TR/Dldr.yapson infècte mon disque C - Page 2

le lien que tu m'as envoyé ne fonctionne pas. et le logiciel demandé est introuvable!

ok

il doit être en cours de mis à jour

Télécharge Superantispyware (SAS)

https://www.superantispyware.com/superantispywarefreevspro.html

Choisis "enregistrer" et enregistre-le sur ton bureau.

Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.

Créé une icône sur le bureau.

Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.

Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.

Sous Configuration and Preferences, clique sur le bouton "Preferences"

Clique sur l'onglet "Scanning Control "
Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée :

* Close browsers before scanning
* Scan for tracking cookies
* Terminate memory threats before quarantining

Laisse les autres lignes décochées.

Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.

Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".

Dans la colonne de gauche, coche C:\Fixed Drive.

Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"

Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.

A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.

Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".

Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.

Pour recopier les informations sur le forum, fais ceci :

- après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
- Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.

- Le rapport va s'ouvrir dans ton éditeur de texte par défaut.

- Copie son contenu dans ta réponse.

tutoriel en image :

https://www.malekal.com/?s=SUPERAntiSpyware

j'ai fais un scan avec superantispyware et vois ce que j"aci le rapport. d'après ce que j'ai compris, il a mis en quarantaine des cookies mais il n'a pas touché à mon programme messenger infecté. que faire?merci d'avance
le rapport : .
SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 01/22/2010 at 08:37 PM

Application Version : 4.33.1000

Core Rules Database Version : 4507
Trace Rules Database Version: 2319

Scan type : Complete Scan
Total Scan Time : 00:28:14

Memory items scanned : 736
Memory threats detected : 0
Registry items scanned : 5425
Registry threats detected : 0
File items scanned : 12802
File threats detected : 59

Adware.Tracking Cookie
C:\Documents and Settings\Emilie\Cookies\emilie@mediaplex[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@smartadserver[3].txt
C:\Documents and Settings\Emilie\Cookies\emilie@garnier2009.solution.weborama[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@mediadico[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@adtech[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@imrworldwide[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@banquepopulaire.solution.weborama[3].txt
C:\Documents and Settings\Emilie\Cookies\emilie@ad.zanox[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@cetelem.solution.weborama[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@cosmetiqueactive2009.solution.weborama[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@gemey2009.solution.weborama[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@atdmt[3].txt
C:\Documents and Settings\Emilie\Cookies\emilie@adbrite[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@media6degrees[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@estat[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@boursoramabanque.solution.weborama[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@serving-sys[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@tracking.publicidees[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@bouyguestelecom.solution.weborama[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@advertstream[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@weborama[3].txt
C:\Documents and Settings\Emilie\Cookies\emilie@fastclick[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@apmebf[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@bluestreak[3].txt
C:\Documents and Settings\Emilie\Cookies\emilie@advertising[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@xiti[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@trafficmp[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@cafecom.solution.weborama[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@ad.yieldmanager[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@linksynergy[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@bs.serving-sys[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@www.googleadservices[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@tradedoubler[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@notrefamille.112.2o7[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@doubleclick[3].txt
C:\Documents and Settings\Emilie\Cookies\emilie@zedo[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@smartadserver[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@weborama[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@samsung.solution.weborama[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@optimize.indieclick[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@bluestreak[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@atdmt[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@xiti[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@adtech[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@track.effiliation[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@specificclick[1].txt
C:\Documents and Settings\Emilie\Cookies\emilie@banquepopulaire.solution.weborama[2].txt
C:\Documents and Settings\Emilie\Cookies\emilie@doubleclick[1].txt
C:\Documents and Settings\Quentin\Cookies\quentin@cetelem.solution.weborama[2].txt
C:\Documents and Settings\Quentin\Cookies\quentin@atdmt[1].txt
C:\Documents and Settings\Quentin\Cookies\quentin@content.yieldmanager[1].txt
C:\Documents and Settings\Quentin\Cookies\quentin@247realmedia[2].txt
C:\Documents and Settings\Quentin\Cookies\quentin@xiti[1].txt
C:\Documents and Settings\Quentin\Cookies\quentin@ad.yieldmanager[2].txt
C:\Documents and Settings\Quentin\Cookies\quentin@tradedoubler[2].txt
C:\Documents and Settings\Quentin\Cookies\quentin@doubleclick[1].txt
C:\Documents and Settings\Quentin\Cookies\quentin@bluestreak[2].txt
C:\Documents and Settings\Quentin\Cookies\quentin@adtech[1].txt
C:\Documents and Settings\Quentin\Cookies\quentin@weborama[1].txt

que du cookies...

