Confirmation d une desinfection virus

donc si je comprend, tu a essayer un M.A.O piraté
télécharge GenProc http://www.genproc.com/GenProc.exe

double-clique sur GenProc.exe et poste le contenu du rapport
ne fait pas ce qui est indiqué dedans pour le moment

BONJOUR
explique nous exactement , quel infection ? des reponses / ventilo cpu se lancant ?
et poste nous ce rapport...
télécharge hijackthis http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
>> enregistre la cible sous .... "le bureau" renomme HJTInstall.exe en par exemple HJT.exe

>> Fais un double-clic sur "HJT.exe" afin de lancer l'installation

>> Clique sur Install ensuite sur "I Accept"

>> Clique sur" Do a scan system and save log file"

>> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse

http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm

bonjour la source etait que je n arrivai pas a ouvrir un logiciel de m.a.o je cliquais et hop de suite sur un ecran bleu et redemarrage ,j ai tout viré mais suppression est elle egal a desinfection .....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:45:57, on 07/10/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/webhp?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

eh oui c est du piratage je suis desolé se sont des logiciels bcp trop cher pour moi .... ah l argent
voila le rapport

Rapport GenProc 2.634 [2] - 07/10/2009 à 10:15:48
@ Windows Vista Service Pack 2 - Mode normal
@ Mozilla Firefox (3.5b4) [Navigateur par défaut]

# Etape 1/ Télécharge :

- ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe (sUBs) sur ton Bureau.

Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ ; Choisis ta session courante *** VISTA *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[2]" sur ton bureau).

# Etape 2/

Double clique sur combofix.exe et suis les instructions. Attention de ne pas utiliser ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne au risque de figer l'ordinateur.

# Etape 3/

Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 4/

Redémarre normalement et poste, dans la même réponse :

- Le contenu du rapport Combofix.txt situé dans C:\ ;
- Un nouveau rapport HijackThis ;
- Un nouveau rapport GenProc ;

Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~

# Détections [1] GenProc 2.634 07/10/2009 à 10:08:59
TDSS:le 07/10/2009 à 10:09:47 "C:\Windows\System32\gxvxc*.???"

# Détections [2] GenProc 2.634 07/10/2009 à 10:15:54
TDSS:le 07/10/2009 à 10:16:36 "C:\Windows\System32\gxvxc*.???"

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 10:16:56 ~~

Télécharge combofix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
clique combofix.exe.
touche 1 (Yes) pour démarrer le scan.
une fois fini un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
Le rapport se trouve également ici : C:\Combofix.txt

Déconnecte toi d'internet ferme les fenêtres de tous les programmes en cours.et provisoirement
arrete les anti virus et autres protection pendand l'analyse
Pendant la durée de l'analyse ne te sert pas de ton pc

une fois l'analyse terminé ,remet toute tes protections antivirus et antispywares

voila le rapport combofix :

ComboFix 09-10-06.03 - VISTA 07/10/2009 11:14.1.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3582.2623 [GMT 2:00]
Lancé depuis: c:\users\VISTA\Desktop\ComboFix.exe
SP: AVG Anti-Spyware *disabled* (Outdated) {48F2E28D-ED66-4646-9C11-B3055B0AF604}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\bdcore.dll
c:\windows\Downloaded Program Files\libfn.dll
c:\windows\Installer\b639b.msi
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\gxvxccount
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_gxvxcserv.sys
-------\Service_gxvxcserv.sys

((((((((((((((((((((((((((((( Fichiers créés du 2009-09-07 au 2009-10-07 ))))))))))))))))))))))))))))))))))))
.

