HELLPPP virus message xp guardian - Page 2

re voila le rapport :

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3872
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

16/03/2010 14:03:30
mbam-log-2010-03-16 (14-03-21).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Eléments examinés: 205196
Temps écoulé: 1 hour(s), 45 minute(s), 26 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 12
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 15

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a3ba40a2-74f0-42bd-f434-00b15a2c8953} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a3ba40a2-74f0-42bd-f434-00b15a2c8953} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\Software\Malware Defense (Rogue.MalwareDefense) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\_VOID (Rootkit.TDSS) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\_VOIDd.sys (Rootkit.TDSS) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Paladin Antivirus (Rogue.PaladinAntivirus) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Paladin Antivirus (Rogue.PaladinAntivirus) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense (Rogue.MalwareDefense) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\ROUA3O12PW (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\TOY5KNQ8OC (Trojan.FakeAlert) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{a3ba40a2-74f0-42bd-f434-00b15a2c8953} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\forceclassiccontrolpanel (Hijack.ControlPanelStyle) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (secfile) Good: (exefile) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Invité\Local Settings\Temp\_VOID7383.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Invité\Local Settings\Temp\_VOID7930.tmp (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Invité\Local Settings\Temp\_VOID7e51.tmp (Rootkit.TDSS) -> No action taken.
C:\Documents and Settings\Invité\Local Settings\Temp\_VOID7efc.tmp (Rootkit.TDSS) -> No action taken.
C:\Documents and Settings\Invité\Local Settings\Temp\_VOID8045.tmp (Rootkit.TDSS) -> No action taken.
C:\Documents and Settings\keemy\Local Settings\Temp\_VOID7932.tmp (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\_VOIDkbocntjlhb.dll (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\_VOIDlgxmjdmogy.dll (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\_VOIDtfnldoultl.dll (Rootkit.TDSS) -> No action taken.
C:\Documents and Settings\All Users\Application Data\mswintmp.dat (Malware.Trace) -> No action taken.
C:\Documents and Settings\All Users\Application Data\_VOIDkrl32mainweq.dll (Rootkit.TDSS) -> No action taken.
C:\Documents and Settings\All Users\Application Data\_VOIDmainqt.dll (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\_VOIDvmyniqgrvt.dat (Rootkit.TDSS) -> No action taken.
C:\Documents and Settings\keemy\Local Settings\Temp\_VOIDb78a.tmp (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.

voici le rapport combofix

ComboFix 10-03-16.05 - keemy 17/03/2010 18:18:59.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.958.596 [GMT 1:00]
Lancé depuis: c:\documents and settings\keemy\Bureau\ComboFix.exe
AV: Trend Micro Internet Security *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: Pare-feu personnel Trend Micro *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1660163187-7360307294-371064680-9918
c:\recycler\S-1-5-21-7262364519-5484560398-323761058-8417
c:\recycler\S-1-5-21-8311700388-7490470563-326890603-1011
c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
c:\windows\system32\driVERs\bguno.sys
c:\windows\system32\install.exe
c:\windows\system32\msconfig.exe
H:\Autorun.inf

Une copie infectée de c:\windows\system32\srsvc.dll a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\srsvc.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS
-------\Legacy_bguno
-------\Service_bguno

((((((((((((((((((((((((((((( Fichiers créés du 2010-02-17 au 2010-03-17 ))))))))))))))))))))))))))))))))))))
.

