Your computer is infected

Bonjour,

Ton Pc est bien infecté par un rogue ou faux antivirus.

Commence par ceci, stp.

Télécharge Random's System Information Tool (RSIT) de random/random et enregistre le sur ton Bureau.
http://images.malwareremoval.com/random/RSIT.exe

# Double-clique sur " RSIT.exe " pour le lancer .
( Si sous Vista : Click droit sur le fichier et choisir exécuter en tant qu'administrateur )
# dans la fenêtre qui va s’ouvrir choisis 1 month pour l'option "List files/folders created ...".
# clique ensuite sur " Continue " pour lancer l'analyse ...

Si la dernière version de HijackThis n'est pas trouvée sur ton PC, RSIT la téléchargera et te demandera d'accepter la licence.

Attends jusqu’à la fin de l’analyse. deux rapports vont être crées.

# Poste en deux messages le contenu de " log.txt ", et de " info.txt " ( dans la barre des tâches).

Note : Si tu ne les trouves pas,les rapports sont sauvegardés dans le dossier C:\rsit.

A+

Merci de me repondre aussi rapidement
Voila c'est fait : Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-11-03 12:36:03
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 34 GB (90%) free of 38 GB
Total RAM: 511 MB (54% free)

======Scheduled tasks folder======

C:\WINDOWS\tasks\Norton Security Scan.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"=C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe []
"brastk"=C:\WINDOWS\brastk.exe [2009-11-03 9728]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WinExpose"=C:\Program Files\WinExpose\WinExpose.exe [2007-06-17 539648]
"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"SVCHOST.EXE"=C:\WINDOWS\system32\drivers\svchost.exe []

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Wireless Configuration Utility HW.32.lnk - C:\WINDOWS\Installer\{BDC88E5A-F47B-4314-AB38-994592E32C95}\NewShortcut1.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-05-19 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoSMBalloonTip"=1
"NoSMConfigurePrograms"=1
"MemCheckBoxInRunDlg"=1
"NoDesktopCleanupWizard"=1
"NoWelcomeScreen"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\WINDOWS\system32\drivers\svchost.exe"="C:\WINDOWS\system32\drivers\svchost.exe:*:Disabled:svchost"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

======List of files/folders created in the last 3 months======

2009-11-03 12:36:04 ----D---- C:\Program Files\trend micro
2009-11-03 12:36:03 ----D---- C:\rsit
2009-11-03 12:32:09 ----A---- C:\mmm.txt
2009-11-03 12:25:43 ----A---- C:\WINDOWS\ntbtlog.txt
2009-11-03 12:08:53 ----D---- C:\Program Files\Sunbelt Software
2009-11-03 12:08:44 ----A---- C:\WINDOWS\system32\wini10891.exe
2009-11-03 12:04:46 ----A---- C:\WINDOWS\system32\tmp.txt
2009-11-03 12:04:42 ----A---- C:\rapport.txt
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\WS2Fix.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\VCCLSID.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\VACFix.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\swxcacls.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\swsc.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\swreg.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\SrchSTS.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\Process.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\o4Patch.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\IEDFix.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\IEDFix.C.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\dumphive.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\Agent.OMZ.Fix.exe
2009-11-03 12:04:08 ----A---- C:\WINDOWS\system32\404Fix.exe

======List of files/folders modified in the last 3 months======

2009-11-03 12:36:04 ----RD---- C:\Program Files
2009-11-03 12:33:08 ----D---- C:\WINDOWS\system32
2009-11-03 12:31:56 ----D---- C:\WINDOWS\system32\CatRoot2
2009-11-03 12:27:07 ----D---- C:\WINDOWS\system32\drivers
2009-11-03 12:27:05 ----D---- C:\WINDOWS
2009-11-03 12:25:33 ----A---- C:\WINDOWS\brastk.exe
2009-11-03 12:20:34 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-11-03 12:09:48 ----D---- C:\Program Files\Norton Security Scan
2009-11-03 12:09:08 ----SHD---- C:\WINDOWS\Installer
2009-11-03 12:09:00 ----HD---- C:\WINDOWS\inf

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdPPM;Pilote de processeur AMD HwPState; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
R1 SbFw;SbFw; C:\WINDOWS\system32\drivers\SbFw.sys [2008-10-31 270888]
R1 sbhips;Sunbelt HIPS Driver; C:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B}; \??\C:\Program Files\CyberLink\PowerDVD\000.fcl []
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-04-14 12288]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-04-13 1897408]
R3 nvax;Service for NVIDIA(R) nForce(TM) Audio Enumerator; C:\WINDOWS\system32\drivers\nvax.sys [2006-02-26 53376]
R3 NVENET;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENET.sys [2004-01-29 94274]
R3 nvmpu401;Service for NVIDIA(R) nForce(TM) MIDI UART; C:\WINDOWS\system32\drivers\nvmpu401.sys [2006-02-26 10240]
R3 nvnforce;Service for NVIDIA(R) nForce(TM) Audio; C:\WINDOWS\system32\drivers\nvapu.sys [2006-02-26 414464]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport; C:\WINDOWS\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
S3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver; C:\WINDOWS\system32\DRIVERS\sis163u.sys [2004-12-31 167424]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-05-19 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-05-19 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Pilote de filtre de restauration système; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73600]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 SbPF.Launcher;SbPF.Launcher; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528]
R2 SiSWLSvc;SiS WirelessLan Service; C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe [2004-12-31 45056]
R2 SPF4;Sunbelt Personal Firewall 4; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------

l'autre: info.txt logfile of random's system information tool 1.06 2009-11-03 12:36:09

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{BDC88E5A-F47B-4314-AB38-994592E32C95}
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Complément Microsoft Enregistrer en tant que PDF ou XPS pour programmes Microsoft Office 2007-->MsiExec.exe /X{90120000-00B2-040C-0000-0000000FF1CE}
CPU-Z 1.45-->rundll32.exe advpack.dll,LaunchINFSection Cpu.inf,UnInstall
Java(TM) 6 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{CC1DB186-550F-3CFE-A2A9-EBA5E5A34BC1}
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mozilla Firefox (2.0.0.17)-->C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
Nero 8 Lite 8.3.2.1-->"C:\Program Files\Nero\unins000.exe"
Norton Security Scan-->MsiExec.exe /I{1A8A214F-6BAC-4E01-A27D-25C19A484908}
NVIDIA Drivers-->C:\WINDOWS\system32\NVUNINST.EXE UninstallGUI
PowerDVD Ultra-->"C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -l0x00040c /z-uninstall
QT Lite 2.6.0-->"C:\Program Files\QT Lite\unins000.exe"
Real Alternative 1.8.0 Lite-->"C:\Program Files\Real Alternative\unins000.exe"
Sunbelt Personal Firewall-->MsiExec.exe /X{82B1150E-9B37-49FC-83EB-D52197D900D0}
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}

======Security center information======

FW: Sunbelt Personal Firewall

======System event log======

Computer Name: XPLOSION
Event Code: 3260
Message: Cet ordinateur a correctement été joint au workgroup 'WORKGROUP'.

