\CHD 0.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Cleantouch Developers Management System 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\ClickZap 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Close Tab By Double Click 1.09.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Code Visual to Flowchart 5.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\COFFEE BREAK Icons.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Complex Calculation 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Cool Mp3 Converter 1.87.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Copy Project 1.00.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Coumadin Dosing Database.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Duke Nukem Mobile 3D.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Dummy Lipsum 2.3.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\DVD Bitrate Calculator 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\EasyCCTV 2.1.146.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\EditURLs 2.02.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Enhanced Controls 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\EuroOffice Solver Professional 1.6.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\ExchangeRecovery 2.1 Build 096246.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Extra Video to iPod MP4 Converter 6.04.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Fast Emoticons.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Firefox 3.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Flash Animated Screensaver 1.04.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Flash Switcher 0.2.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\FlashSpring Server 2.3.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Free Average Interest Rate Calculator 4.5.01.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\GenStocks 1.4.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\GI PassGen Security Suite 1.6.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Glu Mobile Sonic The Hedgehog Golf 176x220 SE.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Google Calendar Delphi Component.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Ground Control 1.0.71101.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Growl 1.2.1 Build 1.2.3064.16892.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\GW Proph-Necro Skill Icon Set.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Hesron 2.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\HiDownload Pro 7.22.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\hMailServer 4.4.2 Build 277 Beta.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\IA Print Screen 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\IDAutomation ASP.NET Barcode Web Control 7.2.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\IEDesignMode 1.00.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\iMacros for Firefox 6.1.1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\IntelliEdit 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Intellisoft TimeSync 1.7.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Kandyan Vista Icons 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\kaspersky.activation.[sharethefiles.com].zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Kaspersky.Anti-Hacker.1.8.180.key.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Kaspersky.Antivirus.Personal.6.0.Key11.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Kaspersky.AntiVirus.Personal.Pro.v5.0.676.Final.Eng.Incl.LicenseKeys.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Kaspersky_Internet_Security_2006_6.0.0.300.Util.RoboCop.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\LiveWorship 1.2 beta 4.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\M Turbo Restart 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\MB Free Capricorn Astrology 1.60.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\MB6-205 Practice Exam Testing Engine Software 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\MediaPortal 1.0.0.0 RC4.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\MIDI Tracker 1.2.5.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\MingSoft Image To Video 1.0.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\My Passwords 5.0.0.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Myjewchat 1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Nevo Audio Converter 2.4.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Niagara Falls Opera Widget 1.9.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\NOD32.Antivirus.System.2.51.26.(NT2000XP2003x64).en.espaÇŸ¶ñol.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\nod32_all_ver_crack.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\O&K Printer Viewer Pro 2.2.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\OCR.Net Barcode Component 3.2.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Okoker HD-DVD Burner 3.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\OOJNI Add-in .NET (C#) for VS2005 3.0.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Outlook 2003 Add-in
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\PacketMon 1.00.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Panda.Titanium.2006.Antivirus+Antispyware.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\PartyDJ 9.3.0.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Password Export Server 3.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\PickPe 1.4.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Pocket PC IPAQ DVD Converter 3.2.6.50.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Question Writer - Personal Edition 3.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Realtime Earnings Counter 1.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Rebate Tracker 1.0.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\rebuilt.Kaspersky.internet.security.6.0.final.fr+crack.16-07-2007.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Remote Database Manager SQL 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Retina WiFi Scanner 1.0.3.40.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Riptastic! 1.12.0.51.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Rising Personal Firewall 2007 19.05.31.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Rndtone 1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\S File Finder 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\SakasaMouse 1.03.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Shortcuts Panel 0.1.0.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\shot2char 1.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\SimAquarium reef shark edition 2.3.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Sphygmic Software Spreadsheet.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Stexbar 1.5.0.151.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Symantec.Norton.Ghost.10.Spanish.part06.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\SySpeed 2.01.01.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\TaskMonifier 1.0.0 build 723.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\The Visitors 1.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\ToggleActiveX 1.2.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Touch-It 4.5.0.3.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\ue.norton.ou.mcafee.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\UltimateZip 4.0.2.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Universal Radio 0.2.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\WCup 2006 1.70.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Wimpy AV 2.2.8.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Windows Utility 1.0.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\WinGroove 0.A4 Beta-2.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\Wolves Screensaver 1.0.6.2634.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\wySUwyg 2.0.0.1.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\XI!Swatch 1.01.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\xSolvo html2xml 1.2.0.4.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\YASA VOB to MP4 Converter 3.8.54.1432.zip
Deleted ! - C:\Users\Ordi1\AppData\Roaming\m\shared\[BrasilP2P]Mcafee.Virusscan.Enterprise.8.0i+Desktop.Firewall.8.5.DrMartinez.zip
Deleted ! - "C:\Users\Ordi1\AppData\Roaming\m\shared"
Deleted ! - "C:\Users\Ordi1\AppData\Roaming\m"
Deleted ! - "C:\Users\Ordi1\AppData\Roaming\drivers\srosa.sys"
Deleted ! - "C:\Users\Ordi1\AppData\Roaming\drivers\srosa2.sys"
Deleted ! - "C:\Users\Ordi1\AppData\Roaming\drivers\winupgro.exe"
Deleted ! - "C:\Users\Ordi1\AppData\Roaming\drivers\downld"
Deleted ! - "C:\Users\Ordi1\AppData\Roaming\drivers"

