27.src, 56.src, 76.src ... VIRUS

OK , bonne idée .

Telecharge malwarebytes
https://www.malwarebytes.com/

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examen rapide".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.

PS : les rapport sont aussi rangé dans l onglet rapport/log

excuser moi mais les processus se nomme 65.scr, 25.scr etc....

voila le log.txt :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Propriétaire at 2009-05-23 11:57:23
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 23 GB (43%) free of 53 GB
Total RAM: 255 MB (8% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-01-28 1554256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-05-15 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-15 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-05-15 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar avec bloqueur de fenêtres pop-up - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]
{D0943516-5076-4020-A3B5-AEFAF26AB263} - Veoh Browser Plug-in - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll [2008-06-19 352256]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-05-15 259696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"KBD"=C:\HP\KBD\KBD.EXE [2003-03-31 61440]
"StorageGuard"=C:\Program Files\VERITAS Software\Update Manager\sgtray.exe [2002-06-18 155648]
"WCOLOREAL"=C:\Program Files\Coloreal\coloreal.exe [2002-11-27 131072]
"Recguard"=C:\WINDOWS\SMINST\RECGUARD.EXE [2002-09-14 212992]
"nwiz"=nwiz.exe /install []
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2003-01-24 315392]
"PS2"=C:\WINDOWS\system32\ps2.exe [2002-10-16 81920]
"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-07-19 266497]
"PinnacleDriverCheck"=C:\WINDOWS\system32\PSDrvCheck.exe [2003-11-10 406016]
"Pinnacle WebUpdater"=C:\Program Files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe [2006-08-24 385024]
"LXCTCATS"=rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16 []
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe [2008-03-25 144784]
"UnlockerAssistant"=C:\Program Files\Unlocker\UnlockerAssistant.exe [2008-05-02 15872]
"PMCRemote"=C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe [2006-09-13 176128]
"AppleSyncNotifier"=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-11-07 111936]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
"netmon"=C:\WINDOWS\system\dllcache.exe [2009-05-17 77312]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
"Steam"=c:\program files\valve\steam\steam.exe [2009-05-19 1217784]
"Veoh"=C:\Program Files\Veoh Networks\Veoh\VeohClient.exe [2008-06-19 3664944]
""= []
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-19 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-15 39408]
"msmacro32"=C:\WINDOWS\msmacro64.exe [2009-05-23 115200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
C:\Program Files\Lexmark 5400 Series\ezprint.exe [2006-06-07 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 5400 Series Fax Server]
C:\Program Files\Lexmark 5400 Series\fm3032.exe [2006-07-11 294912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxctmon.exe]
C:\Program Files\Lexmark 5400 Series\lxctmon.exe [2006-06-20 286720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe [2002-07-18 28672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-02-21 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2002-10-16 315392]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dllcache]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dllcache]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
""=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\hp\IAccess\IAccess.exe"="C:\hp\IAccess\IAccess.exe:*:Enabled:Accès à Internet"
"C:\Program Files\Lexmark 5400 Series\Install\x86\Uninst.exe"="C:\Program Files\Lexmark 5400 Series\Install\x86\Uninst.exe:*:Enabled:Désinstaller le pilote de l'imprimante Lexmark 5400 Series"
"C:\WINDOWS\system32\lxctcoms.exe"="C:\WINDOWS\system32\lxctcoms.exe:*:Enabled:Lexmark Communications System"
"C:\Program Files\DivX\DivX Player\DivX Player.exe"="C:\Program Files\DivX\DivX Player\DivX Player.exe:*:Enabled:DivX Player"
"C:\Program Files\DivX\DivX Codec\DivX EKG.exe"="C:\Program Files\DivX\DivX Codec\DivX EKG.exe:*:Enabled:DivX EKG"
"C:\Program Files\Valve\Steam\SteamApps\mounirin93\condition zero\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\mounirin93\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Valve\Steam\SteamApps\mounirin93\day of defeat\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\mounirin93\day of defeat\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Valve\Steam\SteamApps\mounirin93\counter-strike\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\mounirin93\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Pinnacle\MediaCenter\PMC.exe"="C:\Program Files\Pinnacle\MediaCenter\PMC.exe:LocalSubNet:Enabled:Pmc.exe"
"C:\Program Files\Pinnacle\MediaCenter\PSST.exe"="C:\Program Files\Pinnacle\MediaCenter\PSST.exe:LocalSubNet:Enabled:PSST.exe"
"C:\Program Files\Pinnacle\MediaCenter\PMSInstallInit.exe"="C:\Program Files\Pinnacle\MediaCenter\PMSInstallInit.exe:LocalSubNet:Enabled:PMSInstallInit.exe"
"C:\Program Files\Pinnacle\MediaCenter\PMC.Tvtv.Wizard.exe"="C:\Program Files\Pinnacle\MediaCenter\PMC.Tvtv.Wizard.exe:LocalSubNet:Enabled:PMC.Tvtv.Wizard.exe"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe"="C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe:LocalSubNet:Disabled:PMCService"
"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe"="C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe:*:Enabled:Sunbelt Firewall GUI"
"C:\Program Files\Veoh Networks\Veoh\VeohClient.exe"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client"
"C:\Program Files\Valve\Steam\SteamApps\common\trackmania nations forever\TmForever.exe"="C:\Program Files\Valve\Steam\SteamApps\common\trackmania nations forever\TmForever.exe:*:Enabled:TrackMania Nations Forever"
"C:\Program Files\Valve\Steam\SteamApps\common\trackmania nations forever\TmForeverLauncher.exe"="C:\Program Files\Valve\Steam\SteamApps\common\trackmania nations forever\TmForeverLauncher.exe:*:Enabled:TrackMania Nations Forever"
"C:\WINDOWS\system\dllcache.exe"="C:\WINDOWS\system\dllcache.exe:*:Microsoft Enabled"
