Un virus dans mon antivirus Avast ???

bonjour

• Téléchargez FindyKill ( de El Desaparecido) sur le Bureau.

http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe

Mirroir :

http://findykill.changelog.fr/Setup.exe

• Double-cliquez sur FindyKill présent sur le Bureau.

• Choisissez l'option 1 (Recherche).

• Laissez travailler l'outil.

• Ensuite postez le rapport FindyKill.txt qui apparaîtra (si vous avez créé un sujet sur un forum pour vous faire aider).

• Note : Le rapport FindyKill.txt est sauvegardé à la racine du disque (C:\FindyKill.txt).

(CTRL+A pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller)

• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

• Tuto : http://pagesperso-orange.fr/NosTools/index.html

Merci beaucoup pour ta reponse !
je vais suivre tes conseils !!

Suite a mon probleme j'ai effectué l'analyse avec FindyKill.
Esperant une solution, merci d'avance !
Voici le rapport :

############################## | FindyKill V5.037 |

# User : Christophe (Administrateurs) # CHRISTOP-1BD6A9
# Update on 18/02/2010 by El Desaparecido
# Start at: 17:11:53 | 27/02/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# AMD Athlon(tm) 64 X2 Dual Core Processor 5000+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1368 [VPS 100223-1] 4.8.1368 [ (!) Disabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 78,13 Go (40,19 Go free) # NTFS
# E:\ # Disque amovible
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible
# J:\ # Disque fixe local # 154,76 Go (152,42 Go free) [Données] # NTFS
# K:\ # Disque fixe local # 596,02 Go (419,23 Go free) [VERBATIM] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Christophe\Application Data\drivers\winupgro.exe
C:\Program Files\Fichiers communs\Common Toolkit Suite\AVEngine\AVScanningService.exe
C:\Program Files\Fichiers communs\Common Toolkit Suite\FighterSuiteService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wintems.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

############################## | Processus infectieux stoppés |

"C:\Documents and Settings\Christophe\Application Data\drivers\winupgro.exe" (1268)
"C:\WINDOWS\wintems.exe" (2332)

################## | C: |

################## | C:\WINDOWS |

C:\WINDOWS\ban_list.txt
C:\WINDOWS\mdelk.exe
C:\WINDOWS\wintems.exe

################## | C:\WINDOWS\Prefetch |

C:\WINDOWS\Prefetch\MDELK.EXE-087EF2B4.pf
C:\WINDOWS\Prefetch\WINTEMS.EXE-127B61D4.pf

