Virus: Your protection (rogue)

salut :

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

▶ Télécharge List_Kill'em et enregistre le sur ton bureau

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis l'option Search

un icone blanc et noir va s'afficher sur le bureau , il te servira à relancer le programme par la suite.
un autre rouge et noir te servira a desinstaller le prog a la fin de la desinfection.

▶ laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

Voilou

pdate on 08/04/2010 by g3n-h@ckm@n ::::: 03.30
Start at: 19:59:48 | 08/04/2010

Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Windows Firewall Status : Enabled
AV : Your Protection 1.0 [ Enabled | (!) Outdated ]

C:\ -> Disque fixe local | 452,92 Go (109,78 Go free) | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque CD-ROM
G:\ -> Disque CD-ROM
H:\ -> Disque CD-ROM

Boot: Normal

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\sony\Network Utility\NSUService.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
C:\Program Files\Sony\VAIO Power Management\SPMService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\sony\ISB Utility\ISBMgr.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apntex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\sony\Network Utility\LANUtil.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\sony\SonicStage Mastering Studio\Audio Filter\SSMSFilter.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
NSUFloatingUI REG_SZ "C:\Program Files\Sony\Network Utility\LANUtil.exe"
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe
mplay32xe.exe REG_SZ C:\Windows\TEMP\mplay32xe.exe
Your Protection REG_SZ "C:\Program Files\Your Protection\urpprot.exe" -noscan
hf8wefhuaihf8ewfydiujhfdsfdf REG_SZ C:\Windows\TEMP\ke6b7jyrw.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
RtHDVCpl REG_SZ C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
Apoint REG_SZ C:\Program Files\Apoint\Apoint.exe
ISBMgr.exe REG_SZ "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
StartCCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
AML REG_SZ C:\Program Files\Sony\VAIO Launcher\AML.exe InitApp
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
SearchSettings REG_SZ C:\Program Files\pdfforge Toolbar\SearchSettings.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
ConsentPromptBehaviorAdmin REG_DWORD 2 (0x2)
ConsentPromptBehaviorUser REG_DWORD 1 (0x1)
EnableInstallerDetection REG_DWORD 1 (0x1)
EnableLUA REG_DWORD 0 (0x0)
EnableSecureUIAPaths REG_DWORD 1 (0x1)
EnableVirtualization REG_DWORD 1 (0x1)
PromptOnSecureDesktop REG_DWORD 1 (0x1)
ValidateAdminCodeSignatures REG_DWORD 0 (0x0)
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
scforceoption REG_DWORD 0 (0x0)
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
FilterAdministratorToken REG_DWORD 0 (0x0)
EnableUIADesktopToggle REG_DWORD 0 (0x0)
DisableTaskMgr REG_DWORD 0 (0x0)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoFolderOptions REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
BindDirectlyToPropertySetStorage REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
Userinit REG_SZ C:\Windows\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
AutoRestartShell REG_DWORD 1 (0x1)
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ShutdownWithoutLogon REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
WinStationsDisabled REG_SZ 0
DisableCAD REG_DWORD 1 (0x1)
scremoveoption REG_SZ 0
ShutdownFlags REG_DWORD 43 (0x2b)

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

===============

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{A9BA40A1-74F1-52BD-F431-00B15A2C8953}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: NameServer=212.27.54.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C44FB254-24B4-4A59-BF3B-2076B8BAD566}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: NameServer=212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C44FB254-24B4-4A59-BF3B-2076B8BAD566}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: NameServer=212.27.54.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C44FB254-24B4-4A59-BF3B-2076B8BAD566}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/webhp?gws_rd=ssl
Local Page REG_SZ C:\Windows\system32\blank.htm
Default_Page_URL REG_SZ https://www.google.com/webhp?gws_rd=ssl
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/webhp?gws_rd=ssl
Local Page REG_SZ C:\Windows\system32\blank.htm
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
Wlansvc : 0x2 ( OK = 2 )
SharedAccess : 0x4 ( OK = 2 )
windefend : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )
wscsvc : 0x4 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\drivers\atapi.sys
##
21560,2d9c903dc76a66813d350a562de40ed9,82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3,C:\Windows\System32\drivers\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
##
19944,1f05b78ab91c9075565a9d8a4b880bc4,737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd,C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
##
19048,4f4fcb8b6ea06784fb6d475b7ec7300f,6202d85c9a75e3f01f5f94f069c4cd8a2b9295a182301eae5940ec3bc2c1d896,C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
##
21560,2d9c903dc76a66813d350a562de40ed9,82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3,C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
##
21560,2d9c903dc76a66813d350a562de40ed9,82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3,C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
##
19944,1f05b78ab91c9075565a9d8a4b880bc4,737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd,C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