Record Number: 5
Source Name: Workstation
Time Written: 20011231215706.000000+060
Event Type: Informations
User:

Computer Name: XPLOSION
Event Code: 6011
Message: Le nom NetBIOS et le nom de l'hôte DNS de cet ordinateur ont été modifiés de MACHINENAME vers XPLOSION.

Record Number: 4
Source Name: EventLog
Time Written: 20011231215603.000000+060
Event Type: Informations
User:

Computer Name: MACHINENAME
Event Code: 2
Message: Pendant la validation de \Device\Serial0 en tant que port série, une FIFO a été détectée. La FIFO sera utilisée.

Record Number: 3
Source Name: Serial
Time Written: 20011231224404.000000+060
Event Type: Informations
User:

Computer Name: MACHINENAME
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20011231224354.000000+060
Event Type: Informations
User:

Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Uniprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20011231224354.000000+060
Event Type: Informations
User:

=====Application event log=====

Computer Name: XPLOSION
Event Code: 1000
Message: Les compteurs de performances pour le service MSDTC (MSDTC) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 5
Source Name: LoadPerf
Time Written: 20011231215920.000000+060
Event Type: Informations
User:

Computer Name: XPLOSION
Event Code: 1000
Message: Les compteurs de performances pour le service TermService (Services Terminal Server) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 4
Source Name: LoadPerf
Time Written: 20011231215913.000000+060
Event Type: Informations
User:

Computer Name: XPLOSION
Event Code: 1000
Message: Les compteurs de performances pour le service RemoteAccess (Routage et accès distant) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 3
Source Name: LoadPerf
Time Written: 20011231215701.000000+060
Event Type: Informations
User:

Computer Name: XPLOSION
Event Code: 1000
Message: Les compteurs de performances pour le service PSched (PSched) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 2
Source Name: LoadPerf
Time Written: 20011231215633.000000+060
Event Type: Informations
User:

Computer Name: XPLOSION
Event Code: 1000
Message: Les compteurs de performances pour le service RSVP (QoS RSVP) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 1
Source Name: LoadPerf
Time Written: 20011231215615.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 6 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=0602
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Il manque une partie du rapport mais c'est sans doute l'infection qui a bloqué le téléchargement de Hijackthis.
On le vérifiera ensuite.

>> note : cet outil n'est pas à utiliser sans être préconisé <<

Tu vas télécharger ComBoFix et enregistre le sur ton bureau ( important pour la suite )
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

# Désactive les protections résidentes de ton ordinateur ( antivirus, antispyware et parefeu )
# Branche tes différents supports amovibles ( clés USB, disque dur externe ) sans les ouvrir.

# Lance Combofix.exe et suis les invites.
# Il te sera demandé d’installer la console de récupération.
Important. Fais le absolument.

Il est possible que ComBoFix redémarre l’ordinateur pour supprimer certains fichiers.

# Une fois le scan fini, un rapport va apparaitre.

Copie/colle ce rapport dans ta prochaine réponse.

Note : Si tu ne le trouves pas, il est à C:\ComboFix.txt.

A+

ComboFix 09-11-02.02 - Administrateur 03/11/2009 12:48.1.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.511.291 [GMT 1:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
FW: Sunbelt Personal Firewall *enabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrateur\delself.bat
c:\documents and settings\All Users\Menu Démarrer\Programmes\Internet Explorer.lnk
c:\windows\brastk.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\wini10891.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-03 au 2009-11-03 ))))))))))))))))))))))))))))))))))))
.

2009-11-03 11:36 . 2009-11-03 11:36 -------- d-----w- c:\program files\trend micro
2009-11-03 11:36 . 2009-11-03 11:36 -------- d-----w- C:\rsit
2009-11-03 11:08 . 2008-10-31 06:09 270888 ----a-r- c:\windows\system32\drivers\SbFw.sys
2009-11-03 11:08 . 2008-06-21 03:54 65576 ----a-w- c:\windows\system32\drivers\SbFwIm.sys
2009-11-03 11:08 . 2009-11-03 11:08 -------- d-----w- c:\program files\Sunbelt Software

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-03 11:09 . 2008-11-01 21:59 -------- d-----w- c:\program files\Norton Security Scan
2008-10-16 16:12 . 2001-12-31 21:14 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-10-16 16:12 . 2001-12-31 21:14 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-10-16 16:12 . 2001-12-31 21:14 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-10-16 16:12 . 2001-12-31 21:14 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-10-16 16:12 . 2001-12-31 21:14 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

------- Sigcheck -------

[-] 2008-05-19 . D9E201D9114DCAF1BD2ECBA565DC85F4 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-06-02 . D1EA0A366973ECA3E03F1ACBEFDA8F43 . 979968 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-05-19 16:14 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinExpose"="c:\program files\WinExpose\WinExpose.exe" [2007-06-17 539648]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"WinExpose"="c:\program files\WinExpose\WinExpose.exe" [2007-06-17 539648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-05-19 124928]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Wireless Configuration Utility HW.32.lnk - c:\windows\Installer\{BDC88E5A-F47B-4314-AB38-994592E32C95}\NewShortcut1.exe [2002-1-3 40960]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"DisablePagingExecutive"=dword:00000001
"SecondLevelDataCache"=dword:00000200

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [03/11/2009 12:08 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [21/06/2008 04:54 66600]
R2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [31/10/2008 07:24 95528]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [03/11/2009 12:08 65576]
S2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [31/10/2008 07:24 1365288]
S3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\SiS163u.sys [31/12/2004 17:46 167424]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Contenu du dossier 'Tâches planifiées'

2008-11-02 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2008-01-09 12:28]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0v3hzdyp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

Toolbar-ITBar7Position - (no file)
HKLM-Run-NVMixerTray - c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-03 12:55
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(1004)
c:\windows\system32\scecli.dll
.
Heure de fin: 2009-11-03 12:58
ComboFix-quarantined-files.txt 2009-11-03 11:58

Avant-CF: 35 890 286 592 octets libres
Après-CF: 35 898 482 688 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

- - End Of File - - 657670A1434D77A503F877E37146595D

J'y comprend rien de plus j'ai plus la croix rouge..

