Supprimer win32backdoor.TDSS

merci mais les liens que tu m'indiquent sont bloqués je pense par le virus et preque tt les site de telechargement de combofix ... alor comment faire ?

merci ;)

ça marche pas . il me di de telecharger combofix dans des sites officiel je crois que moi je ne pe pa acceder. il ne veut pa demarrer. :/

pareil, le mm message. ( il me di d'accepter les termes, si je fé nn ça quitte) ...

oui c vrai je l'ai fait et ça a marché
voici le rapport de combofix :

ComboFix 09-06-13.01 - Basque Philippe 13/06/2009 20:25.1 - NTFSx86 NETWORK
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.801 [GMT 2:00]
Lancé depuis: d:\documents and settings\Basque Philippe\Bureau\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\windows\system32\TDSSosvd.dat
d:\documents and settings\Basque Philippe\RavMonLog

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV.SYS
-------\Service_TDSSserv.sys


((((((((((((((((((((((((((((( Fichiers créés du 2009-05-13 au 2009-06-13 ))))))))))))))))))))))))))))))))))))
.

2009-06-10 19:54 . 2009-06-10 19:54 -------- d-----w- d:\documents and settings\Basque Philippe\Application Data\Malwarebytes
2009-06-10 19:54 . 2009-05-26 11:20 40160 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-06-10 19:54 . 2009-06-10 19:59 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware2
2009-06-10 19:54 . 2009-06-10 19:54 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-10 19:54 . 2009-05-26 11:19 19096 ----a-w- d:\windows\system32\drivers\mbam.sys
2009-06-10 19:47 . 2009-06-10 19:47 -------- d-s---w- D:\CCM
2009-06-10 11:37 . 2009-06-10 11:57 -------- d-----w- d:\documents and settings\Basque Philippe\DoctorWeb
2009-06-10 11:24 . 2009-06-10 11:24 -------- d-----w- d:\documents and settings\Basque Philippe\Local Settings\Application Data\Eazel-FR
2009-06-10 11:24 . 2009-06-10 11:24 -------- d-----w- d:\documents and settings\Basque Philippe\Local Settings\Application Data\Conduit
2009-06-09 19:45 . 2009-06-09 19:45 -------- d-----w- d:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-06-07 21:10 . 2009-06-07 21:10 -------- d-----w- d:\program files\Java
2009-06-07 21:09 . 2009-06-07 21:09 152576 ----a-w- d:\documents and settings\Basque Philippe\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-06 18:13 . 2009-06-06 18:13 579584 -c--a-w- d:\windows\system32\dllcache\user32.dll
2009-06-06 18:10 . 2009-06-06 18:10 -------- d-----w- d:\windows\ERUNT
2009-06-03 19:02 . 2009-06-13 17:11 -------- d-----w- d:\documents and settings\All Users\Application Data\TrackMania
2009-06-03 18:27 . 2009-06-03 18:30 -------- d-----w- d:\program files\TmNationsForever
2009-06-02 17:05 . 2009-06-09 19:53 -------- d-----w- D:\SDFix
2009-05-31 06:16 . 2009-05-31 06:16 -------- d-----w- d:\documents and settings\Basque Philippe\Application Data\live-player
2009-05-31 06:15 . 2009-05-31 06:16 -------- d-----w- d:\program files\Live-Player
2009-05-17 16:18 . 2009-05-17 16:18 -------- d-----w- d:\documents and settings\Basque Philippe\Application Data\dota-allstars.71E01812711E1682B196CE418CDA466F24682743.1
2009-05-17 16:17 . 2009-05-19 19:21 -------- d-----w- d:\documents and settings\Basque Philippe\Application Data\dota_allstars
2009-05-17 16:17 . 2009-05-17 16:17 -------- d-----w- d:\program files\Fichiers communs\Adobe AIR