################## | C:\WINDOWS\system32 |

C:\WINDOWS\system32\srosa2.sys
C:\WINDOWS\system32\wfsintwq.sys

################## | C:\WINDOWS\system32\drivers |

################## | C:\Documents and Settings\Christophe\Application Data |

C:\Documents and Settings\Christophe\Application Data\drivers
C:\Documents and Settings\Christophe\Application Data\drivers\downld
C:\Documents and Settings\Christophe\Application Data\drivers\downld\143625.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\144078.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\144484.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\145578.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\155984.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\156453.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\156859.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\158328.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\167031.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\168359.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\168828.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\169046.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\169328.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\169578.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\169828.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\170093.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\170375.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\171031.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\171703.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\172031.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\172375.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\173046.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\203859.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\204171.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\204453.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\204796.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\205062.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\206187.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\207203.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\207500.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\207796.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\208000.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\208218.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\209656.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\210125.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\210359.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\210625.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\210875.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\211125.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\211781.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\212234.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\212484.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\212765.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\213187.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\213640.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\214656.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\215375.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\215687.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\216031.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\216265.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\216531.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\217203.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\217671.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\218953.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\219953.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\220312.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\220562.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\221015.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\221312.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\221531.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\221859.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\231250.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\231515.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\231953.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\232390.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\232796.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\233234.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\233703.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\234078.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\235531.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\241078.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\241343.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\241656.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\242109.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\242437.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\242656.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\242890.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\243140.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\243390.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\243765.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\244046.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\244484.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\244875.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\245468.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\245906.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\246468.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\247031.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\247984.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\248687.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\249359.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\250062.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\250312.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\250578.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\250968.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\251421.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\251859.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\252281.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\252859.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\253296.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\254296.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\255375.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\255593.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\255828.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\256109.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\256390.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\258375.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\259390.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\260078.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\269687.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\269984.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\270671.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\271218.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\271937.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\272421.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\273125.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\273625.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\274718.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\275453.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\276078.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\276546.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\276765.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\277015.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\278609.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\280109.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\280796.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\281546.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\282218.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\283140.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\283703.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\284296.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\284546.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\284796.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\285078.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\285359.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\285609.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\285875.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\286078.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\286281.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\286562.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\286812.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\288625.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\290156.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\290656.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\291156.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\291453.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\291781.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\292265.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\293609.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\293843.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\294109.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\295109.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\295968.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\296484.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\296921.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\299781.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\301531.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\302015.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\302515.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\302718.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\302937.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\303562.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\304109.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\304328.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\304562.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\305031.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\305531.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\305828.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\306171.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\306390.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\306765.exe
C:\Documents and Settings\Christophe\Application Data\drivers\downld\306953.exe
C:\Documents and Settings\Christophe\Application Data\drivers\winupgro.exe

################## | Temporary Internet Files |

################## | Registre |

[HKLM\SYSTEM\CurrentControlSet\Services\sK9Ou0s]
[HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s]
[HKLM\SYSTEM\ControlSet003\Services\sK9Ou0s]
[HKLM\SYSTEM\CurrentControlSet\Services\srosa]
[HKLM\SYSTEM\ControlSet001\Services\srosa]
[HKLM\SYSTEM\ControlSet003\Services\srosa]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
[HKCU\Software\bisoft]
[HKCU\Software\DateTime4]
[HKCU\Software\WS4001]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
[HKU\S-1-5-21-527237240-1214440339-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
[HKU\S-1-5-21-527237240-1214440339-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
[HKU\S-1-5-21-527237240-1214440339-725345543-1004\Software\bisoft]
[HKU\S-1-5-21-527237240-1214440339-725345543-1004\Software\DateTime4]
[HKCU\Software\Local AppWizard-Generated Applications\key_gen]
[HKCU\Software\Local AppWizard-Generated Applications\winupgro]
[HKU\S-1-5-21-527237240-1214440339-725345543-1004\Software\Local AppWizard-Generated Applications\key_gen]
[HKU\S-1-5-21-527237240-1214440339-725345543-1004\Software\Local AppWizard-Generated Applications\winupgro]

################## | Etat |

# Affichage des fichiers cachés : OK

Clé manquante : HKLM\...\SafeBoot | Mode sans echec non fonctionnel !

# (!) Ndisuio -> Start = 4 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# (!) Ip6Fw -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) SharedAccess -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wuauserv -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wscsvc -> Start = 4 ( Good = 2 | Bad = 4 )

################## | ! Fin du rapport # FindyKill V5.037 ! |

vu

tu peux supprimer immédiatement le crack qui t'a mis ce bazar !!!

1)

! Déconnecte toi et ferme toutes application en cours (navigateur compris ) .

• Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...

• Double clique sur setup.exe présent sur ton bureau pour lancer l’outil.

• Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

• Au second menu choisis l'option 2 (suppression) et tape sur [entrée]

• Le pc va redémarrer automatiquement ...

▶ le programme va travailler, ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

► Poste le rapport qui apparaît à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt)

Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide

.............................

2)

• Télécharge Random's System Information Tool (RSIT) de Random/Random.

(outil de diagnostic)

http://images.malwareremoval.com/random/RSIT.exe

• Enregistre le sur ton Bureau.

• Double clique sur RSIT.exe pour lancer l'outil.

• Clique sur "Continue" à l'écran Disclaimer.

• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande)

et tu devras accepter la licence.

• Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés stp

Les rapports se trouvent à cet endroit:
C:\rsit\info.txt
C:\rsit\log.txt