Combofix a fait un peu de ménage.
ce n'est pas terminé. Il doit rester d'autres fichiers à supprimer.

1/ Tu vas sur le site de VirusTotal et tu vas pouvoir analyser un fichier.
https://www.virustotal.com/gui/

# Copiez le chemin indiqué ci-dessous et le coller dans la zone à analyser :

Chemin : C:\WINDOWS\system32\drivers\beep.sys

# Tu cliques ensuite sur envoyer le fichier.
# Tu postes le rapport de l'analyse ( pour cela, tu sélectionnes la zone de résultat --> click droit --> copier )

Fais-en de même avec le fichier : c:\program files\WinExpose\WinExpose.exe

2/ Supprime RSIT sur ton bureau et le dossier C:\RSIT.
recommence la manip du message 1 :
https://forums.commentcamarche.net/forum/affich-15027971-your-computer-is-infected#1

A+

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.11.03 -
AhnLab-V3 5.0.0.2 2009.11.02 -
AntiVir 7.9.1.53 2009.11.02 -
Antiy-AVL 2.0.3.7 2009.11.02 -
Authentium 5.1.2.4 2009.11.03 -
Avast 4.8.1351.0 2009.11.02 -
AVG 8.5.0.423 2009.11.02 -
BitDefender 7.2 2009.11.03 -
CAT-QuickHeal 10.00 2009.11.02 -
ClamAV 0.94.1 2009.11.02 -
Comodo 2820 2009.11.03 -
DrWeb 5.0.0.12182 2009.11.03 -
eSafe 7.0.17.0 2009.11.02 Win32.Banker
eTrust-Vet 35.1.7098 2009.11.02 -
F-Prot 4.5.1.85 2009.11.02 -
F-Secure 9.0.15370.0 2009.10.30 -
Fortinet 3.120.0.0 2009.11.03 -
GData 19 2009.11.03 -
Ikarus T3.1.1.72.0 2009.11.03 -
Jiangmin 11.0.800 2009.11.02 -
K7AntiVirus 7.10.886 2009.11.02 -
Kaspersky 7.0.0.125 2009.11.03 -
McAfee 5790 2009.11.02 -
McAfee+Artemis 5790 2009.11.02 -
McAfee-GW-Edition 6.8.5 2009.11.02 -
Microsoft 1.5202 2009.11.02 -
NOD32 4566 2009.11.02 -
Norman 6.03.02 2009.11.02 -
nProtect 2009.1.8.0 2009.11.02 -
Panda 10.0.2.2 2009.11.02 -
PCTools 7.0.3.5 2009.11.02 -
Rising 21.54.04.00 2009.11.02 -
Sophos 4.47.0 2009.11.03 -
Sunbelt 3.2.1858.2 2009.11.02 -
Symantec 1.4.4.12 2009.11.03 -
TheHacker 6.5.0.2.058 2009.10.31 -
TrendMicro 8.950.0.1094 2009.11.02 -
VBA32 3.12.10.11 2009.11.02 -
ViRobot 2009.11.2.2017 2009.11.02 -
VirusBuster 4.6.5.0 2009.11.02 -
Information additionnelle
File size: 4224 bytes
MD5 : da1f27d85e0d1525f6621372e7b685e9
SHA1 : e3d2dc5eb273fa701de8af13b60d6baac7629260
SHA256: 5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x66C
timedatestamp.....: 0x3B7D82E5 (Fri Aug 17 22:47:33 2001)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x424 0x480 5.77 64f775a399d212649b5b58a280791c2d
.rdata 0x780 0xAD 0x100 2.62 0ace5f365131534c66de4137833221ad
INIT 0x880 0x284 0x300 4.44 13a9d0bea8490140305ffa9291acfd99
.rsrc 0xB80 0x3C8 0x400 3.22 9b654fc1759147ff04b147754f347be4
.reloc 0xF80 0x9A 0x100 2.80 5c4742feb834ca0995d1e806fe06cc57

( 0 imports )

( 0 exports )

TrID : File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ThreatExpert: https://www.symantec.com?md5=da1f27d85e0d1525f6621372e7b685e9
ssdeep: 48:qvsINlblgYeU/DtYrmVimGxIBqOopSDKGV7Co+sjIZWQ7q2ue5WwGD+:ilbd/DKrmLGWBqhev7X+MEWKLu+Ww8
PEiD : -
RDS : NSRL Reference Data Set

( Topics Entertainment )

Instant Home Design: beep.sys
( Symantec )

Norton SystemWorks 2005: BEEP.SYS
( Compaq )

Compaq Operating System CD: beep.sys
( NewTech Infosystems Inc. )

CD-Maker Plus Edition: beep.sys
( The Learning Company Inc. )

Reader Rabbits Toddler: beep.sys
( Dell )

Reinstallation CD Microsoft Windows XP Professional: beep.sys
( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: BEEP.SYS, beep.sys
( Sony )

Sony VAIO Recover CDs: BEEP.SYS
( Microsoft )