killem est à nouveau disponible

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

▶ Télécharge et installe List&Kill'em et enregistre le sur ton bureau
http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem_Install.exe
double clique ( clic droit "executer en tant qu'administrateur" pour Vista/Seven ) sur le raccourci sur ton bureau pour lancer l'installation

coche la case "creer une icone sur le bureau"

une fois terminée , clic sur "terminer" et le programme se lancer seul

choisis la langue puis choisis l'option 1 = Mode Recherche

▶ laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

tu peux supprimer le rapport catchme.log de ton bureau maintenant.

List'em by g3n-h@ckm@n 1.2.1.0
User : Emilie (Administrateurs)
Update on 21/01/2010 by g3n-h@ckm@n ::::: 10:30
Start at: 11:16:50 | 23/01/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Atom(TM) CPU N280 @ 1.66GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | (!) Outdated ]

C:\ -> Disque fixe local | 74,52 Go (54,76 Go free) [XP] | NTFS
D:\ -> Disque fixe local | 73,24 Go (69,44 Go free) [Data] | NTFS
E:\ -> Disque amovible

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\system32\thpsrv.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Atheros\ACU.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\CardDetector\HUAWEI160\CardDetector.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ThpSrv.exe
C:\WINDOWS\system32\TODDSrv.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\WINDOWS\system32\wscntfy.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
c:\program files\avira\antivir desktop\avcenter.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Emilie\Local Settings\Temp\4.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
TOSHIBA Online Product Information REG_SZ C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe
AdobeBridge REG_SZ
MSMSGS REG_SZ "C:\Program Files\Messenger\msmsgs.exe" /background
SUPERAntiSpyware REG_SZ C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IgfxTray REG_SZ C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds REG_SZ C:\WINDOWS\system32\hkcmd.exe
Persistence REG_SZ C:\WINDOWS\system32\igfxpers.exe
RTHDCPL REG_SZ RTHDCPL.EXE
ITSecMng REG_EXPAND_SZ %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
NDSTray.exe REG_SZ NDSTray.exe
CeEKEY REG_SZ C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
TDispVol REG_SZ TDispVol.exe
HWSetup REG_SZ C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
SmoothView REG_SZ C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
Zooming REG_SZ ZoomingHook.exe
<NO NAME> REG_SZ
SVPWUTIL REG_SZ C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
TAccessibility REG_SZ C:\Program Files\TOSHIBA\Accessibility\TAccessibility.exe Instant
TPNF REG_SZ C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
TPSMain REG_SZ TPSMain.exe
ThpSrv REG_SZ C:\WINDOWS\system32\thpsrv /logon
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
ACU REG_SZ "C:\Program Files\Atheros\ACU.exe" -nogui
Apoint REG_SZ C:\Program Files\Apoint2K\Apoint.exe
Camera Assistant Software REG_SZ "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
TUSBSleepChargeSrv REG_EXPAND_SZ %ProgramFiles%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
CardDetectorHUAWEI160 REG_SZ C:\Program Files\CardDetector\HUAWEI160\CardDetector.exe
BEWINTERNET-FR-DMGP-V2SessionManager REG_SZ "C:\Program Files\Orange\IEWInternet\SessionManager\SessionManager.exe"
CFSServ.exe REG_SZ CFSServ.exe -NoClient
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 128 (0x80)
NoDriveAutoRun REG_DWORD 128 (0x80)
HonorAutoRunSetting REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 128 (0x80)
NoDriveTypeAutoRun REG_DWORD 128 (0x80)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
{56F9679E-7826-4C84-81F3-532071A8BCC5} REG_SZ
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE REG_SZ C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote
C:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe REG_SZ C:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe:*:enabled:CSS
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE REG_SZ C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
C:\Program Files\Yooda\SeeUrankV3\SeeUrank.exe REG_SZ C:\Program Files\Yooda\SeeUrankV3\SeeUrank.exe:*:Enabled:Yooda SeeUrank