=======
Drive :
=======

D'fragmenteur de disque Windows
Copyright (c) 2006 Microsoft Corp.

Rapport d'analyse pour le volume C:

Taille du volume = 453 Go
Espace libre = 110 Go
tendue d'espace libre la plus grande = 65.44 Go
Pourcentage de fragmentation des fichiers = 3 %

Remarqueÿ: sur les volumes NTFS, les fragments de fichiers de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.

Il n'est pas n'cessaire de d'fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\ProgramData\_VOIDmfeklnmal.dll
Present !! : C:\ProgramData\_VOIDmfeklnmal.dll
Present !! : C:\ProgramData\_VOIDmfeklnmal.dll
Present !! : C:\Program Files\Your Protection
Present !! : C:\Users\Jordy\AppData\Local\d3d9caps.dat
Present !! : C:\Users\Jordy\AppData\Local\GDIPFONTCACHEV1.DAT
Present !! : C:\Users\Jordy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Your Protection
Present !! : C:\Users\Jordy\downloads\setup.exe
Present !! : C:\Users\Jordy\Local Settings\Temp\044.exe
Present !! : C:\Users\Jordy\Local Settings\Temp\1.ico
Present !! : C:\Users\Jordy\Local Settings\Temp\2.ico
Present !! : C:\Users\Jordy\Local Settings\Temp\3.ico
Present !! : C:\Users\Jordy\Local Settings\Temp\864.exe
Present !! : C:\Users\Jordy\Local Settings\Temp\alm.log
Present !! : C:\Users\Jordy\Local Settings\Temp\amt.log
Present !! : C:\Users\Jordy\Local Settings\Temp\urp.dat
Present !! : C:\Users\Jordy\Local Settings\Temp\_VOIDmainqt.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\044.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\864.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\AdobeAIRInstaller.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\AutoRun.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\eauninstall.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5782.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5DE8.EXE
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUADCC.EXE
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC7C1.EXE
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\Hammer0.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\jre-6u15-windows-i586-iftw.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\The Battle for Middle-earth II_uninst.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP5C81.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\Uninstaller.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\_is1545.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\_is6789.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\_is9E3C.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\_isD8AD.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\urp.dat
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\urpr.dat
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\AutoRunGUI.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\comver.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dialogs.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7340007.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7370014.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7410004.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5A4F.DLL
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5F4F.DLL
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC0EF.DLL
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC9C4.DLL
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\gtapi.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\_VOIDmainqt.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP28D4.tmp
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP85E1.tmp