2261A: Supporting Users Running the Microsoft Windows XP Operating System: beep.sys2262A: Supporting Users Running Applications on a Microsoft Windows XP Operating System: beep.sysApplications, Platforms: beep.sysApplications, Platforms: beep.sysApplications, Platforms, Servers: beep.sysApplications, Platforms, Servers: beep.sysDisc 2438.5: beep.sysImplementing and Supporting Microsoft Windows XP Professional: beep.sysInternet Explorer: beep.sysInternet Explorer Versions: beep.sysMDSN Disc 2441.2: beep.sysMicrosoft Security Resource Kit: beep.sysMicrosoft TechNet Trial Software 2002 Volume 1: beep.sysMicrosoft Windows XP Professional: beep.sysMSDN Disc 1550: beep.sysMSDN Disc 2041: beep.sysMSDN Disc 2053: beep.sysMSDN Disc 2307: beep.sysMSDN Disc 2364: beep.sysMSDN disc 2390: beep.sysMSDN Disc 2428: beep.sysMSDN Disc 2428.1: beep.sysMSDN Disc 2428.2: beep.sysMSDN Disc 2428.4: beep.sysMSDN Disc 2428.5: beep.sysMSDN Disc 2428.8: beep.sysMSDN Disc 2438: beep.sysMSDN Disc 2438.1: beep.sysMSDN Disc 2438.2: beep.sysMSDN DISC 2438.3: beep.sysMSDN Disc 2438.7: beep.sysMSDN Disc 2438.8: beep.sysMSDN Disc 2439: beep.sysMSDN Disc 2439.1: beep.sysMSDN Disc 2439.2: beep.sysMSDN Disc 2439.3: beep.sysMSDN Disc 2439.6: beep.sysMSDN Disc 2439.7: beep.sysMSDN Disc 2439.8: beep.sysMSDN Disc 2440.3: beep.sysMSDN Disc 2440.4: beep.sysMSDN Disc 2440.5: beep.sysMSDN Disc 2441: beep.sysMSDN Disc 2441.1: beep.sysMSDN Disc 2441.5: beep.sysMSDN Disc 2441.6: beep.sysMSDN Disc 2441.7: beep.sysMSDN Disc 2442: beep.sysMSDN Disc 2442.1: beep.sysMSDN Disc 2442.2: beep.sysMSDN Disc 2442.3: beep.sysMSDN Disc 2442.4: beep.sysMSDN Disc 2442.6: beep.sysMSDN Disc 2443: beep.sysMSDN Disc 2443.1: beep.sysMSDN Disc 2443.2: beep.sysMSDN Disc 2443.4: beep.sysMSDN Disc 2444: beep.sysMSDN Disc 2444.1: beep.sysMSDN Disc 2444.3: beep.sysMSDN Disc 2444.3: beep.sysMSDN Disc 2444.4: beep.sysMSDN Disc 2444.6: beep.sysMSDN Disc 2455: beep.sysMSDN Disc 2455.1: beep.sysMSDN disc 2455.2: beep.sysMSDN Disc 2455.6: beep.sysMSDN Disc 2464: beep.sysMSDN Disc 2464.1: beep.sysMSDN Disc 2464.5: beep.sysMSDN Disc 2465: beep.sysMSDN Disc 2465.2: beep.sysMSDN disc 2465.3: beep.sysMSDN Disc 2465.4: beep.sysMSDN Disc 2465.5: beep.sysMSDN Disc 2466: beep.sysMSDN Disc 2466.1: beep.sysMSDN Disc 2466.2: beep.sysMSDN Disc 2466.4: beep.sysMSDN Disc 2476: beep.sysMSDN Disc 2476.1: beep.sysMSDN Disc 2476.2: beep.sysMSDN Disc 2476.4: beep.sysMSDN Disc 2477.2: beep.sysMSDN Disc 3264: beep.sysMSDN Disc2365: beep.sysMSDN Disc2389: beep.sysMSDN Disc2428.3: beep.sysMSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: beep.sysOffice XP Professional with FrontPage: beep.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: beep.sysPlatforms: beep.sysPlatforms SDKs/DDKs: beep.sysPlatforms, SDK/DDK: beep.sysPlatforms, SDK/DDK: beep.sysPlatforms, SDK/DDK, Developer Tools: beep.sysVirtual PC for Mac Windows XP Home Edition: beep.sysVirtual PC for Mac Windows XP Professional Edition: beep.sysWindows 2000 Versions: beep.sysWindows 98 Versions: beep.sysWindows CE .NET Evaluation Software: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP eMbedded Evaluation Software: beep.sysWindows XP Home Edition: beep.sysWindows XP Home Edition: beep.sysWindows XP Professional: beep.sysWindows XP Professional: beep.sysWindows XP Professional 2002 Service Pack 1: beep.sysWindows XP Tablet PC Edition: beep.sys

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.11.03 -
AhnLab-V3 5.0.0.2 2009.11.02 -
AntiVir 7.9.1.53 2009.11.02 -
Antiy-AVL 2.0.3.7 2009.11.02 -
Authentium 5.1.2.4 2009.11.03 -
Avast 4.8.1351.0 2009.11.02 -
AVG 8.5.0.423 2009.11.02 -
BitDefender 7.2 2009.11.03 -
CAT-QuickHeal 10.00 2009.11.02 -
ClamAV 0.94.1 2009.11.02 -
Comodo 2820 2009.11.03 -
DrWeb 5.0.0.12182 2009.11.03 -
eSafe 7.0.17.0 2009.11.02 Win32.Banker
eTrust-Vet 35.1.7098 2009.11.02 -
F-Prot 4.5.1.85 2009.11.02 -
F-Secure 9.0.15370.0 2009.10.30 -
Fortinet 3.120.0.0 2009.11.03 -
GData 19 2009.11.03 -
Ikarus T3.1.1.72.0 2009.11.03 -
Jiangmin 11.0.800 2009.11.02 -
K7AntiVirus 7.10.886 2009.11.02 -
Kaspersky 7.0.0.125 2009.11.03 -
McAfee 5790 2009.11.02 -
McAfee+Artemis 5790 2009.11.02 -
McAfee-GW-Edition 6.8.5 2009.11.02 -
Microsoft 1.5202 2009.11.02 -
NOD32 4566 2009.11.02 -
Norman 6.03.02 2009.11.02 -
nProtect 2009.1.8.0 2009.11.02 -
Panda 10.0.2.2 2009.11.02 -
PCTools 7.0.3.5 2009.11.02 -
Rising 21.54.04.00 2009.11.02 -
Sophos 4.47.0 2009.11.03 -
Sunbelt 3.2.1858.2 2009.11.02 -
Symantec 1.4.4.12 2009.11.03 -
TheHacker 6.5.0.2.058 2009.10.31 -
TrendMicro 8.950.0.1094 2009.11.02 -
VBA32 3.12.10.11 2009.11.02 -
ViRobot 2009.11.2.2017 2009.11.02 -
VirusBuster 4.6.5.0 2009.11.02 -
Information additionnelle
File size: 4224 bytes
MD5 : da1f27d85e0d1525f6621372e7b685e9
SHA1 : e3d2dc5eb273fa701de8af13b60d6baac7629260
SHA256: 5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x66C
timedatestamp.....: 0x3B7D82E5 (Fri Aug 17 22:47:33 2001)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x424 0x480 5.77 64f775a399d212649b5b58a280791c2d
.rdata 0x780 0xAD 0x100 2.62 0ace5f365131534c66de4137833221ad
INIT 0x880 0x284 0x300 4.44 13a9d0bea8490140305ffa9291acfd99
.rsrc 0xB80 0x3C8 0x400 3.22 9b654fc1759147ff04b147754f347be4
.reloc 0xF80 0x9A 0x100 2.80 5c4742feb834ca0995d1e806fe06cc57