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{CEF48DB6-DA34-4255-9FF0-9263E0FD7807}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3F7924B9-D148-3141-87B1-68F36043A940}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4711D28A-D1FF-8164-90AA-9F59E72CA596}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CF9CB2A1-AC9C-BF16-08A7-8A13FC92A487}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x3
SharedAccess : 0x2
wuauserv : 0x2

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Documents and Settings\Emilie\Local Settings\Temp\4.tmp
## C:\> hashdeep C:\WINDOWS\System32\Drivers\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\System32\Drivers\atapi.sys

Sources
=======

C:\WINDOWS\system32\drivers\atapi.sys
C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

Référence :
==========

Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
74,52 Go total, 54,77 Go libre (73%), 0% fragment‚ (fragmentation du fichier 1%)

Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\Documents and Settings\Emilie\Application Data\wklnhst.dat
Present !! : C:\Documents and Settings\Emilie\Application Data\wklnhst.dat
Present !! : C:\Documents and Settings\Emilie\Local Settings\Temp\afl.log
Present !! : C:\Documents and Settings\Emilie\Local Settings\Temp\alm.log
Present !! : C:\Documents and Settings\Emilie\Local Settings\Temp\amt.log
Present !! : C:\Documents and Settings\Emilie\Local Settings\Temp\LM.doc
Present !! : C:\Documents and Settings\Emilie\LOCAL Settings\Temp\FP_PL_PFS_INSTALLER.exe
Present !! : C:\Documents and Settings\Emilie\LOCAL Settings\Temp\SSUPDATE.EXE

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"

================
Other infections
================

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-23 11:25:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

==========
Programs
==========

Activation Assistant for the 2007 Microsoft Office suites
Adobe
Alwil Software
Apoint2K
Atheros
Avira
Camera Assistant Software for Toshiba
CardDetector
CCleaner
ComPlus Applications
DIFX
eBay
eclipse
Fichiers communs
Google
InstallShield Installation Information
Intel
Internet Explorer
Java
JRE
List_Kill'em
Malwarebytes' Anti-Malware
Messenger
Microsoft
microsoft frontpage
Microsoft Office
Microsoft Office Outlook Connector
Microsoft Visual Studio
Microsoft Visual Studio 8
Microsoft Works
Microsoft.NET
Movie Maker
Mozilla Firefox
MSBuild
MSECache
MSN
MSN Gaming Zone
MSXML 4.0
myphotobook
NetMeeting
Online Services
OpenOffice.org 3
Orange
Outlook Express
PhotoFiltre
Picasa2
Quark
QuickTime
Realtek
Reference Assemblies
Services en ligne
SUPERAntiSpyware
Toshiba
TOSHIBA Games
trend micro
Uninstall Information
VisualLightBox
Windows Desktop Search
Windows Media Player
Windows NT
WindowsUpdate
xerox
Yahoo!
Yooda

============
Drive C:
============

AUTOEXEC.BAT
autorun.inf
boot.ini
Bootfont.bin
CONFIG.SYS
Documents and Settings
hiberfil.sys
I386
Intel
IO.SYS
Kill'em
List'em.txt
MSDOS.SYS
MSOCache
NTDETECT.COM
ntldr
pagefile.sys
Program Files
RECYCLER
renaissance
RHDSetup.log
rsit
SUPPORT
voici le dernier rapport list'em kill.

SWSTAMP.TXT
System Volume Information
Toshiba
UsbFix
UsbFix.txt
VALUEADD
WINDOWS

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

C:\Documents and Settings\Emilie\Mes documents\installation_programmes\Office Professionnel 2007\Serial {Microsoft Office 2007 Pro.}.txt
C:\Program Files\Microsoft Works\Install.exe

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

▶ Relance List&Kill'em (clic droit "exécuter en tant qu'administrateur" pour Vista/Seven) avec le raccourci sur ton bureau ,

mais cette fois-ci :

▶ choisis l'option 2 = Mode Suppression

laisse travailler l'outil.

en fin de scan un rapport s'ouvre

▶ colle le contenu dans ta reponse

...............