"C:\WINDOWS\System32\55.scr"="C:\WINDOWS\System32\55.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\87.scr"="C:\WINDOWS\System32\87.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\12.scr"="C:\WINDOWS\System32\12.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\05.scr"="C:\WINDOWS\System32\05.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\28.scr"="C:\WINDOWS\System32\28.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\72.scr"="C:\WINDOWS\System32\72.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\54.scr"="C:\WINDOWS\System32\54.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\34.scr"="C:\WINDOWS\System32\34.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\26.scr"="C:\WINDOWS\System32\26.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\77.scr"="C:\WINDOWS\System32\77.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\68.scr"="C:\WINDOWS\System32\68.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\22.scr"="C:\WINDOWS\System32\22.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\15.scr"="C:\WINDOWS\System32\15.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\38.scr"="C:\WINDOWS\System32\38.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\56.scr"="C:\WINDOWS\System32\56.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\71.scr"="C:\WINDOWS\System32\71.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\48.scr"="C:\WINDOWS\System32\48.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\82.scr"="C:\WINDOWS\System32\82.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\60.scr"="C:\WINDOWS\System32\60.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\13.scr"="C:\WINDOWS\System32\13.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\07.scr"="C:\WINDOWS\System32\07.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\47.scr"="C:\WINDOWS\System32\47.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\84.scr"="C:\WINDOWS\System32\84.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\57.scr"="C:\WINDOWS\System32\57.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\74.scr"="C:\WINDOWS\System32\74.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\70.scr"="C:\WINDOWS\System32\70.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\21.scr"="C:\WINDOWS\System32\21.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\25.scr"="C:\WINDOWS\System32\25.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\20.scr"="C:\WINDOWS\System32\20.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\86.scr"="C:\WINDOWS\System32\86.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\27.scr"="C:\WINDOWS\System32\27.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\58.scr"="C:\WINDOWS\System32\58.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\14.scr"="C:\WINDOWS\System32\14.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\66.scr"="C:\WINDOWS\System32\66.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\06.scr"="C:\WINDOWS\System32\06.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\02.scr"="C:\WINDOWS\System32\02.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\63.scr"="C:\WINDOWS\System32\63.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\45.scr"="C:\WINDOWS\System32\45.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\35.scr"="C:\WINDOWS\System32\35.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\76.scr"="C:\WINDOWS\System32\76.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\43.scr"="C:\WINDOWS\System32\43.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\46.scr"="C:\WINDOWS\System32\46.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\75.scr"="C:\WINDOWS\System32\75.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\33.scr"="C:\WINDOWS\System32\33.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\42.scr"="C:\WINDOWS\System32\42.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\10.scr"="C:\WINDOWS\System32\10.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\30.scr"="C:\WINDOWS\System32\30.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\51.scr"="C:\WINDOWS\System32\51.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\08.scr"="C:\WINDOWS\System32\08.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\36.scr"="C:\WINDOWS\System32\36.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\73.scr"="C:\WINDOWS\System32\73.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\65.scr"="C:\WINDOWS\System32\65.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\23.scr"="C:\WINDOWS\System32\23.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\32.scr"="C:\WINDOWS\System32\32.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\83.scr"="C:\WINDOWS\System32\83.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\62.scr"="C:\WINDOWS\System32\62.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\04.scr"="C:\WINDOWS\System32\04.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\16.scr"="C:\WINDOWS\System32\16.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\78.scr"="C:\WINDOWS\System32\78.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\81.scr"="C:\WINDOWS\System32\81.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\80.scr"="C:\WINDOWS\System32\80.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\53.scr"="C:\WINDOWS\System32\53.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\24.scr"="C:\WINDOWS\System32\24.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\37.scr"="C:\WINDOWS\System32\37.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\64.scr"="C:\WINDOWS\System32\64.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\52.scr"="C:\WINDOWS\System32\52.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\00.scr"="C:\WINDOWS\System32\00.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\01.scr"="C:\WINDOWS\System32\01.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\40.scr"="C:\WINDOWS\System32\40.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\85.scr"="C:\WINDOWS\System32\85.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\50.scr"="C:\WINDOWS\System32\50.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\88.scr"="C:\WINDOWS\System32\88.scr:*:Microsoft Enabled"
"C:\WINDOWS\System32\61.scr"="C:\WINDOWS\System32\61.scr:*:Microsoft Enabled"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.reg - open - regedit.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-05-23 11:57:23 ----D---- C:\rsit
2009-05-20 14:08:25 ----D---- C:\Program Files\Fichiers communs\DivX Shared
2009-05-19 22:53:17 ----A---- C:\WINDOWS\msmacro64.exe
2009-05-17 17:56:07 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-05-17 17:54:51 ----A---- C:\WINDOWS\ntbtlog.txt