( 0 imports )

( 0 exports )

TrID : File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ThreatExpert: https://www.symantec.com?md5=da1f27d85e0d1525f6621372e7b685e9
ssdeep: 48:qvsINlblgYeU/DtYrmVimGxIBqOopSDKGV7Co+sjIZWQ7q2ue5WwGD+:ilbd/DKrmLGWBqhev7X+MEWKLu+Ww8
PEiD : -
RDS : NSRL Reference Data Set

( Topics Entertainment )

Instant Home Design: beep.sys
( Symantec )

Norton SystemWorks 2005: BEEP.SYS
( Compaq )

Compaq Operating System CD: beep.sys
( NewTech Infosystems Inc. )

CD-Maker Plus Edition: beep.sys
( The Learning Company Inc. )

Reader Rabbits Toddler: beep.sys
( Dell )

Reinstallation CD Microsoft Windows XP Professional: beep.sys
( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: BEEP.SYS, beep.sys
( Sony )

Sony VAIO Recover CDs: BEEP.SYS
( Microsoft )

2261A: Supporting Users Running the Microsoft Windows XP Operating System: beep.sys2262A: Supporting Users Running Applications on a Microsoft Windows XP Operating System: beep.sysApplications, Platforms: beep.sysApplications, Platforms: beep.sysApplications, Platforms, Servers: beep.sysApplications, Platforms, Servers: beep.sysDisc 2438.5: beep.sysImplementing and Supporting Microsoft Windows XP Professional: beep.sysInternet Explorer: beep.sysInternet Explorer Versions: beep.sysMDSN Disc 2441.2: beep.sysMicrosoft Security Resource Kit: beep.sysMicrosoft TechNet Trial Software 2002 Volume 1: beep.sysMicrosoft Windows XP Professional: beep.sysMSDN Disc 1550: beep.sysMSDN Disc 2041: beep.sysMSDN Disc 2053: beep.sysMSDN Disc 2307: beep.sysMSDN Disc 2364: beep.sysMSDN disc 2390: beep.sysMSDN Disc 2428: beep.sysMSDN Disc 2428.1: beep.sysMSDN Disc 2428.2: beep.sysMSDN Disc 2428.4: beep.sysMSDN Disc 2428.5: beep.sysMSDN Disc 2428.8: beep.sysMSDN Disc 2438: beep.sysMSDN Disc 2438.1: beep.sysMSDN Disc 2438.2: beep.sysMSDN DISC 2438.3: beep.sysMSDN Disc 2438.7: beep.sysMSDN Disc 2438.8: beep.sysMSDN Disc 2439: beep.sysMSDN Disc 2439.1: beep.sysMSDN Disc 2439.2: beep.sysMSDN Disc 2439.3: beep.sysMSDN Disc 2439.6: beep.sysMSDN Disc 2439.7: beep.sysMSDN Disc 2439.8: beep.sysMSDN Disc 2440.3: beep.sysMSDN Disc 2440.4: beep.sysMSDN Disc 2440.5: beep.sysMSDN Disc 2441: beep.sysMSDN Disc 2441.1: beep.sysMSDN Disc 2441.5: beep.sysMSDN Disc 2441.6: beep.sysMSDN Disc 2441.7: beep.sysMSDN Disc 2442: beep.sysMSDN Disc 2442.1: beep.sysMSDN Disc 2442.2: beep.sysMSDN Disc 2442.3: beep.sysMSDN Disc 2442.4: beep.sysMSDN Disc 2442.6: beep.sysMSDN Disc 2443: beep.sysMSDN Disc 2443.1: beep.sysMSDN Disc 2443.2: beep.sysMSDN Disc 2443.4: beep.sysMSDN Disc 2444: beep.sysMSDN Disc 2444.1: beep.sysMSDN Disc 2444.3: beep.sysMSDN Disc 2444.3: beep.sysMSDN Disc 2444.4: beep.sysMSDN Disc 2444.6: beep.sysMSDN Disc 2455: beep.sysMSDN Disc 2455.1: beep.sysMSDN disc 2455.2: beep.sysMSDN Disc 2455.6: beep.sysMSDN Disc 2464: beep.sysMSDN Disc 2464.1: beep.sysMSDN Disc 2464.5: beep.sysMSDN Disc 2465: beep.sysMSDN Disc 2465.2: beep.sysMSDN disc 2465.3: beep.sysMSDN Disc 2465.4: beep.sysMSDN Disc 2465.5: beep.sysMSDN Disc 2466: beep.sysMSDN Disc 2466.1: beep.sysMSDN Disc 2466.2: beep.sysMSDN Disc 2466.4: beep.sysMSDN Disc 2476: beep.sysMSDN Disc 2476.1: beep.sysMSDN Disc 2476.2: beep.sysMSDN Disc 2476.4: beep.sysMSDN Disc 2477.2: beep.sysMSDN Disc 3264: beep.sysMSDN Disc2365: beep.sysMSDN Disc2389: beep.sysMSDN Disc2428.3: beep.sysMSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: beep.sysOffice XP Professional with FrontPage: beep.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: beep.sysPlatforms: beep.sysPlatforms SDKs/DDKs: beep.sysPlatforms, SDK/DDK: beep.sysPlatforms, SDK/DDK: beep.sysPlatforms, SDK/DDK, Developer Tools: beep.sysVirtual PC for Mac Windows XP Home Edition: beep.sysVirtual PC for Mac Windows XP Professional Edition: beep.sysWindows 2000 Versions: beep.sysWindows 98 Versions: beep.sysWindows CE .NET Evaluation Software: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP eMbedded Evaluation Software: beep.sysWindows XP Home Edition: beep.sysWindows XP Home Edition: beep.sysWindows XP Professional: beep.sysWindows XP Professional: beep.sysWindows XP Professional 2002 Service Pack 1: beep.sysWindows XP Tablet PC Edition: beep.sys