question: quand tu as cherché à localiser messenger_setup.exe'

avais tu affiché les dossiers et fichiers cachés comme conseillé

je suis toujours face au même problème et j'ai vraiment besoins d'aide je ne trouve pas l'infection!

as tu fais le post 26 ?

je ne sais plus... quelle était la manip?

je viens de retrouver la manip list'killem en mode suppression, c'est en cours...

voici le rapport

Kill'em by g3n-h@ckm@n 1.2.1.0

User : Emilie (Administrateurs)
Update on 21/01/2010 by g3n-h@ckm@n ::::: 10:30
Start at: 12:10:30 | 14/02/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Atom(TM) CPU N280 @ 1.66GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Disque fixe local | 74,52 Go (54,43 Go free) [XP] | NTFS
D:\ -> Disque fixe local | 73,24 Go (69,44 Go free) [Data] | NTFS
F:\ -> Disque amovible

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\system32\thpsrv.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\CardDetector\HUAWEI160\CardDetector.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe
C:\WINDOWS\system32\ThpSrv.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\TODDSrv.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\IEWInternet\Launcher\Launcher.exe
C:\Program Files\Orange\IEWInternet\systray\systrayapp.exe
C:\Program Files\Orange\IEWInternet\connectivity\connectivitymanager.exe
C:\Program Files\Orange\IEWInternet\PhoneTools\TextMessaging.exe
C:\Program Files\Orange\IEWInternet\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\IEWInternet\Deskboard\deskboard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Emilie\Local Settings\Temp\53.tmp\pv.exe

Detections :
==========

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache

Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\Documents and Settings\Emilie\Application Data\wklnhst.dat
Quarantined & Deleted !! : C:\Documents and Settings\Emilie\Local Settings\Temp\afl.log
Quarantined & Deleted !! : C:\Documents and Settings\Emilie\Local Settings\Temp\alm.log
Quarantined & Deleted !! : C:\Documents and Settings\Emilie\Local Settings\Temp\amt.log
Quarantined & Deleted !! : C:\Documents and Settings\Emilie\Local Settings\Temp\LM.doc
Quarantined & Deleted !! : C:\Documents and Settings\Emilie\LOCAL Settings\Temp\FP_PL_PFS_INSTALLER.exe
Quarantined & Deleted !! : C:\Documents and Settings\Emilie\LOCAL Settings\Temp\SSUPDATE.EXE

==============
host file OK !
==============

========
Registry
========
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe

============
Disk Cleaned
============

================
Prefetch cleaned
================

ok

fais tourner antivir

s'il trouve encore ce fichier infecté arrêtes le..

pour essayer alors de le localiser dans ton pc

• Télécharge seaf.exe de C__XX

http://pagesperso-orange.fr/NosTools/C_XX/SEAF.exe

• Double clique sur SEAF.exe ( clic droit et "Exécuter en tant qu'administrateur" pour Vista)

• Tape messenger_setup.exe dans cette fenêtre blanche et "lancer la recherche"

coches toutes les cases option

• Patiente pendant la recherche.

• Copie/colle le rapport qui va s'ouvrir dans ta prochaine réponse.

un tuto ici pour t'aider

https://forum.pcastuces.com/default.asp

1. ========================= SEAF 1.0.0.7 - C_XX
2.
3. Commencé à: 19:52:38 le 14/02/2010
4.
5. Valeur(s) recherchée(s):
6.
7. messenger_setup.exe
8.
9. (!) --- Affichage des ADS
10. (!) --- Informations supplémentaires
11. (!) --- Recherche registre
12.
13. ====== Fichier(s) (TC: Date de création, TM: Date de modification, DA, Dernier accès) ======
14.
15. Aucun fichier trouvé
16.
17. ====== Dossier(s) (TC: Date de création, TM: Date de modification, DA, Dernier accès) ======
18.
19. Aucun dossier trouvé
20.
21.
22. ====== Entrée(s) du registre ======
23.
24. Aucune entrée du registre trouvée
25.
26. =========================
27.
28. Fin à: 19:54:49 le 14/02/2010 ( E.O.F )

as tu eu encore une aletre d'antivir, car ce messenger_setup.exe est introuvable