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\hf8wefhuaihf8ewfydiujhfdsfdf
Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\mplay32xe.exe
Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\your protection
Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SearchSettings
Present !! : HKU\S-1-5-21-2582767111-3107744122-1024548549-1000\Software\Microsoft\Windows\CurrentVersion\Run\hf8wefhuaihf8ewfydiujhfdsfdf
Present !! : HKU\S-1-5-21-2582767111-3107744122-1024548549-1000\Software\Microsoft\Windows\CurrentVersion\Run\mplay32xe.exe
Present !! : HKU\S-1-5-21-2582767111-3107744122-1024548549-1000\Software\Microsoft\Windows\CurrentVersion\Run\your protection
Present !! : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Present !! : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKEY_USERS\S-1-5-21-2582767111-3107744122-1024548549-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
Present !! : "HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings"
Present !! : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B922D405-6D13-4A2B-AE89-08A030DA4402}"
Present !! : "HKLM\Software\Search Settings"
Present !! : HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Present !! : HKCU\SOFTWARE\_VOID
Present !! : HKCU\Software\AppDataLow\Software\pdfforge
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4}
Present !! : HKLM\Software\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Present !! : HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\76DA9915C36F3D742951F63351CF5C97
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9B0B0584E80456A4FB98DA3973B1EB3F
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A89F1E0FE544529429C8BF82FE74CE39
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\C9667115F6A9CE340B31B63B680FF26F
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EFB70E89C3D6D354596520DE424F89D6
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\F49A213B5069AC348994D03F81B56C19
Present !! : HKLM\Software\pdfforge
Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NPF
Present !! : HKLM\SYSTEM\ControlSet001\Services\npf
Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_NPF
Present !! : HKLM\SYSTEM\ControlSet002\Services\npf
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF
Present !! : HKLM\SYSTEM\CurrentControlSet\Services\npf

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-08 20:11:35
Windows 6.0.6002 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys spei.sys >>UNKNOWN [0x85CA3938]<<
kernel: MBR read successfully
user & kernel MBR OK

=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/webhp?gws_rd=ssl
Local Page REG_SZ C:\Windows\System32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.google.com/webhp?gws_rd=ssl
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/webhp?gws_rd=ssl
Local Page REG_SZ C:\Windows\system32\blank.htm
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
cval REG_DWORD 0 (0x0)
AntiVirusDisableNotify REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 20:11:37,01

Merci de m'aider =)

▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :

▶ choisis l'Option Clean

ton PC va redemarrer,

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

▶ colle le contenu dans ta reponse

Kill'em by g3n-h@ckm@n 1.7.0.3

User : Jordy (Administrateurs)
Update on 08/04/2010 by g3n-h@ckm@n ::::: 22.50
Start at: 05:15:07 | 09/04/2010

Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 452,92 Go (111,99 Go free) | NTFS
F:\ -> Disque CD-ROM
G:\ -> Disque CD-ROM
H:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\sony\Network Utility\NSUService.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\runonce.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\cmd.exe
C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
C:\Windows\system32\conime.exe
C:\Program Files\Sony\VAIO Power Management\SPMService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe

Detections :
==========

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Program Files\Your Protection

Quarantined & Deleted !! : C:\Users\Jordy\AppData\Local\d3d9caps.dat
Quarantined & Deleted !! : C:\Users\Jordy\AppData\Local\GDIPFONTCACHEV1.DAT
Quarantined & Deleted !! : C:\Users\Jordy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Your Protection
Quarantined & Deleted !! : C:\Users\Jordy\downloads\setup.exe
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\044.exe
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\1.ico
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\2.ico
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\3.ico
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\317.exe
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\771.exe
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\864.exe
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\alm.log
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\amt.log
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\urp.dat
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\AdobeAIRInstaller.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\AutoRun.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\eauninstall.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5782.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5DE8.EXE
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUADCC.EXE
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC7C1.EXE
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\Hammer0.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\jre-6u15-windows-i586-iftw.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\mplay32xe.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\The Battle for Middle-earth II_uninst.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP5C81.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\Uninstaller.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\wjkedy.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\_is1545.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\_is6789.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\_is9E3C.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\_isD8AD.exe
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\urpr.dat
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\AutoRunGUI.dll
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\comver.dll
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dialogs.dll
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7340007.dll
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7370014.dll
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7410004.dll
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5A4F.DLL
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5F4F.DLL
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC0EF.DLL
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC9C4.DLL
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\gtapi.dll
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP28D4.tmp
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP85E1.tmp
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$I2WO1L1.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$I3UZ53Y.lnk
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$I3YYZSQ.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$I4N8A2B.txt
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IBA61VV.xtm
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IBL1BY0.txt
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IDUW4NV.rar
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IHC1SYO.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IJLPS2G.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IRMF5MJ.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$ISCS5ZQ.xtm
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IVWA8EL.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$R2WO1L1.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$R3UZ53Y.lnk
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$R3YYZSQ.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$R4N8A2B.txt
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RBA61VV.xtm
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RBL1BY0.txt
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RDUW4NV.rar
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RHC1SYO.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RJLPS2G.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RRMF5MJ.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RSCS5ZQ.xtm
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RVWA8EL.avi