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.11.03 -
AhnLab-V3 5.0.0.2 2009.11.02 -
AntiVir 7.9.1.53 2009.11.02 -
Antiy-AVL 2.0.3.7 2009.11.02 -
Authentium 5.1.2.4 2009.11.03 -
Avast 4.8.1351.0 2009.11.02 -
AVG 8.5.0.423 2009.11.02 -
BitDefender 7.2 2009.11.03 -
CAT-QuickHeal 10.00 2009.11.02 -
ClamAV 0.94.1 2009.11.02 -
Comodo 2820 2009.11.03 -
DrWeb 5.0.0.12182 2009.11.03 -
eSafe 7.0.17.0 2009.11.02 Win32.Banker
eTrust-Vet 35.1.7098 2009.11.02 -
F-Prot 4.5.1.85 2009.11.02 -
F-Secure 9.0.15370.0 2009.10.30 -
Fortinet 3.120.0.0 2009.11.03 -
GData 19 2009.11.03 -
Ikarus T3.1.1.72.0 2009.11.03 -
Jiangmin 11.0.800 2009.11.02 -
K7AntiVirus 7.10.886 2009.11.02 -
Kaspersky 7.0.0.125 2009.11.03 -
McAfee 5790 2009.11.02 -
McAfee+Artemis 5790 2009.11.02 -
McAfee-GW-Edition 6.8.5 2009.11.02 -
Microsoft 1.5202 2009.11.02 -
NOD32 4566 2009.11.02 -
Norman 6.03.02 2009.11.02 -
nProtect 2009.1.8.0 2009.11.02 -
Panda 10.0.2.2 2009.11.02 -
PCTools 7.0.3.5 2009.11.02 -
Rising 21.54.04.00 2009.11.02 -
Sophos 4.47.0 2009.11.03 -
Sunbelt 3.2.1858.2 2009.11.02 -
Symantec 1.4.4.12 2009.11.03 -
TheHacker 6.5.0.2.058 2009.10.31 -
TrendMicro 8.950.0.1094 2009.11.02 -
VBA32 3.12.10.11 2009.11.02 -
ViRobot 2009.11.2.2017 2009.11.02 -
VirusBuster 4.6.5.0 2009.11.02 -
Information additionnelle
File size: 4224 bytes
MD5 : da1f27d85e0d1525f6621372e7b685e9
SHA1 : e3d2dc5eb273fa701de8af13b60d6baac7629260
SHA256: 5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x66C
timedatestamp.....: 0x3B7D82E5 (Fri Aug 17 22:47:33 2001)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x424 0x480 5.77 64f775a399d212649b5b58a280791c2d
.rdata 0x780 0xAD 0x100 2.62 0ace5f365131534c66de4137833221ad
INIT 0x880 0x284 0x300 4.44 13a9d0bea8490140305ffa9291acfd99
.rsrc 0xB80 0x3C8 0x400 3.22 9b654fc1759147ff04b147754f347be4
.reloc 0xF80 0x9A 0x100 2.80 5c4742feb834ca0995d1e806fe06cc57

( 0 imports )

( 0 exports )

TrID : File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ThreatExpert: https://www.symantec.com?md5=da1f27d85e0d1525f6621372e7b685e9
ssdeep: 48:qvsINlblgYeU/DtYrmVimGxIBqOopSDKGV7Co+sjIZWQ7q2ue5WwGD+:ilbd/DKrmLGWBqhev7X+MEWKLu+Ww8
PEiD : -
RDS : NSRL Reference Data Set

( Topics Entertainment )

Instant Home Design: beep.sys
( Symantec )

Norton SystemWorks 2005: BEEP.SYS
( Compaq )

Compaq Operating System CD: beep.sys
( NewTech Infosystems Inc. )

CD-Maker Plus Edition: beep.sys
( The Learning Company Inc. )

Reader Rabbits Toddler: beep.sys
( Dell )

Reinstallation CD Microsoft Windows XP Professional: beep.sys
( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: BEEP.SYS, beep.sys
( Sony )

Sony VAIO Recover CDs: BEEP.SYS
( Microsoft )