2009-10-07 09:22 . 2009-10-07 09:26 -------- d-----w- c:\users\VISTA\AppData\Local\temp
2009-10-07 09:22 . 2009-10-07 09:22 -------- d-----w- c:\users\IUSR_NMPR\AppData\Local\temp
2009-10-07 09:22 . 2009-10-07 09:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-07 09:21 . 2009-10-07 09:21 -------- d-----w- c:\users\tina\AppData\Local\temp
2009-10-07 09:21 . 2009-10-07 09:21 -------- d-----w- c:\users\francois.PC-de-VISTA\AppData\Local\temp
2009-10-07 09:21 . 2009-10-07 09:21 -------- d-----w- c:\users\francois\AppData\Local\temp
2009-10-07 09:21 . 2009-10-07 09:21 -------- d-----w- c:\users\cristina\AppData\Local\temp
2009-10-07 09:21 . 2009-10-07 09:21 -------- d-----w- c:\users\alex\AppData\Local\temp
2009-10-07 07:40 . 2009-10-07 07:40 -------- d-----w- c:\users\VISTA\Tracing
2009-10-07 07:02 . 2009-10-07 07:03 -------- d-----w- c:\users\VISTA\.housecall6.6
2009-10-07 06:52 . 2009-10-07 06:52 -------- d-----w- c:\windows\system32\HouseCall 6.6
2009-10-07 06:49 . 2009-10-07 06:49 -------- d-----w- c:\windows\BDOSCAN8
2009-10-05 13:10 . 2009-10-05 13:10 -------- d-----w- c:\users\francois.PC-de-VISTA\Office Genuine Advantage
2009-10-03 20:59 . 2009-10-03 21:12 -------- d-----w- c:\users\cristina\AppData\Local\Microsoft Games
2009-10-03 20:44 . 2009-10-03 20:44 -------- d-----w- c:\users\cristina\Office Genuine Advantage
2009-10-03 19:05 . 2009-10-03 19:04 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-03 19:04 . 2009-10-03 19:04 -------- d-----w- c:\program files\Java
2009-10-03 06:08 . 2009-10-03 06:08 -------- d-----w- c:\programdata\Office Genuine Advantage
2009-10-03 06:02 . 2009-10-03 06:02 -------- d-----w- c:\program files\Microsoft LifeCam
2009-10-03 06:01 . 2007-07-19 16:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-10-03 04:56 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-03 04:50 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-03 04:50 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-03 04:50 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-03 04:50 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-03 04:49 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-03 04:49 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-03 04:49 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-03 04:49 . 2009-08-06 17:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-03 04:49 . 2009-08-06 16:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-09-09 09:40 . 2009-06-15 14:53 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-09 09:40 . 2009-06-15 14:52 499712 ----a-w- c:\windows\system32\kerberos.dll
2009-09-09 09:40 . 2009-06-15 14:54 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-09-09 09:40 . 2009-06-15 14:53 270848 ----a-w- c:\windows\system32\schannel.dll
2009-09-09 09:40 . 2009-06-15 23:15 439864 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-09-09 09:40 . 2009-06-15 14:52 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2009-09-09 09:40 . 2009-06-15 14:53 72704 ----a-w- c:\windows\system32\secur32.dll
2009-09-09 09:40 . 2009-06-15 12:48 9728 ----a-w- c:\windows\system32\lsass.exe
2009-09-09 09:33 . 2009-09-09 09:33 -------- d-----w- c:\users\VISTA\AppData\Roaming\WinBatch
2009-09-09 09:32 . 2009-09-09 09:32 -------- d-----w- c:\program files\HP
2009-09-09 09:31 . 2009-09-09 09:33 -------- d-----w- c:\users\VISTA\AppData\Roaming\HpUpdate
2009-09-09 09:30 . 2009-09-09 09:30 -------- d-----w- c:\windows\Hewlett-Packard
2009-09-09 05:18 . 2009-08-14 16:27 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-09-09 05:18 . 2009-08-14 13:48 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-09-09 05:18 . 2009-08-14 13:49 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-09-09 05:18 . 2009-08-14 13:49 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-09-09 05:18 . 2009-08-14 13:49 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-09-09 05:18 . 2009-08-14 13:49 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-09-09 05:18 . 2009-08-14 13:49 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-09-09 05:18 . 2009-08-14 13:49 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-09-09 05:18 . 2009-08-14 13:49 10240 ----a-w- c:\windows\system32\finger.exe
2009-09-09 05:18 . 2009-08-14 13:48 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-09-09 05:18 . 2009-08-14 15:53 17920 ----a-w- c:\windows\system32\netevent.dll
2009-09-09 05:17 . 2009-07-11 19:01 513536 ----a-w- c:\windows\system32\wlansvc.dll
2009-09-09 05:17 . 2009-07-11 19:01 302592 ----a-w- c:\windows\system32\wlansec.dll
2009-09-09 05:17 . 2009-07-11 19:01 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2009-09-09 05:17 . 2009-07-11 19:01 65024 ----a-w- c:\windows\system32\wlanapi.dll
2009-09-09 05:17 . 2009-07-11 17:03 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2009-09-09 05:17 . 2009-06-10 11:41 2868224 ----a-w- c:\windows\system32\mf.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-07 09:27 . 2009-02-25 23:37 -------- d-----w- c:\programdata\Kaspersky Lab
2009-10-07 09:24 . 2009-02-25 23:37 7823904 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-10-07 09:24 . 2009-02-25 23:37 6580 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-10-07 09:24 . 2009-02-25 23:37 63252 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-10-07 09:24 . 2009-02-25 23:37 1302560 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-10-07 07:42 . 2006-12-06 21:56 672084 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-07 07:42 . 2006-12-06 21:56 124228 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-05 20:39 . 2009-06-11 05:31 1356 ----a-w- c:\users\VISTA\AppData\Local\d3d9caps.dat
2009-10-03 07:01 . 2009-07-12 09:03 -------- d-----w- c:\users\VISTA\AppData\Roaming\BitTorrent
2009-10-03 06:03 . 2006-12-06 13:14 -------- d-----w- c:\program files\Realtek
2009-09-28 21:22 . 2009-03-05 13:02 -------- d-----w- c:\users\francois.PC-de-VISTA\AppData\Roaming\BitTorrent
2009-09-23 16:27 . 2009-02-26 12:10 -------- d-----w- c:\programdata\Roxio
2009-09-22 13:50 . 2009-02-25 23:37 107547 ----a-w- c:\windows\system32\drivers\klin.dat
2009-09-22 13:50 . 2009-02-25 23:37 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-09-20 11:52 . 2009-09-20 11:52 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-09-09 09:50 . 2009-05-10 10:33 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-09 09:42 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-29 00:27 . 2009-09-03 05:05 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-03 05:05 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-26 13:18 . 2009-08-26 13:18 -------- d-----w- c:\users\francois.PC-de-VISTA\AppData\Roaming\Malwarebytes
2009-08-09 09:20 . 2009-06-04 11:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-04 07:48 . 2009-08-04 07:48 2744800 ----a-w- c:\windows\system32\drivers\RTKVHDA.sys
2009-08-04 07:17 . 2009-08-04 07:17 1265696 ----a-w- c:\windows\system32\RtkPgExt.dll
2009-08-04 07:17 . 2009-08-04 07:17 52256 ----a-w- c:\windows\system32\RtkCoInst.dll
2009-08-04 07:17 . 2009-08-04 07:17 326176 ----a-w- c:\windows\system32\RtkApoApi.dll
2009-08-04 07:17 . 2006-12-06 13:15 2898464 ----a-w- c:\windows\system32\RtkAPO.dll
2009-08-03 13:07 . 2009-08-03 13:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-08-03 13:07 . 2009-08-03 13:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll
2009-08-03 13:07 . 2009-08-03 13:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
2009-08-03 11:36 . 2009-06-04 11:26 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 11:36 . 2009-06-04 11:26 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-21 21:52 . 2009-07-29 04:44 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 04:44 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 04:44 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 04:44 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-21 12:01 . 2009-07-21 12:01 266240 ----a-w- c:\windows\system32\FMAPO.dll
2009-07-17 13:54 . 2009-08-12 17:12 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-15 12:40 . 2009-08-12 17:12 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-07-15 12:39 . 2009-08-12 17:12 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-15 12:39 . 2009-08-12 17:12 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-15 12:39 . 2009-08-12 17:12 7680 ----a-w- c:\windows\system32\spwmp.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-16 221184]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-07-21 208616]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-03 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi2"=xgusb.cpl

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):b0,29,97,35,11,e8,c9,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{476CB903-C18C-4B59-AF0D-2A8D5758B342}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{49F56069-E6A2-414E-AB90-6DC1F8057A3D}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{39E4179A-A3B1-4BBB-924C-06D296DA5D16}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{AE1F472A-81F8-41AE-9929-EA8AE3A17607}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{E230A820-65E3-429D-8EFE-EED0CAC2A01E}"= UDP:c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{CA7AAC92-AB5D-4F04-B648-39EB36A62150}"= TCP:c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{85AC98B0-DBA3-45AC-B301-F6F72B3A5B07}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{81D2422E-034E-4D88-8194-3C10B46E2E42}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"TCP Query User{9F7B858E-D56C-407B-920B-35881E9FAE10}e:\\setup.exe"= UDP:E:\setup.exe:Programme d'installation de Kaspersky Internet Security 2009
"UDP Query User{1B142040-4162-4EF0-B79F-FCA3038EAEA8}e:\\setup.exe"= TCP:E:\setup.exe:Programme d'installation de Kaspersky Internet Security 2009
"{32179FD4-D057-4D94-9D9F-8186CFADD352}"= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{07275166-448D-4701-ABFB-ADD653AC98A4}"= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{25094E35-419E-492C-AC02-314A252F5825}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{11CA85AE-6299-458E-8812-C873A8648F33}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"{A9577844-8FCB-4A02-9032-5D3E1C6AE003}"= Disabled:UDP:c:\users\VISTA\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{B3421D05-0D70-44BE-9E82-C1C55C136905}"= Disabled:TCP:c:\users\VISTA\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"TCP Query User{63947157-83CE-41E8-A584-157B9652F88C}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule Plus
"UDP Query User{A42AD4EF-75AF-45E2-A9DE-6F36E535E557}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule Plus
"{CC92C394-682F-4D23-828B-E2EEC7EF9821}"= UDP:c:\program files\SUPERAntiSpyware\RUNSAS.EXE:SUPERAntiSpyware Alternate Start
"{4773A00D-A145-46FA-A238-C72697EA518D}"= TCP:c:\program files\SUPERAntiSpyware\RUNSAS.EXE:SUPERAntiSpyware Alternate Start
"{572D2705-2A06-4435-A421-4B9DB3778869}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"TCP Query User{672F1E03-50B6-4F95-8AC9-64DC75BB9BF3}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{80A36B95-E5F2-40A6-A1A1-F1A267B9BF40}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{7C4D87A3-058E-401D-9B61-CD9716EE5B51}c:\\users\\vista\\documents\\programm\\bittorrent.exe"= UDP:c:\users\vista\documents\programm\bittorrent.exe:bittorrent.exe
"UDP Query User{AF4A473B-AA7D-41D2-8C3D-89CFCCBD9A9E}c:\\users\\vista\\documents\\programm\\bittorrent.exe"= TCP:c:\users\vista\documents\programm\bittorrent.exe:bittorrent.exe
"{3069C4D1-AA08-40BC-8192-A971B15B3C61}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{782ABCA5-FA79-4031-A10D-60D1120B02C8}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{FDC26632-521F-418C-9FF6-4C20237B6CAC}"= UDP:c:\users\VISTA\Downloads\BitTorrent.exe:BitTorrent (TCP-In)
"{899BCA2E-44A5-480A-9205-338612D5B931}"= TCP:c:\users\VISTA\Downloads\BitTorrent.exe:BitTorrent (UDP-In)
"{5F11BE0B-1CA2-4E68-AB7D-787666E75D5A}"= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{575B547F-AC6F-4346-90D1-B62B76CA5DF6}"= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{A9210A0D-A3C0-4BBB-AEDE-90E669BEB3B2}"= UDP:c:\program files\Microsoft LifeCam\LifeEnC2.exe:LifeEnC2.exe
"{0BD3E1BA-DB5B-421E-9D32-067D71442001}"= TCP:c:\program files\Microsoft LifeCam\LifeEnC2.exe:LifeEnC2.exe
"{71364EBD-710F-4382-A223-77F46D274B26}"= UDP:c:\program files\Microsoft LifeCam\LifeTray.exe:LifeTray.exe
"{F837406C-DF68-41FF-A4BC-7A3AB2446ED6}"= TCP:c:\program files\Microsoft LifeCam\LifeTray.exe:LifeTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [29/01/2008 18:29 33808]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [09/07/2008 18:28 20496]
R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [30/03/2009 16:28 1533808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [13/03/2008 19:02 26640]
S2 IntelDHSvcConf;Intel DH Service;c:\program files\Intel\IntelDH\Intel Media Server\tools\IntelDHSvcConf.exe [10/05/2006 10:13 29696]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [10/05/2009 12:32 55280]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 SynasUSB;SynasUSB;c:\windows\System32\drivers\synasUSB.sys [07/07/2009 21:36 18432]
S4 DQLWinService;DQLWinService;c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [03/09/2006 11:32 208896]
S4 TeamViewer4;TeamViewer 4;"c:\program files\TeamViewer\Version4\TeamViewer_Service.exe" -service --> c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [?]
.
Contenu du dossier 'Tâches planifiées'