======List of files/folders modified in the last 1 months======

2009-05-23 11:57:24 ----D---- C:\WINDOWS\Prefetch
2009-05-23 11:55:51 ----D---- C:\WINDOWS\system32
2009-05-23 11:21:45 ----D---- C:\Program Files\Mozilla Firefox
2009-05-23 11:11:39 ----D---- C:\WINDOWS\system32\drivers
2009-05-23 11:07:04 ----D---- C:\WINDOWS\Temp
2009-05-23 02:47:37 ----D---- C:\WINDOWS
2009-05-23 02:21:23 ----D---- C:\WINDOWS\system32\FxsTmp
2009-05-23 02:13:29 ----D---- C:\WINDOWS\system32\CatRoot2
2009-05-20 14:09:42 ----D---- C:\Program Files\DivX
2009-05-20 14:09:18 ----SHD---- C:\WINDOWS\Installer
2009-05-20 14:09:16 ----SHD---- C:\Config.Msi
2009-05-20 13:41:02 ----D---- C:\WINDOWS\Minidump
2009-05-19 01:48:40 ----D---- C:\WINDOWS\BDOSCAN8
2009-05-17 16:36:03 ----D---- C:\WINDOWS\system
2009-05-17 15:06:16 ----D---- C:\Program Files\TubeMaster
2009-05-16 09:17:53 ----D---- C:\WINDOWS\WinSxS
2009-05-16 09:17:41 ----RAD---- C:\Program Files
2009-05-16 09:17:09 ----D---- C:\Program Files\ISOpen
2009-05-16 09:16:26 ----D---- C:\Program Files\Call of Duty Game of the Year Edition
2009-05-15 22:23:06 ----D---- C:\Program Files\Google
2009-04-29 22:29:09 ----D---- C:\Program Files\Lx_cats