2261A: Supporting Users Running the Microsoft Windows XP Operating System: beep.sys2262A: Supporting Users Running Applications on a Microsoft Windows XP Operating System: beep.sysApplications, Platforms: beep.sysApplications, Platforms: beep.sysApplications, Platforms, Servers: beep.sysApplications, Platforms, Servers: beep.sysDisc 2438.5: beep.sysImplementing and Supporting Microsoft Windows XP Professional: beep.sysInternet Explorer: beep.sysInternet Explorer Versions: beep.sysMDSN Disc 2441.2: beep.sysMicrosoft Security Resource Kit: beep.sysMicrosoft TechNet Trial Software 2002 Volume 1: beep.sysMicrosoft Windows XP Professional: beep.sysMSDN Disc 1550: beep.sysMSDN Disc 2041: beep.sysMSDN Disc 2053: beep.sysMSDN Disc 2307: beep.sysMSDN Disc 2364: beep.sysMSDN disc 2390: beep.sysMSDN Disc 2428: beep.sysMSDN Disc 2428.1: beep.sysMSDN Disc 2428.2: beep.sysMSDN Disc 2428.4: beep.sysMSDN Disc 2428.5: beep.sysMSDN Disc 2428.8: beep.sysMSDN Disc 2438: beep.sysMSDN Disc 2438.1: beep.sysMSDN Disc 2438.2: beep.sysMSDN DISC 2438.3: beep.sysMSDN Disc 2438.7: beep.sysMSDN Disc 2438.8: beep.sysMSDN Disc 2439: beep.sysMSDN Disc 2439.1: beep.sysMSDN Disc 2439.2: beep.sysMSDN Disc 2439.3: beep.sysMSDN Disc 2439.6: beep.sysMSDN Disc 2439.7: beep.sysMSDN Disc 2439.8: beep.sysMSDN Disc 2440.3: beep.sysMSDN Disc 2440.4: beep.sysMSDN Disc 2440.5: beep.sysMSDN Disc 2441: beep.sysMSDN Disc 2441.1: beep.sysMSDN Disc 2441.5: beep.sysMSDN Disc 2441.6: beep.sysMSDN Disc 2441.7: beep.sysMSDN Disc 2442: beep.sysMSDN Disc 2442.1: beep.sysMSDN Disc 2442.2: beep.sysMSDN Disc 2442.3: beep.sysMSDN Disc 2442.4: beep.sysMSDN Disc 2442.6: beep.sysMSDN Disc 2443: beep.sysMSDN Disc 2443.1: beep.sysMSDN Disc 2443.2: beep.sysMSDN Disc 2443.4: beep.sysMSDN Disc 2444: beep.sysMSDN Disc 2444.1: beep.sysMSDN Disc 2444.3: beep.sysMSDN Disc 2444.3: beep.sysMSDN Disc 2444.4: beep.sysMSDN Disc 2444.6: beep.sysMSDN Disc 2455: beep.sysMSDN Disc 2455.1: beep.sysMSDN disc 2455.2: beep.sysMSDN Disc 2455.6: beep.sysMSDN Disc 2464: beep.sysMSDN Disc 2464.1: beep.sysMSDN Disc 2464.5: beep.sysMSDN Disc 2465: beep.sysMSDN Disc 2465.2: beep.sysMSDN disc 2465.3: beep.sysMSDN Disc 2465.4: beep.sysMSDN Disc 2465.5: beep.sysMSDN Disc 2466: beep.sysMSDN Disc 2466.1: beep.sysMSDN Disc 2466.2: beep.sysMSDN Disc 2466.4: beep.sysMSDN Disc 2476: beep.sysMSDN Disc 2476.1: beep.sysMSDN Disc 2476.2: beep.sysMSDN Disc 2476.4: beep.sysMSDN Disc 2477.2: beep.sysMSDN Disc 3264: beep.sysMSDN Disc2365: beep.sysMSDN Disc2389: beep.sysMSDN Disc2428.3: beep.sysMSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: beep.sysOffice XP Professional with FrontPage: beep.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: beep.sysPlatforms: beep.sysPlatforms SDKs/DDKs: beep.sysPlatforms, SDK/DDK: beep.sysPlatforms, SDK/DDK: beep.sysPlatforms, SDK/DDK, Developer Tools: beep.sysVirtual PC for Mac Windows XP Home Edition: beep.sysVirtual PC for Mac Windows XP Professional Edition: beep.sysWindows 2000 Versions: beep.sysWindows 98 Versions: beep.sysWindows CE .NET Evaluation Software: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP eMbedded Evaluation Software: beep.sysWindows XP Home Edition: beep.sysWindows XP Home Edition: beep.sysWindows XP Professional: beep.sysWindows XP Professional: beep.sysWindows XP Professional 2002 Service Pack 1: beep.sysWindows XP Tablet PC Edition: beep.sys

C'est OK pour le fichier beep.sys.
Tu peux analyser l'autre fichier.

A+

Voila l'autre fichier :Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.93 2009.02.18 -
AhnLab-V3 2009.2.19.0 2009.02.18 -
AntiVir 7.9.0.83 2009.02.18 -
Authentium 5.1.0.4 2009.02.18 -
Avast 4.8.1335.0 2009.02.17 -
AVG 8.0.0.237 2009.02.18 -
BitDefender 7.2 2009.02.18 -
CAT-QuickHeal 10.00 2009.02.18 -
ClamAV 0.94.1 2009.02.18 -
Comodo 983 2009.02.18 -
DrWeb 4.44.0.09170 2009.02.18 -
eSafe 7.0.17.0 2009.02.18 Suspicious File
eTrust-Vet 31.6.6363 2009.02.18 -
F-Prot 4.4.4.56 2009.02.18 -
F-Secure 8.0.14470.0 2009.02.18 -
Fortinet 3.117.0.0 2009.02.18 -
GData 19 2009.02.18 -
Ikarus T3.1.1.45.0 2009.02.18 -
K7AntiVirus 7.10.630 2009.02.18 -
Kaspersky 7.0.0.125 2009.02.18 -
McAfee 5529 2009.02.17 -
McAfee+Artemis 5529 2009.02.17 -
Microsoft 1.4306 2009.02.18 -
NOD32 3865 2009.02.18 -
Norman 6.00.06 2009.02.18 -
nProtect 2009.1.8.0 2009.02.18 -
Panda 9.4.3.20 2009.02.18 -
PCTools 4.4.2.0 2009.02.18 -
Prevx1 V2 2009.02.18 -
Rising 21.17.22.00 2009.02.18 -
SecureWeb-Gateway 6.7.6 2009.02.18 -
Sophos 4.38.0 2009.02.18 -
Sunbelt 3.2.1855.2 2009.02.17 -
Symantec 10 2009.02.18 -
TheHacker 6.3.2.2.259 2009.02.18 -
TrendMicro 8.700.0.1004 2009.02.18 -
VBA32 3.12.8.13 2009.02.18 -
ViRobot 2009.2.18.1613 2009.02.18 -
VirusBuster 4.5.11.0 2009.02.18 -
Information additionnelle
File size: 539648 bytes
MD5 : bab69f82cc5829faa2b3725213e3a841
SHA1 : 07ffb18de5ae64be21bb609232c7341a2d86e0af
SHA256: 742158826217f84edea2939ea1fd6d364e05319089ae38f58e607cc35395bc26
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1717C0
timedatestamp.....: 0x2A425E19 (Sat Jun 20 00:22:17 1992)
machinetype.......: 0x14C (Intel I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x103000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x104000 0x6E000 0x6DC00 7.92 709daf5b95e06bc3e618c479ddd4a8f7
.rsrc 0x172000 0x16000 0x15C00 4.69 b1955f7683c4fe0b68abdf943e5e186f