2010-03-16 10:44 . 2010-03-16 10:44 -------- d-----w- c:\documents and settings\keemy\Application Data\Malwarebytes
2010-03-16 10:44 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-16 10:44 . 2010-03-16 10:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-16 10:44 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-14 14:49 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-14 14:33 . 2010-03-14 14:33 -------- d-----w- c:\windows\system32\MpEngineStore
2010-03-13 15:32 . 2010-03-13 15:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Zylom
2010-03-12 06:43 . 2010-03-12 06:43 -------- d-----w- c:\documents and settings\Invité.PCTITAN
2010-03-02 22:21 . 2010-03-02 22:21 -------- d-----w- c:\documents and settings\keemy\Application Data\dvdcss
2010-03-01 12:50 . 2010-03-01 12:50 50354 ----a-w- c:\documents and settings\keemy\Application Data\Facebook\uninstall.exe
2010-03-01 12:50 . 2010-03-01 12:50 -------- d-----w- c:\documents and settings\keemy\Application Data\Facebook
2010-02-26 06:41 . 2010-02-26 06:41 847040 ----a-w- c:\documents and settings\keemy\Application Data\Facebook\axfbootloader.dll
2010-02-26 06:41 . 2010-02-26 06:41 5582848 ----a-w- c:\documents and settings\keemy\Application Data\Facebook\npfbplugin_1_0_3.dll
2010-02-24 03:53 . 2010-02-24 03:53 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-02-24 03:53 . 2010-02-24 03:53 -------- d-----w- c:\program files\NOS
2010-02-24 02:04 . 2010-02-24 02:01 59920 ----a-w- c:\windows\system32\drivers\tmactmon.sys
2010-02-24 02:04 . 2010-02-24 02:01 50704 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
2010-02-24 02:04 . 2010-02-24 02:01 158224 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-02-24 02:02 . 2010-02-24 03:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Trend Micro
2010-02-24 02:02 . 2010-02-24 02:04 -------- d-----w- c:\program files\Trend Micro
2010-02-24 02:01 . 2010-02-24 02:01 89872 ----a-w- c:\windows\system32\drivers\tmtdi.sys
2010-02-24 02:01 . 2010-02-24 02:01 36368 ----a-w- c:\windows\system32\drivers\tmpreflt.sys
2010-02-24 02:01 . 2010-02-24 02:01 339984 ----a-w- c:\windows\system32\drivers\TM_CFW.sys
2010-02-24 02:01 . 2010-02-24 02:01 225808 ----a-w- c:\windows\system32\drivers\tmxpflt.sys
2010-02-24 02:01 . 2010-02-24 02:01 1223832 ----a-w- c:\windows\system32\drivers\vsapint.sys
2010-02-23 17:43 . 2010-02-23 17:47 -------- d-----w- C:\audacity_1_2_temp
2010-02-23 17:24 . 2010-02-19 18:31 31936 ----a-w- c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-02-23 17:24 . 2010-02-19 18:31 29344 ----a-w- c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-02-22 15:00 . 2010-02-22 15:00 -------- d-----w- c:\windows\system32\drivers\NIS
2010-02-22 14:47 . 2010-02-22 14:47 -------- d-----w- c:\documents and settings\All Users\Application Data\PCSettings
2010-02-22 01:37 . 2010-02-22 01:37 -------- d-----w- c:\documents and settings\keemy\Local Settings\Application Data\Help
2010-02-21 16:34 . 2010-02-11 18:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-21 16:34 . 2010-02-11 18:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-21 16:34 . 2010-02-11 18:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-21 16:34 . 2010-02-11 18:39 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-21 16:34 . 2010-02-11 18:38 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-21 16:34 . 2010-02-11 18:38 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-21 16:34 . 2010-02-11 18:38 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-21 16:34 . 2010-02-11 18:53 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-02-21 16:34 . 2010-02-11 18:53 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-21 16:06 . 2010-02-21 16:06 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-02-21 16:01 . 2010-02-21 16:01 -------- d-----w- c:\program files\CCleaner
2010-02-21 04:06 . 2010-02-21 05:11 -------- d-----w- c:\program files\a-squared Free
2010-02-21 03:13 . 2010-02-21 03:31 -------- d-----w- c:\windows\system32\drivers\NAV
2010-02-21 03:13 . 2010-02-21 03:13 -------- d-----w- c:\program files\Windows Sidebar
2010-02-21 03:13 . 2010-02-23 01:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-02-21 03:13 . 2010-02-22 15:02 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-02-21 02:40 . 2010-03-16 10:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-20 19:08 . 2010-02-20 19:08 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-02-20 19:08 . 2010-02-20 19:08 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-02-20 19:08 . 2010-02-20 19:08 -------- d-----w- c:\program files\McAfee Security Scan
2010-02-20 16:29 . 2010-02-23 01:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-20 03:18 . 2009-12-16 15:05 471040 ----a-w- c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll
2010-02-20 03:18 . 2009-12-16 15:05 347136 ----a-w- c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-02-20 03:18 . 2009-12-16 15:05 340992 ----a-w- c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-02-20 03:18 . 2009-12-16 15:05 43008 ----a-w- c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-02-20 03:18 . 2009-12-16 15:05 1452032 ----a-w- c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-02-20 02:32 . 2010-02-20 02:32 -------- d-----w- c:\documents and settings\keemy\Application Data\Yahoo!
2010-02-20 02:32 . 2010-02-20 02:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-02-20 02:32 . 2010-02-20 02:32 -------- d-----w- c:\program files\Yahoo!
2010-02-20 02:14 . 2010-02-20 02:14 -------- d-----w- c:\documents and settings\keemy\Local Settings\Application Data\Google
2010-02-20 02:13 . 2010-02-20 02:13 -------- d-----w- c:\documents and settings\keemy\Local Settings\Application Data\Mozilla
2010-02-20 02:02 . 2010-02-24 01:42 -------- d-----w- c:\documents and settings\Invité
2010-02-20 01:45 . 2010-02-20 01:45 -------- d-----w- C:\2356729980481e854c2a5ed6
2010-02-20 01:31 . 2010-02-20 01:31 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-02-20 01:29 . 2010-02-20 01:29 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-16 01:52 . 2010-02-16 01:52 -------- d-----w- c:\program files\iPod
2010-02-16 01:52 . 2010-02-16 01:52 -------- d-----w- c:\program files\iTunes
2010-02-16 01:52 . 2010-02-16 01:52 -------- d-----w- c:\program files\Bonjour
2010-02-16 01:51 . 2010-02-16 01:52 -------- d-----w- c:\program files\QuickTime
2010-02-16 01:51 . 2010-02-16 01:51 -------- d-----w- c:\program files\Apple Software Update
2010-02-16 01:51 . 2009-08-28 18:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2010-02-16 01:51 . 2009-08-28 18:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-02-15 17:52 . 2010-02-15 17:52 -------- d-----w- c:\program files\Fichiers communs\xing shared