»»»» Supression files in C:\Users\Ordi1\AppData\Local\Temp

»»»» Supression files in C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\2IT8GII6\b64[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\2IT8GII6\b64[2].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\2IT8GII6\b64_1[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\2IT8GII6\b64_2[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\2IT8GII6\b64_3[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\2IT8GII6\b64_3[2].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\2IT8GII6\b64_5[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\b64[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\b64[2].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\b64[3].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\b64[4].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\b64_1[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\b64_2[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\b64_2[2].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\b64_3[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\b64_3[2].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\b64_3[3].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\3F411HPF\file[1].txt
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\F6LT99SJ\b64[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\F6LT99SJ\b64[2].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[2].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[3].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[4].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[5].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[6].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_1[7].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\F6LT99SJ\b64_3[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_1[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_1[2].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_1[3].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_2[1].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_2[2].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_2[3].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_2[4].jpg
Deleted ! - C:\Users\Ordi1\Local Settings\Temporary Internet Files\Content.IE5\UR5RP9LJ\b64_3[1].jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_CURRENT_USER\Software\MuleAppData
Deleted ! - HKEY_CURRENT_USER\Software\FFC
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdelk.exe
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintems.exe
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\flec006.exe
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hldrrr.exe
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winfilse.exe
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupgro.exe
Deleted ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\Local AppWizard-Generated Applications\serial
Deleted ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\FFC
Deleted ! - HKEY_USERS\S-1-5-21-3592243411-1056888313-2424810740-1000\Software\MuleAppData

--------------- [ States / Restarting of services ] ----------------

+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

EapHost - Type of startup = 2

Wlansvc - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2

WinDefend - Type of startup = 2

-> UAC is Enable

--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Lecteur fixe
D: - Lecteur fixe
F: - Lecteur fixe
J: - Lecteur amovible

+- deleting files :

--------------- [ Registry / Mountpoint2 ] ----------------

-> Not found !

--------------- [ Searching Other Infections ] ----------------

Références de comparaison Bagle MD5 :

113ac36b77630a2f67dd6cb7844406a4 C:\Windows\system32\mdelk.exe
113ac36b77630a2f67dd6cb7844406a4 C:\Windows\system32\wintems.exe
ebe38e2fcd97bfaf184cd5386100b529 C:\Users\Ordi1\AppData\Roaming\drivers\winupgro.exe
5d641d5e744ad9aca087e8dae68e7822 C:\Avenger\wintems.exe

Suspect ! - ebe38e2fcd97bfaf184cd5386100b529 C:\Program Files\RocketDock\RocketDock.exe

--------------- [ Searching Cracks / Keygen ] ----------------

C:\Users\Ordi1\AppData\Local\QuickPar\sacred_ii_fallen_angel_fr_crack.rar(1).qp
C:\Users\Ordi1\AppData\Local\QuickPar\sacred_ii_fallen_angel_fr_crack.rar(1).qp.bak
C:\Users\Ordi1\AppData\Roaming\uTorrent\Sacred2_V2.34.0_Crack.zip.torrent

---------------- ! End of report ! ------------------

PS : Par contre je n'ai plus d'antivirus, plus de volets windows (vista), plus de résidents spybots (pas eu besoin de reconfigurer spybot comme tu me l'avais demandé)...

oui,

m'étonne pas,
bagle détruit les antivirus

faut que tu réinstalles

au fait,bagle s'attrappe via des cracks foireux et pourri

si tu réutilise tes cracks
tu seras réinfecté à coup sur,c'est une certitude

bref
désinstalle et réinstalle Antivir

fais les MAJ de adobe
https://get2.adobe.com/reader/otherversions/

poste un nouveau rapport Hijack avec stp

Ok, bon je vois que je suis découvert... ;-)

Sinon trève de plaisanteries, j'utilisais Avira antivir avant tout ce bazar, tu me conseillerais quoi comme bon antivirus gratuit et que me faut t'il mettre en place en plus de celui ci (pare feu, résident tel que spybot...), afin que mon ordi soit bien protégé, car j'avoue avoir été peut être un peu trop laxiste de ce côté, non?

Je te poste un nouveau apport Hijack dès que celui est terminé.

Et voilà le rapport :

Logfile of HijackThis v1.99.1
Scan saved at 01:48:39, on 12/01/2009
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\AASP\1.00.59\aaCenter.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\play2\play.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Users\Ordi1\AppData\Roaming\MICROS~1\esentutl.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Krait] C:\Program Files\Razer\Krait\razerhid.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SimpleComm] "C:\Program Files\SimpleComm\ngssc.exe" /min
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{22398AB0-0E43-4B88-9680-38A1AE92E2AE}: NameServer = 212.27.53.252,212.27.54.252
O17 - HKLM\System\CS1\Services\Tcpip\..\{22398AB0-0E43-4B88-9680-38A1AE92E2AE}: NameServer = 212.27.53.252,212.27.54.252
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\Windows\SYSTEM32\crypserv.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

tu gardes Antivir et spybot
c'est très bien comme ça

faut les réinstaller

en attendant désinstalle findykill

refais un scan avec MBAM et Antivir
poste les rapports