( 13 imports )

> advapi32.dll: FreeSid
> comctl32.dll: ImageList_Add
> comdlg32.dll: PrintDlgA
> gdi32.dll: SaveDC
> gdiplus.dll: GdiplusStartup
> kernel32.dll: LoadLibraryA, GetProcAddress, ExitProcess
> ole32.dll: IsEqualGUID
> oleaut32.dll: VariantClear
> shell32.dll: ShellExecuteA
> user32.dll: GetDC
> version.dll: VerQueryValueA
> winspool.drv: OpenPrinterA
> wsock32.dll: send

( 0 exports )

TrID : File type identification
UPX compressed Win32 Executable (42.6%)
Win32 EXE Yoda's Crypter (37.0%)
Win32 Executable Generic (11.8%)
Win16/32 Executable Delphi generic (2.8%)
Generic Win/DOS Executable (2.7%)
ThreatExpert: https://www.symantec.com?md5=bab69f82cc5829faa2b3725213e3a841
ssdeep: 12288:UPVqQIA3xfgLrm4XQhTMRyMomvku59+SMd9HGBn4q3FG:UPNI/BEPmr9ysB4q3FG
PEiD : UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
packers (Kaspersky): UPX
packers (F-Prot): UPX
RDS : NSRL Reference Data Set
-

Manip du debut :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-11-03 13:33:50
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 34 GB (90%) free of 38 GB
Total RAM: 511 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:33:58, on 03/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20696)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WinExpose\WinExpose.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\Program Files\trend micro\Administrateur.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKCU\..\Run: [WinExpose] "C:\Program Files\WinExpose\WinExpose.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [WinExpose] "C:\Program Files\WinExpose\WinExpose.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [WinExpose] "C:\Program Files\WinExpose\WinExpose.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

Plusieurs questions :

- Est-ce que cela te dit quelque chose WinExpose ?
- pas d'antivirus sur le PC. Il faut en installer un . Je te propose Antivir qui est actuellement le meilleur AV gratuit. Qu'en penses-tu ?

A+

Sa me dit rien winexpose ???
Je vais instaler l'antivirus dont tu me parle merci pour ton aide ..

Pour l'antivirus, on verra plus tard.

On va vérifier pour certains fichiers.

Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau.
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
# Double-clique sur OTMoveIt.exe pour le lancer.
# Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste Instructions for Items to be Moved.

:files
C:\WINDOWS\karna.dat
C:\WINDOWS\system32\karna.dat
C:\WINDOWS\system32\drivers\svchost.exe
C:\WINDOWS\system32\wini10891.exe

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

:Commands
[emptytemp]
[Reboot]

# Clique sur MoveIt! pour lancer la suppression. Le résultat apparaitra dans le cadre "Results".
# Le PC va redémarrer pour supprimer les fichiers.
# après le redémarrage, un rapport va s'ouvrir.
# Copie/Colle le contenu du rapport dans ton prochain message.

Note : Si tu ne trouves plus le rapport,c'est un fichier .log qui se trouve en C:\_OTMoveIt\MovedFiles.

A+

All processes killed
========== FILES ==========
File/Folder C:\WINDOWS\karna.dat not found.
File/Folder C:\WINDOWS\system32\karna.dat not found.
File/Folder C:\WINDOWS\system32\drivers\svchost.exe not found.
File/Folder C:\WINDOWS\system32\wini10891.exe not found.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|"" /E : value set successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 22842077 bytes
->Java cache emptied: 919107 bytes
->FireFox cache emptied: 57020769 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2351795 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 79,29 mb

OTM by OldTimer - Version 3.0.0.6 log created on 11032009_140313

Files moved on Reboot...

Registry entries deleted on Reboot...

OK,

Deux scans pour vérifier que le PC est propre ( dont l'installation de l'AV )

1/ Tu télécharges MalwareBytes.
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Tu l'installes. Choisis les options par défaut.
# A la fin de l’installation, il te sera demandé de mettre à jour MalwareBytes et de l’éxecuter .
# Accepte. Après la, mise à jour, le logiciel va s’ouvrir.

# Dans l’onglet Recherche, sélectionne Exécuter un examen complet.
# Clique sur recherche. Tu ne sélectionnes que les disques durs de l’ordinateur.
# Clique sur lancer l’examen.

# A la fin de la recherche, comme il est demandé, clique sur afficher les résultats.
# Si des infections sont trouvées, clique sur Supprimer la sélection.
Tu postes le rapport dans ton prochain message.

Si tu ne retrouves pas le rapport, ouvre MalwareBytes et regarde dans l’onglet Rapport/logs. Il y est. Clique dessus et choisir ouvrir.

Le scan dure en moyenne 50 mn.

2/ Télécharge Antivir.
https://www.avira.com/fr/free-antivirus-windows

Suis le tuto pour installer Antivir :
https://www.malekal.com/avira-free-security-antivirus-gratuit/

* Mets à jour Antivir et lance un scan complet
* Pour cela, clique sur l'onglet Protection Locale puis Contrôler
* Choisis les éléments à scanner ( disques durs locaux ).
* Lance le scan en cliquant sur la loupe.

Lorsque le scan est terminé, tu as la possibilité de générer un rapport en cliquant sur le bouton rapport.
Poste le rapport.

A+

Je dois m'absenter. je regarderais cela en fin de journée.

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3092
Windows 5.1.2600 Service Pack 3

03/11/2009 14:34:33
mbam-log-2009-11-03 (14-34-33).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 109424
Temps écoulé: 20 minute(s), 42 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\dllcache\beep.sys (Fake.Beep.sys) -> Quarantined and deleted successfully.

As-tu installé Antivir ?

A+

Oui mais j'arrive pas a faire la mise a jour..