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-16 18:30 . 2010-02-15 15:31 -------- d-----w- c:\documents and settings\keemy\Application Data\vlc
2010-03-13 14:37 . 2009-11-24 02:34 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-24 01:38 . 2009-11-20 00:09 16208 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-22 02:06 . 2010-02-14 22:14 16208 ----a-w- c:\documents and settings\keemy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-21 16:34 . 2010-02-14 16:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-02-16 01:52 . 2009-12-05 01:16 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-02-15 17:52 . 2007-08-23 00:22 -------- d-----w- c:\program files\Fichiers communs\Real
2010-02-15 17:51 . 2007-08-22 21:28 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-02-15 17:51 . 2007-08-22 21:28 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-02-15 04:48 . 2010-02-14 22:52 -------- d-----w- c:\documents and settings\keemy\Application Data\Apple Computer
2010-02-15 04:15 . 2010-02-14 23:20 -------- d-----w- c:\documents and settings\keemy\Application Data\Nokia
2010-02-14 23:24 . 2010-02-14 23:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia
2010-02-14 23:24 . 2009-11-24 02:18 -------- d-----w- c:\program files\Fichiers communs\Nokia
2010-02-14 23:24 . 2009-11-24 02:16 -------- d-----w- c:\program files\Nokia
2010-02-14 23:23 . 2010-02-14 23:23 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\msxml6Exec.exe
2010-02-14 23:23 . 2010-02-14 23:23 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\Sleep.exe
2010-02-14 23:23 . 2010-02-14 23:23 3203453 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\vcredistExec.exe
2010-02-14 23:23 . 2010-02-14 23:24 24443520 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\NokiaSoftwareUpdaterSetup_fr[1].exe
2010-02-14 23:23 . 2009-11-24 02:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2010-02-14 23:21 . 2010-02-14 23:20 -------- d-----w- c:\documents and settings\keemy\Application Data\PC Suite
2010-02-14 22:58 . 2010-02-14 22:58 -------- d-----w- c:\program files\Safari
2010-02-14 22:54 . 2010-02-14 22:54 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
2010-02-14 22:14 . 2010-02-14 22:14 86576 ----a-w- c:\documents and settings\keemy\Application Data\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe
2010-02-14 22:14 . 2010-02-14 22:14 392728 ----a-w- c:\documents and settings\keemy\Application Data\Microsoft\Services Windows Live\Services Windows Live.dll
2010-02-14 22:14 . 2010-02-14 22:14 135680 ----a-w- c:\documents and settings\keemy\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
2010-02-14 22:14 . 2010-02-14 22:14 132672 ----a-w- c:\documents and settings\keemy\Application Data\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe
2010-02-14 16:05 . 2009-12-16 03:41 -------- d-----w- c:\program files\Alwil Software
2010-02-13 15:44 . 2009-12-06 02:01 33558 ----a-w- c:\documents and settings\All Users\Application Data\Google\Toolbar for Firefox\Firefox_Toolbar_Uninstaller.exe
2010-02-13 05:01 . 2009-11-24 05:04 -------- d-----w- c:\documents and settings\Administrateur\Application Data\vlc
2010-01-22 18:51 . 2010-01-22 18:51 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-01-20 15:35 . 2009-12-05 02:06 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-19 04:11 . 2010-01-19 04:11 -------- d-----w- c:\program files\AbiSuite2
2010-01-19 03:44 . 2010-01-19 03:44 -------- d-----w- c:\program files\Abdio
2010-01-18 19:58 . 2009-12-05 01:17 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Apple Computer
2010-01-13 14:28 . 2010-01-13 14:28 79856 ----a-w- c:\documents and settings\All Users\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\uninstaller.exe
2009-12-31 16:50 . 2005-07-09 19:40 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 06:23 . 2009-12-22 06:23 9556 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-21 19:07 . 2005-07-09 19:41 916480 ----a-w- c:\windows\system32\wininet.dll
.