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-11-25 75072]
R1 fwdrv;Firewall Driver; C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 302000]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-19 40320]
R1 khips;Kerio HIPS Driver; C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 72624]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2001-10-23 9855]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2002-12-14 732492]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800]
R3 ASAPIW2k;ASAPIW2K; C:\WINDOWS\system32\drivers\ASAPIW2k.sys [2005-05-26 11264]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2006-02-21 1505792]
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSF_DP.sys [2002-08-08 1175504]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFHWBS2.sys [2002-08-08 169779]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-11-21 9856]
R3 Ps2;PS2; C:\WINDOWS\System32\DRIVERS\PS2.sys [2001-06-04 14112]
R3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 sysdrv32;Play Port I/O Driver; \??\C:\WINDOWS\system32\drivers\sysdrv32.sys []
R3 usbehci;Pilote miniport de contrôleur hôte amélioré USB 2.0 Microsoft; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [2002-08-08 604272]
S1 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2002-10-26 91774]
S1 AmdK7;Pilote de processeur AMD K7; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2004-08-19 41600]
S2 BDRSDRV;BDRSDRV; \??\C:\Program Files\Softwin\BitDefender10\bdrsdrv.sys []
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2002-10-26 71514]
S3 BDFSDRV;BDFSDRV; \??\C:\Program Files\Softwin\BitDefender10\bdfsdrv.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 cpuz131;cpuz131; \??\C:\DOCUME~1\lynx\LOCALS~1\Temp\cpuz131\cpuz_x32.sys []
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2002-10-26 80283]
S3 MPE;Filtre BDA MPE; C:\WINDOWS\system32\DRIVERS\MPE.sys [2004-08-03 15360]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 QCMerced;Logitech QuickCam Express; C:\WINDOWS\System32\DRIVERS\LVCM.sys [2002-06-10 37888]
S3 S3Psddr;S3Psddr; C:\WINDOWS\System32\DRIVERS\s3gnbm.sys [2004-08-03 166912]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 sony_ssm.sys;sony_ssm.sys; \??\C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\sony_ssm.sys []
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 USB28xxBGA;USB 2870 Device; C:\WINDOWS\system32\DRIVERS\emBDA.sys [2006-08-09 291200]
S3 USB28xxOEM;USB 28xx OEM Filter; C:\WINDOWS\system32\DRIVERS\emOEM.sys [2006-08-09 28160]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-11-07 32000]
S3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2004-08-03 17024]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 Xponaut_WBD;Xponaut WaveBridge Device (WDM); C:\WINDOWS\system32\drivers\xpntwbd.sys [2007-01-19 13184]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;Avira AntiVir Personal – Free Antivirus Scheduler; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-25 68865]
R2 AntiVirService;Avira AntiVir Personal – Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-25 151297]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-02-21 405504]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 lxct_device;lxct_device; C:\WINDOWS\system32\lxctcoms.exe [2006-07-13 528384]
R2 SPF4;Sunbelt Personal Firewall 4; C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 1234480]
R2 UserAccess7;SecuROM User Access Service (V7); C:\WINDOWS\system32\UAService7.exe [2008-07-31 122880]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-19 14336]
S2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\System32\nvsvc32.exe [2002-09-10 61440]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2004-08-19 268800]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-15 182768]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S4 aspimgr;Microsoft ASPI Manager; C:\WINDOWS\system32\aspimgr.exe []

-----------------EOF-----------------

# Télécharge ceci: (merci a S!RI pour ce petit programme).

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

Exécute le, Double click sur Smitfraudfix.exe choisit l’option 1,
voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php
il va générer un rapport : copie/colle le sur le poste stp.

ok !

entre temps j'ai installer process blocker ! et je les block un par un et sa marche plutot bien en attendant de les suprimer ! bonne idée ?

voila le rapport :

SmitFraudFix v2.416

Rapport fait à 12:23:30,96, 23/05/2009
Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\lxctcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Process Blocker\Process Blocker.exe
C:\Program Files\Process Blocker\Tray Informer.exe
C:\Program Files\Process Blocker\ListEditor.exe
C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Propri‚taire

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Propri‚taire\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PROPRI~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family
DNS Server Search Order: 212.27.40.240
DNS Server Search Order: 212.27.40.241

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9C50C4DB-85B9-42E1-88C9-77FD83EB248E}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9C50C4DB-85B9-42E1-88C9-77FD83EB248E}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9C50C4DB-85B9-42E1-88C9-77FD83EB248E}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin