[!] Pubs intempestives sous Vista S.V.P. !

Bonjour,

télécharge GenProc http://www.genproc.com/GenProc.exe

double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre

J'ai le message d'erreur "C:/Windows/system32/cscript.exe n'est pas une application Win32 valide."
Qu'est-ce que je fais ?

Merci encore :)

lance le en mode sans echec

Toujours le même message d'erreur.

[*] Télécharge combofix (sUBs) http://download.bleepingcomputer.com/sUBs/ComboFix.exe sur ton Bureau
[*] Double clique combofix.exe et suis les instructions.
[*] Installe la console de récupération si proposé et continue.
[*] Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Décidément !!!

"C:/XXXXXXXXXXXXXXX/XXXXXXXXX.cfxxe n'est pas une application Win32 valide."
Le message se répète 3 à 4 fois et il est marqué dans le terminal bleu "Accès refusé"

Merci de tes réponses aussi rapides !

en mode sans echec?

Pareil...

[*] Rends-toi à cette adresse afin de télécharger FindyKill (créé par Chiquitine29) :

[*] https://www.androidworld.fr/

[*] Clique sur [b]TÉLÉCHARGER/b et enregistre-le sur ton bureau.

[*] [url=http://pagesperso-orange.fr/NosTools/tuto_fyk2.html][u]­tutoriel recherche/u/url

[*] [b]/!\ Ne fais pas le nettoyage tout dessuite /!\/b

[*] Double clic sur le raccourci FindyKill sur ton bureau, l'installation se fera automatiquement

[*] Au menu principal,choisi l option 1 (Recherche)

[*] Post le rapport FindyKill.txt
/list
* Note : le rapport FindyKill.txt est sauvegardé a la racine du disque

Voilà,

(Le message d'erreur a encore eu lieu, mais j'ai laissé faire.)

############################## | FindyKill V5.014 |

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\STacSV.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\R\Program Files\DNA\btdna.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\system32\wbem\wmiprvse.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe
C:\Windows\system32\conime.exe

################## | C: |

################## | C:\Windows |

################## | C:\Windows\system32 |

################## | C:\Windows\system32\drivers |

################## | C:\Users\R\AppData\Roaming |

################## | Temporary Internet Files |

################## | Registre / Clés infectieuses |

Présent ! [HKLM\software\microsoft\security center\Svc] "AntiVirusOverride"
Présent ! [HKLM\software\microsoft\security center\Svc] "FirewallOverride"

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# Uac : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 3 ( Good = 2 | Bad = 4 )
# windefend -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | Cracks / Keygens / Serials |

################## | ! Fin du rapport # FindyKill V5.014 ! |

Bonjour,

Pouvez vous m'eclairer par la suite ? :)

Merci !

S'il vous plait ?

relance combofix et laisse faire

ComboFix 09-11-09.02 - R 11/11/2009 12:46.1.2 - NTFSx86
Lancé depuis: c:\users\R\Desktop\ComboFix.exe
.
[i] ADS - Windows: deleted 24 bytes in 1 streams. /i

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2746947571-3893594193-687437354-500
c:\$recycle.bin\S-1-5-21-3395499582-3656299844-1299793059-500
c:\program files\Internet Saving Optimizer
c:\program files\Internet Saving Optimizer\3.7.0.4550\adwpx.exe
c:\program files\Internet Saving Optimizer\3.7.0.4550\Data\config.md
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome.manifest
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome\content\NPAddOn.js
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome\content\NPAddOn.xul
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome\NPAddOn.jar
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\components\NPFFAddOn.dll
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\components\NPFFAddOn.xpt
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\components\NPFFHelperComponent.js
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\install.rdf
c:\program files\Internet Saving Optimizer\3.7.0.4550\NPCommon.dll
c:\program files\Internet Saving Optimizer\3.7.0.4550\NPIEAddOn.dll
c:\program files\Internet Saving Optimizer\3.7.0.4550\unins000.dat
c:\program files\Internet Saving Optimizer\3.7.0.4550\unins000.exe
c:\program files\Media Access Startup
c:\program files\Media Access Startup\1.5.6.910\Data\config.md
c:\program files\Media Access Startup\1.5.6.910\FF\chrome.manifest
c:\program files\Media Access Startup\1.5.6.910\FF\chrome\content\HPAddOn.js
c:\program files\Media Access Startup\1.5.6.910\FF\chrome\content\HPAddOn.xul
c:\program files\Media Access Startup\1.5.6.910\FF\chrome\HPAddOn.jar
c:\program files\Media Access Startup\1.5.6.910\FF\components\HPFFAddOn.dll
c:\program files\Media Access Startup\1.5.6.910\FF\components\HPFFAddOn.xpt
c:\program files\Media Access Startup\1.5.6.910\FF\components\HPFFHelperComponent.js
c:\program files\Media Access Startup\1.5.6.910\FF\install.rdf
c:\program files\Media Access Startup\1.5.6.910\HPCommon.dll
c:\program files\Media Access Startup\1.5.6.910\hppx.exe
c:\program files\Media Access Startup\1.5.6.910\MAHelper.exe
c:\program files\Media Access Startup\1.5.6.910\unins000.dat
c:\program files\Media Access Startup\1.5.6.910\unins000.exe
c:\users\R\AppData\Roaming\Desktopicon
c:\users\R\AppData\Roaming\Desktopicon\eBayShortcuts.exe
c:\windows\msnimport.exe
c:\windows\system32\jdns_sd.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-11 au 2009-11-11 ))))))))))))))))))))))))))))))))))))
.

2009-11-11 11:56 . 2009-11-11 11:57 -------- d-----w- c:\users\R\AppData\Local\temp
2009-11-11 11:56 . 2009-11-11 11:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-11-02 19:42 . 2009-11-02 19:42 -------- d-----w- c:\program files\iPod
2009-11-02 19:42 . 2009-11-02 19:42 4096 d-----w- c:\program files\iTunes
2009-11-02 19:33 . 2009-11-02 19:33 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-30 09:18 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-30 09:18 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-30 09:18 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-30 09:18 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-30 09:18 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-30 09:18 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-30 09:18 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-30 09:18 . 2009-08-06 18:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-30 09:18 . 2009-08-06 17:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-27 18:21 . 2009-09-10 15:21 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-27 18:21 . 2009-09-10 15:21 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-21 16:44 . 2009-10-21 16:53 -------- d-----w- C:\FindyKill
2009-10-20 22:00 . 2009-10-20 22:00 -------- d-----w- C:\cf04e6701d4c61663b9f62d46116f08f
2009-10-20 21:38 . 2009-10-20 21:38 6736 ----a-w- c:\windows\system32\drivers\PROCEXP90.SYS
2009-10-20 19:40 . 2009-10-20 20:42 4096 d-----w- C:\GenProc
2009-10-19 18:50 . 2009-10-19 18:50 -------- d-----w- c:\program files\CCleaner
2009-10-17 20:12 . 2009-10-17 20:12 653560 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-10-16 17:41 . 2009-09-10 17:30 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-16 17:41 . 2009-08-05 14:22 3597896 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-16 17:41 . 2009-08-05 14:22 3546184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-16 17:41 . 2009-08-31 13:55 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-10-16 17:41 . 2009-08-31 13:55 428544 ----a-w- c:\windows\system32\EncDec.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-11 11:51 . 2009-02-15 17:06 4096 d-----w- c:\users\R\AppData\Roaming\DNA
2009-11-11 11:25 . 2008-08-11 21:38 669566 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-11 11:25 . 2008-08-11 21:38 123556 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-11 11:20 . 2009-05-27 17:26 27459 ----a-w- c:\programdata\nvModes.dat
2009-11-11 00:02 . 2008-08-11 11:52 2372 ----a-w- c:\windows\bthservsdp.dat
2009-11-10 21:26 . 2008-08-05 20:09 4096 d-----w- c:\program files\Messenger Plus! Live
2009-11-07 18:54 . 2008-08-05 21:01 8192 d-----w- c:\users\R\AppData\Roaming\LimeWire
2009-11-02 19:42 . 2008-08-05 21:38 -------- d-----w- c:\program files\Common Files\Apple
2009-11-02 19:42 . 2009-10-02 15:59 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-11-02 19:17 . 2009-08-11 17:43 8192 d-----w- c:\program files\Safari
2009-10-31 09:11 . 2008-08-12 16:48 4096 d-----w- c:\users\R\AppData\Roaming\Skype
2009-10-31 09:11 . 2008-08-12 16:49 4096 d-----w- c:\users\R\AppData\Roaming\skypePM
2009-10-17 16:07 . 2006-11-02 11:18 4096 d-----w- c:\program files\Windows Mail
2009-09-30 16:22 . 2008-08-13 09:57 7592 ----a-w- c:\users\R\AppData\Local\d3d9caps.dat
2009-09-23 16:42 . 2009-08-28 23:04 -------- d-----w- c:\programdata\Sukoku
2009-09-14 09:44 . 2009-10-16 17:40 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-09-06 13:02 . 2009-09-06 13:02 3584 ----a-r- c:\users\R\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-09-04 12:24 . 2009-10-16 17:40 61440 ----a-w- c:\windows\system32\msasn1.dll
2009-09-02 08:23 . 2008-08-11 12:20 75304 ----a-w- c:\users\R\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-28 17:42 . 2009-08-28 17:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-28 17:42 . 2009-08-28 17:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-28 12:39 . 2009-09-02 22:31 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-02 22:31 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-27 05:22 . 2009-10-16 17:40 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 05:17 . 2009-10-16 17:40 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-08-27 05:17 . 2009-10-16 17:40 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-08-27 03:42 . 2009-10-16 17:40 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-08-21 09:37 . 2009-08-28 23:03 3020324 -c----w- c:\programdata\{FB94CE54-2703-4BFF-8E94-A0AD14C0FA22}\Setup.exe
2009-08-20 17:25 . 2009-08-20 17:25 1961720 ----a-w- c:\users\R\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-08-18 22:47 . 2009-05-30 16:37 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-14 17:07 . 2009-09-09 21:29 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-09 21:29 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-09 21:29 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-09 21:29 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 21:29 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 21:29 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 21:29 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 21:29 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-09 21:29 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-09 21:29 10240 ----a-w- c:\windows\system32\finger.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-12-17 17:54 . 2008-07-31 20:14 74 --sh--r- c:\windows\CT4CET.bin
2006-05-03 09:06 . 2009-08-15 23:52 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-08-15 23:52 31232 --sh--r- c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-08-15 23:52 216064 --sh--r- c:\windows\System32\nbDX.dll
2008-08-01 05:45 . 2008-08-01 05:45 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"BitTorrent DNA"="c:\users\R\Program Files\DNA\btdna.exe" [2009-10-03 323392]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-24 159744]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2008-01-02 405504]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-12-03 36864]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-09 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-09 92704]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2008-06-09 96800]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-08 198160]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-07-31 20:23 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^R^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BitTorrent Acceleration Patch.lnk]
path=c:\users\R\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitTorrent Acceleration Patch.lnk
backup=c:\windows\pss\BitTorrent Acceleration Patch.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^R^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PdaNet Desktop.lnk]
path=c:\users\R\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk
backup=c:\windows\pss\PdaNet Desktop.lnk.Startup
backupExtension=.Startup

S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2008-01-02 73728]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-07-14 108289]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - mfehidk
*Deregistered* - MPFP
*Deregistered* - PROCEXP113

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyServer = proxy.free.fr:3128
uInternet Settings,ProxyOverride = *.local
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\users\R\AppData\Roaming\Mozilla\Firefox\Profiles\3qv5x2n1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|facebook.com
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\users\R\Program Files\DNA\plugins\npbtdna.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-Microsoft_Manager - c:\windows\Explorer_.exe
AddRemove-Avidemux 2.4 - c:\program files\Avidemux 2.4\uninstall.exe
AddRemove-Sukoku - c:\program files\Sukoku\uninstall.exe
AddRemove-{16B6279B-9FF5-41fb-8BF9-404324F5DD1F}}_is1 - c:\program files\Media Access Startup\1.5.6.910\unins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-11 12:56
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iastor.sys spmz.sys hal.dll >>UNKNOWN [0x85887938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x858d11f8
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-11-11 13:00
ComboFix-quarantined-files.txt 2009-11-11 12:00

Avant-CF: 74 086 572 032 octets libres
Après-CF: 80 162 566 144 octets libres

- - End Of File - - 23223148C18B771AD175403A7A0F36FE

tu n'as plus ces pubs

il faut bloquer le sfenetre pop up va dan ta barre outils et bloquer ls fenetre voila

Effectivement, je ne les ai plus :).
Merci beaucoup Narco!4 !

Salut,
Au cas où tu n'aurais pas vu Narco:

detected MBR rootkit hooks:
\Driver\atapi -> 0x858d11f8
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection ! 

+++ ;)

Je fais quoi alors ?

lance genproc