------- Sigcheck -------

[7] 2008-04-14 . E598D81197E2E0EC42A0C55772BB00E8 . 59904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\regsvc.dll
[7] 2008-04-13 . E598D81197E2E0EC42A0C55772BB00E8 . 59904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regsvc.dll
[7] 2004-08-19 . B6F76CE10953A141545A0D01F1776885 . 59904 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regsvc.dll

c:\windows\System32\regsvc.dll ... manque !!
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-30 1182088]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-30 1182088]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2010-01-26 1020248]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^keemy^Menu Démarrer^Programmes^Démarrage^Notification de cadeaux MSN.lnk]
path=c:\documents and settings\keemy\Menu Démarrer\Programmes\Démarrage\Notification de cadeaux MSN.lnk
backup=c:\windows\pss\Notification de cadeaux MSN.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 18:34 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [21/02/2010 17:34 162512]
R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [21/02/2010 05:06 1858144]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [24/02/2010 03:01 36368]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [24/02/2010 03:01 339984]
R3 TmPfw;Trend Micro Personal Firewall;c:\program files\Trend Micro\Internet Security\TmPfw.exe [24/02/2010 03:04 497008]
R3 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [24/02/2010 03:04 689416]
S2 aswFsBlk;aswFsBlk;aswFsBlk.sys --> aswFsBlk.sys [?]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 14:50 238960]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 13:49 227232]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [24/11/2009 03:17 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [24/11/2009 03:17 8320]
S3 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [24/02/2010 03:04 50704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contenu du dossier 'Tâches planifiées'

2010-02-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-03-17 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-23 02:51]

2010-03-17 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-09-30 09:40]

2010-03-17 c:\windows\Tasks\User_Feed_Synchronization-{77A97E75-0666-4149-8C59-067723B20DB3}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]