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-13 10:33 . 2008-10-25 08:34 -------- d-----w- d:\program files\Wanadoo
2009-06-11 05:22 . 2008-10-24 20:57 -------- d--h--w- d:\program files\InstallShield Installation Information
2009-06-07 21:10 . 2009-02-27 14:13 410984 ----a-w- d:\windows\system32\deploytk.dll
2009-06-07 20:14 . 2009-03-06 18:34 -------- d-----w- d:\program files\ma-config.com
2009-06-07 20:14 . 2009-03-06 18:34 -------- d-----w- d:\documents and settings\All Users\Application Data\ma-config.com
2009-06-01 20:21 . 2009-01-11 13:52 -------- d-----w- d:\documents and settings\Basque Philippe\Application Data\Hamachi
2009-05-19 18:11 . 2008-10-25 08:06 -------- d-----w- d:\program files\Analog Devices
2009-05-11 19:58 . 2009-05-11 19:52 -------- d-----w- d:\program files\new directX
2009-05-11 17:18 . 2009-05-11 17:18 -------- d-----w- d:\program files\SAGEM
2009-05-08 19:59 . 2004-08-05 12:00 76772 ----a-w- d:\windows\system32\perfc00C.dat
2009-05-08 19:59 . 2004-08-05 12:00 472042 ----a-w- d:\windows\system32\perfh00C.dat
2009-05-07 20:20 . 2008-10-24 20:58 -------- d-----w- d:\program files\ATI Technologies
2009-05-07 20:10 . 2009-05-07 20:10 -------- d-----w- d:\documents and settings\Basque Philippe\Application Data\ATI
2009-05-07 15:33 . 2004-08-05 12:00 348672 ----a-w- d:\windows\system32\localspl.dll
2009-05-03 17:49 . 2009-04-16 17:09 -------- d-----w- d:\program files\D-Tools
2009-04-29 04:34 . 2004-08-05 12:00 670720 ----a-w- d:\windows\system32\wininet.dll
2009-04-29 04:34 . 2004-08-05 12:00 81920 ----a-w- d:\windows\system32\ieencode.dll
2009-04-22 13:07 . 2009-04-22 13:06 664 ----a-w- d:\windows\system32\d3d9caps.dat
2009-04-22 13:06 . 2009-04-18 21:10 1100 ----a-w- d:\windows\system32\d3d8caps.dat
2009-04-19 19:50 . 2004-08-05 12:00 1847296 ----a-w- d:\windows\system32\win32k.sys
2009-04-17 21:03 . 2009-03-18 17:45 -------- d-----w- d:\program files\EA GAMES
2009-04-15 14:53 . 2004-08-05 12:00 585216 ----a-w- d:\windows\system32\rpcrt4.dll
2009-03-31 19:31 . 2009-01-11 13:52 25280 ----a-w- d:\windows\system32\drivers\hamachi.sys
2009-03-31 17:47 . 2009-03-31 17:47 138 ----a-w- d:\documents and settings\Basque Philippe\Local Settings\Application Data\fusioncache.dat
2009-03-16 12:18 . 2009-05-11 19:40 69448 ----a-w- d:\windows\system32\XAPOFX1_3.dll
2009-03-16 12:18 . 2009-05-11 19:40 517448 ----a-w- d:\windows\system32\XAudio2_4.dll
2009-03-16 12:18 . 2009-05-11 19:40 235352 ----a-w- d:\windows\system32\xactengine3_4.dll
2009-03-16 12:18 . 2009-05-11 19:40 22360 ----a-w- d:\windows\system32\X3DAudio1_6.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RaidTool"="d:\program files\VIA\RAID\raid_tool.exe" [2005-04-26 589824]
"SoundMAXPnP"="d:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-04-01 1368064]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\D:^Documents and Settings^Basque Philippe^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]
path=d:\documents and settings\Basque Philippe\Menu Démarrer\Programmes\Démarrage\hamachi.lnk
backup=d:\windows\pss\hamachi.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 Lbd;Lbd;d:\windows\system32\drivers\Lbd.sys [06/03/2009 18:56 64160]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 921936]
S3 maconfservice;Ma-Config Service;d:\program files\ma-config.com\maconfservice.exe [29/05/2009 17:13 234864]
.
Contenu du dossier 'Tâches planifiées'

2009-06-08 d:\windows\Tasks\Ad-Aware Update (Weekly).job
- d:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 21:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - (no file)


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2095689
mStart Page = about:blank
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-13 20:29
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1275210071-842925246-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:0f,95,47,73,e0,3b,2a,9f,41,4c,25,5d,55,5c,d4,02,28,0e,6f,69,bc,bb,21,
f7,a5,00,39,7b,23,18,00,0a,77,0c,56,68,da,a5,c5,dd,fe,20,f9,75,d6,c6,94,5b,\
"??"=hex:92,f8,03,9f,44,d6,cf,43,7d,fe,1c,50,bf,3c,94,92

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"C040C10900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
"C040110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(700)
d:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(364)
d:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\ati2evxx.exe
d:\windows\system32\ati2evxx.exe
d:\windows\system32\CF14515.exe
d:\windows\system32\FTRTSVC.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\HPZipm12.exe
d:\windows\system32\PnkBstrA.exe
d:\windows\system32\PnkBstrB.exe
d:\program files\Analog Devices\SoundMAX\SMAgent.exe
d:\windows\system32\wbem\unsecapp.exe
d:\windows\system32\wbem\wmiapsrv.exe
d:\program files\Lavasoft\Ad-Aware\AAWTray.exe
d:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2009-06-13 20:31 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-13 18:31

Avant-CF: 150 369 525 760 octets libres
Après-CF: 150 300 221 440 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

Current=9 Default=9 Failed=8 LastKnownGood=10 Sets=4,5,6,7,8,9,10
166 --- E O F --- 2009-06-10 20:17

ok ;)