==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\mplay32xe.exe
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SearchSettings
Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
Deleted : "HKCU\Software\Malware Defense"
Deleted : "HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings"
Deleted : "HKCU\SOFTWARE\Paladin Antivirus"
Deleted : "HKLM\SOFTWARE\Malware Defense"
Deleted : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B922D405-6D13-4A2B-AE89-08A030DA4402}"
Deleted : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}"
Deleted : "HKLM\SOFTWARE\Paladin Antivirus"
Deleted : "HKLM\Software\Search Settings"
Deleted : HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Deleted : HKCU\SOFTWARE\_VOID
Deleted : HKCU\Software\AppDataLow\Software\pdfforge
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4}
Deleted : HKLM\SOFTWARE\_VOID
Deleted : HKLM\Software\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\76DA9915C36F3D742951F63351CF5C97
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9B0B0584E80456A4FB98DA3973B1EB3F
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A89F1E0FE544529429C8BF82FE74CE39
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\C9667115F6A9CE340B31B63B680FF26F
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EFB70E89C3D6D354596520DE424F89D6
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\F49A213B5069AC348994D03F81B56C19
Deleted : HKLM\Software\pdfforge
Deleted : HKLM\SYSTEM\ControlSet001\Services\_VOIDd.sys
Deleted : HKLM\SYSTEM\ControlSet001\Services\npf
Deleted : HKLM\SYSTEM\ControlSet002\Services\_VOIDd.sys
Deleted : HKLM\SYSTEM\ControlSet002\Services\npf
Deleted : HKLM\SYSTEM\CurrentControlSet\Services\_VOIDd.sys
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
cval REG_DWORD 0 (0x0)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirstRunDisabled REG_DWORD 1 (0x1)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)
========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Wlansvc : Start = 2
SharedAccess : Start = 2
windefend : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
============

=================
anti-ver blaster : OK !!
=================

================
Prefetch cleaned
================

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

au fait c'est normal que des périphériques se désactivent ( je pense a la batterie qui déconne et a la souris aussi )

essaie avec une autre souris pour certitude

Télécharge OTL de OLDTimer

▶ enregistre le sur ton Bureau.

▶ Double clic ( pour vista / 7 => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

▶ Coche les 2 cases Lop et Purity

▶ Coche la case devant scan all users

▶ règle-le sur "60 Days"

▶ dans la moitié gauche , mets tout sur "all"

ne modifie pas ceci :

"files created whithin" et "files modified whithin"

▶Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

▶▶▶ NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier ci-dessus.

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

▶ Copie ce lien dans ta réponse.

▶▶ Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.

http://www.cijoint.fr/cjlink.php?file=cj201004/cijwGst3Na.txt

http://www.cijoint.fr/cjlink.php?file=cj201004/cijFbWw6wh.txt

voilou

▶ Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
* - Coche Afficher les fichiers et dossiers cachés
* - Décoche Masquer les extensions des fichiers dont le type est connu
* - Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)

▶ clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

* Clique sur Parcourir en haut, choisis Poste de travail et cherche ces fichiers :

C:\Windows\System32\drivers\ihazni.sys


* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
* Une nouvelle fenêtre de ton navigateur va apparaître
* Clique alors sur les deux fleches
* Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
* Enfin colle le résultat dans ta prochaine réponse.

Note : Pour analyser un autre fichier, clique en bas sur Autre fichier.

ensuite :

▶ clic droit "executer en tant qu'administrateur" sur OTL.exe pour le lancer.

▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous Customs Scans/Fixes :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O20 - HKLM Winlogon: TaskMan - (C:\Users\Jordy\csrss.exe) - C:\Users\Jordy\csrss.exe ()

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"iTunesHelper"=-
"QuickTime Task"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your Protection]

:Files
C:\Users\Jordy\Desktop\Your Protection Support.lnk
C:\Users\Jordy\Desktop\Your Protection.lnk
C:\Users\Jordy\csrss.exe
C:\Users\Jordy\AppData\Roaming\wklnhst.dat

:commands
[emptytemp]
[start explorer]
[reboot]


▶ Clique sur RunFix pour lancer la suppression.

▶ Poste le rapport.

y'a une erreur quand j'essaie d'envoyer ihazni.sys sur virus total.
Une boite de message s'affiche et indique:
"ihazni.sys , un périphérique attaché au système ne fonctionne par correctement"

essaie de le copier sur ton bureau et de retenter une analyse avec la copie

Copie impossible.
Impossible de lire a partir du fichier ou de la disquette source.

t'es-t-il possible de le zipper ?

non ça créer un fichier zip vide. Pendant l'opération de zippage une console d'erreur s'affiche avec le même diagnostique qu'auparavant"un périphérique attaché au système ne fonctionne par correctement"

ok passe à la suite on y reviendra

voilà le rapport:

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Sinon OTL a planté pendant l'opération, j'ai arreté l'ordinateur et j'ai eu bcp de mal a le rallumer. Voila la description de l'arret non planifié :
Signature du problème :
Nom d'événement de problème: BlueScreen
Version du système: 6.0.6002.2.2.0.768.3
Identificateur de paramètres régionaux: 1036

Informations supplémentaires sur le problème :
BCCode: 1000007e
BCP1: C0000005
BCP2: 807D4C48
BCP3: 8BB673B0
BCP4: 8BB670AC
OS Version: 6_0_6002
Service Pack: 2_0
Product: 768_1

Fichiers aidant à décrire le problème :
C:\Windows\Minidump\Mini040910-01.dmp
C:\Users\Jordy\AppData\Local\Temp\WER-80980-0.sysdata.xml
C:\Users\Jordy\AppData\Local\Temp\WER733B.tmp.version.txt

ok retente la manip avec OTL en mode sans echec stp

OTL plante plus mais le redémarrage échoue. Je dirais même plus que le démarrage échoue systématiquement ensuite (sauf quand je lance l'ordi en mode sans echec).

Signature du problème :
Nom d'événement de problème: BlueScreen
Version du système: 6.0.6002.2.2.0.768.3
Identificateur de paramètres régionaux: 1036

Informations supplémentaires sur le problème :
BCCode: 1000007e
BCP1: C0000005
BCP2: 807D1C48
BCP3: 8BB673B0
BCP4: 8BB670AC
OS Version: 6_0_6002
Service Pack: 2_0
Product: 768_1

Fichiers aidant à décrire le problème :
C:\Windows\Minidump\Mini040910-03.dmp
C:\Users\Jordy\AppData\Local\Temp\WER-71635-0.sysdata.xml
C:\Users\Jordy\AppData\Local\Temp\WERA820.tmp.version.txt

ok tu peux m'obtenir le rapport ?

ha voila j'ai réussi a redémarrer.

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Prefs.js: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15 removed from extensions.enabledItems
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\TaskMan:C:\Users\Jordy\csrss.exe deleted successfully.
File C:\Users\Jordy\csrss.exe not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your Protection\ not found.
========== FILES ==========
File\Folder C:\Users\Jordy\Desktop\Your Protection Support.lnk not found.
File\Folder C:\Users\Jordy\Desktop\Your Protection.lnk not found.
File\Folder C:\Users\Jordy\csrss.exe not found.
File\Folder C:\Users\Jordy\AppData\Roaming\wklnhst.dat not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Jordy
->Temp folder emptied: 28452 bytes
->Temporary Internet Files folder emptied: 2569916 bytes
->Java cache emptied: 50915485 bytes
->FireFox cache emptied: 38508541 bytes
->Flash cache emptied: 25201728 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 47823132 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 449195 bytes

Total Files Cleaned = 158,00 mb

OTL by OldTimer - Version 3.2.1.1 log created on 04092010_180631

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

refais un scan OTL stp