2010-03-17 c:\windows\Tasks\User_Feed_Synchronization-{EDA7F3CF-E7C9-4527-B274-74BC70021070}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Examen supplémentaire -------
.
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\
FF - component: c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll
FF - component: c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\keemy\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\documents and settings\keemy\Application Data\Mozilla\Firefox\Profiles\tmh7r4ov.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-17 18:29
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(3496)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_fre.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Trend Micro\Internet Security\SfCtlCom.exe
c:\program files\Nokia\PC Connectivity Solution\ServiceLayer.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Nokia\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\Nokia\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Heure de fin: 2010-03-17 18:32:46 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-03-17 17:32

Avant-CF: 171 953 520 640 octets libres
Après-CF: 175 477 776 384 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
h:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 0A3727B55419B77DB7BA5A44FA4FEE26

non c'est bon tout est rentré dans l' ordre merci beaucoup de ton aide tu est le best !!!!

bizzarement dasn proprétés systèmes je n'ai pas l'onglet restauration systeme

bon ben j'ai fais different scan qui ne trouve aucune infection donc je ne vais pas t'embeter plus longtemp je te remercie enormement de m'avoir aidé et d'avoir pris le temp de m' expliquer point par point les differentes etapes afin de regler mon probleme. merci tu est le best !!!!

Salut maelys011

Je devais être dans les patates quand je t'ai demandé un nouveau scan...

Comment va le PC, as-tu d'autre souci?

@++ :)

Salut maelys011

Pour des raisons de sécurité et surtout pour garder ton PC propre, on va désactiver la restauration système sur tous les lecteurs :

- Clique droit sur le Poste de travail sur le bureau, dans propriété tu cliques sur l'onglet Restauration système

- Coche la case désactiver la restauration et applique

Redémarre l'ordinateur et réactive la restauration système.

Tutoriel XP : http://www.libellules.ch/desactiver_restauration.php

Tutoriel Vista : https://www.commentcamarche.net/faq/13214-vista-desactiver-reactiver-la-restauration-systeme-de-vista

Tutoriel Seven :
https://www.commentcamarche.net/informatique/windows/147-restaurer-windows-avec-les-points-de-restauration/

-----

On va faire un ménage des outils téléchargés pour la désinfection, télécharge Tools Cleaner sur le bureau :

http://pc-system.fr/

- Double clique sur ToolsCleaner2.exe sur le bureau
- Clique sur Recherche et laisse le scan agir.
- Clique sur Suppression pour finaliser.
- Tu peux, si tu le souhaites, te servir des Options facultatives.
- Clique sur Quitter pour obtenir le rapport.
- Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
- Si des outils restes après le passage de Tools Cleaner, tu pourras les supprimer manuellement ainsi que tous les rapports qui on été généré lors de la désinfection.

-----

Important de mettre à jour Windows et tes logiciels :
Mettre Windows(catégories critique, Services Pack et Services Release) à jour : http://www.windowsupdate.com/windowsupdate/v6/default.aspx

Faire un scan de vulnérabilités afin de vérifier que tes logiciels soit à jour sans failles de sécurités et mettre à jour :
https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/

Faire un ménage des fichiers inutiles et de la base de registre :
https://www.malekal.com/tutoriel-ccleaner/

Dis moi quand cela est fais où si tu as des soucis et on passe à la résolution du sujet par la suite.

@++ :)

toolcleaner ne fonctionne pas quand je double clique il m' indique srclient.dll est introuvable ???

Salut maelys011

Télécharge SystemLook sur ton Bureau :
http://jpshortstuff.247fixes.com/SystemLook.exe

- Double-clique sur SystemLook.exe pour le lancer.

- Copie le contenu en gras ci-dessous et colle-le dans la zone texte de SystemLook :

:filefind
srclient.dll

- Clique sur le bouton Look pour démarrer l'examen.
- A la fin, le Bloc-notes s'ouvre avec le résultat de l'analyse. Copie-colle le rapport dans ta prochaine réponse.

@++ :)

Salut maelys011

Fais un copier/coller de ce fichier :
C:\WINDOWS\ServicePackFiles\i386\srclient.dll

Dans ce dossier :
c:\windows\system32

Essai de nouveau avec ToolsCleaner

@++ :)