2009-10-07 c:\windows\Tasks\User_Feed_Synchronization-{0872C049-97CD-4312-A193-3FF805BA6BB8}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]

2009-10-07 c:\windows\Tasks\User_Feed_Synchronization-{6BEEB2EE-3ABE-4114-AFB8-4F43FDBFDA8C}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]

2009-10-07 c:\windows\Tasks\User_Feed_Synchronization-{ADAD7DF4-70B3-4EC6-839A-3B52ED013F5F}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/ig
mWindow Title =
IE: Ajouter à Kaspersky Anti-Bannière - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\users\VISTA\AppData\Roaming\Mozilla\Firefox\Profiles\frvzrz31.default\
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
AddRemove-Applied Acoustics Lounge Lizard EP VSTi DXi v3.0 - c:\progra~1\AAS\LOUNGE~1.0\UNWISE.EXE
AddRemove-Arturia Arp2600 V v1.0 - c:\progra~1\Arturia\ARP260~1\UNWISE.EXE
AddRemove-Arturia CS-80V v1.5 - c:\progra~1\Arturia\CS-80V\UNWISE.EXE
AddRemove-ASIO4ALL - c:\program files\ASIO4ALL v2\uninstall.exe
AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe
AddRemove-aumuyom - c:\users\vista\appdata\local\aumuyom.bat
AddRemove-Big_Tick_Angelina_1.3 - c:\windows\iun6002.exe
AddRemove-Collab - c:\program files\Image-Line\Collab\uninstall.exe
AddRemove-Estradion-230 VSTi_is1 - c:\program files\Estradion-230 VSTi\unins000.exe
AddRemove-filehippo.com - c:\program files\filehippo.com\uninstall.exe
AddRemove-Foorius_is1 - c:\program files\Foorius\unins000.exe
AddRemove-Futureaudioworkshop Circle VSTi RTAS_is1 - c:\program files\FAW\Circle\Uninstall\unins000.exe
AddRemove-Image Line PoiZone v1.0 VSTi - c:\progra~1\PoiZone\UNWISE.EXE
AddRemove-Impulse v. 3.10 - c:\program files\VstPlugins\ImpulseUninstal.exe
AddRemove-iZotope Vinyl for DirectX and ProTools_is1 - c:\program files\iZotope\Vinyl\unins000.exe
AddRemove-Korg Legacy Collection v1.1.10 - c:\progra~1\KORGLE~1\UNWISE.EXE
AddRemove-Native Instruments Absynth 4 - c:\progra~1\NATIVE~1\ABSYNT~2\UNWISE.EXE
AddRemove-Native Instruments FM8 v1.0.1.002 - c:\progra~1\NATIVE~1\FM8\UNWISE.EXE
AddRemove-Native Instruments Massive v1.0.1.008 - c:\progra~1\NATIVE~1\Massive\UNWISE.EXE
AddRemove-Native Instruments Service Center - c:\progra~1\NATIVE~1\SERVIC~1\UNWISE.EXE
AddRemove-Native Instruments Vokator - c:\progra~1\NATIVE~1\Vokator\UNWISE.EXE
AddRemove-Nebula3cm - c:\nebulatemprepository\Uninstall3cm.exe
AddRemove-Octopus - c:\program files\VstPlugins\UninstalOctopus.exe
AddRemove-PoiZone - c:\progra~1\PoiZone\uninstall.exe
AddRemove-reFX Nexus Demo_is1 - c:\program files\VstPlugins\Nexus\unins000.exe
AddRemove-reFX quadraSID 1.6.0_is1 - c:\program files\VstPlugins\unins000.exe
AddRemove-reFX Vanguard VSTi_is1 - c:\progra~1\VSTPLU~1\Vanguard\Uninstall\unins000.exe
AddRemove-RgcAudio z3ta Plus DXi VSTi v1.41 - c:\progra~1\rgcaudio\Z3TA_~1\UNWISE.EXE
AddRemove-Rhythm-2 VSTi_is1 - c:\program files\Rhythm-2 VSTi\unins000.exe
AddRemove-Rob Papen Albino 2 - c:\progra~1\VSTPLU~1\ALBINO~1\ALBINO~1\UNWISE.EXE
AddRemove-BitTorrent - c:\users\VISTA\Downloads\BitTorrent.exe

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\System32\WUDFHost.exe
c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
c:\windows\System32\wbem\WMIADAP.exe
c:\program files\Hewlett-Packard\SDP\RemEngine.exe
.
**************************************************************************
.
Heure de fin: 2009-10-07 11:32 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-10-07 09:32

Avant-CF: 57 951 260 672 octets libres
Après-CF: 58 776 236 032 octets libres

315 --- E O F --- 2009-10-06 04:49

télécharge Malwarebyte's ici http://www.malwarebytes.org/mbam/program/mbam-setup.exe
le programme va se mettre automatiquement a jour.
S'il manque le fichier COMCTL32.OCX, vous pourrez le télécharger ici
https://www.malekal.com/tutorial-aboutbuster/
Une fois a jour, le programme va se lancer; click sur l´onglet paramètre, et coche la case : "Arrêter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examen rapide".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des éléments on été trouvés > click sur supprimer la sélection.

si il t´es demandé de redémarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de manière a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.

PS : les rapport sont aussi rangé dans l onglet rapport/log

rapport malware :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2917
Windows 6.0.6002 Service Pack 2

07/10/2009 11:47:52
mbam-log-2009-10-07 (11-47-52).txt

Type de recherche: Examen rapide
Eléments examinés: 130984
Temps écoulé: 4 minute(s), 46 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)