Virus: Your protection (rogue) Fermé

Question

Plusieurs gentils virus ont décider de squatter mon ordi. Y'en a un qui m'a installé des icônes porntube sur le bureau. L'autre a commencé par désactiver le pare feu window pour en créer un faux ensuite. Il se présente aussi sous la forme d'un faux antivirus payant qui fait sa pub a coup de fausses notifications et de pub intempestives. J'ai essayé de restaurer le système à une date antérieure mais il semble qu'il ait aussi bloqué ce processus la.
I need a medic please !

Configuration: Windows Vista / Firefox 3.5.9

gen-hackman · Answer

salut :

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

&#9654 Télécharge List_Kill'em et enregistre le sur ton bureau 

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis l'option Search

un icone blanc et noir va s'afficher sur le bureau , il te servira à relancer le programme par la suite.
un autre rouge et noir te servira a desinstaller le prog a la fin de la desinfection.

&#9654 laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

&#9654 Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

Tojo · Answer

Voilou

pdate on 08/04/2010 by g3n-h@ckm@n ::::: 03.30
Start at: 19:59:48 | 08/04/2010

Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Windows Firewall Status : Enabled
AV : Your Protection 1.0 [ Enabled | (!) Outdated ]

C:\ -> Disque fixe local | 452,92 Go (109,78 Go free) | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque CD-ROM
G:\ -> Disque CD-ROM
H:\ -> Disque CD-ROM

Boot: Normal

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\sony\Network Utility\NSUService.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
C:\Program Files\Sony\VAIO Power Management\SPMService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\sony\ISB Utility\ISBMgr.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apntex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\sony\Network Utility\LANUtil.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\sony\SonicStage Mastering Studio\Audio Filter\SSMSFilter.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
NSUFloatingUI REG_SZ "C:\Program Files\Sony\Network Utility\LANUtil.exe"
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe
mplay32xe.exe REG_SZ C:\Windows\TEMP\mplay32xe.exe
Your Protection REG_SZ "C:\Program Files\Your Protection\urpprot.exe" -noscan
hf8wefhuaihf8ewfydiujhfdsfdf REG_SZ C:\Windows\TEMP\ke6b7jyrw.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
RtHDVCpl REG_SZ C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
Apoint REG_SZ C:\Program Files\Apoint\Apoint.exe
ISBMgr.exe REG_SZ "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
StartCCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
AML REG_SZ C:\Program Files\Sony\VAIO Launcher\AML.exe InitApp
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
SearchSettings REG_SZ C:\Program Files\pdfforge Toolbar\SearchSettings.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
ConsentPromptBehaviorAdmin REG_DWORD 2 (0x2)
ConsentPromptBehaviorUser REG_DWORD 1 (0x1)
EnableInstallerDetection REG_DWORD 1 (0x1)
EnableLUA REG_DWORD 0 (0x0)
EnableSecureUIAPaths REG_DWORD 1 (0x1)
EnableVirtualization REG_DWORD 1 (0x1)
PromptOnSecureDesktop REG_DWORD 1 (0x1)
ValidateAdminCodeSignatures REG_DWORD 0 (0x0)
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
scforceoption REG_DWORD 0 (0x0)
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
FilterAdministratorToken REG_DWORD 0 (0x0)
EnableUIADesktopToggle REG_DWORD 0 (0x0)
DisableTaskMgr REG_DWORD 0 (0x0)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoFolderOptions REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
BindDirectlyToPropertySetStorage REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
Userinit REG_SZ C:\Windows\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
AutoRestartShell REG_DWORD 1 (0x1)
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ShutdownWithoutLogon REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
WinStationsDisabled REG_SZ 0
DisableCAD REG_DWORD 1 (0x1)
scremoveoption REG_SZ 0
ShutdownFlags REG_DWORD 43 (0x2b)

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

===============

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{A9BA40A1-74F1-52BD-F431-00B15A2C8953}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: NameServer=212.27.54.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C44FB254-24B4-4A59-BF3B-2076B8BAD566}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: NameServer=212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C44FB254-24B4-4A59-BF3B-2076B8BAD566}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9FC43582-197F-4958-AA24-8465DC761A8B}: NameServer=212.27.54.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C44FB254-24B4-4A59-BF3B-2076B8BAD566}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/webhp?gws_rd=ssl
Local Page REG_SZ C:\Windows\system32\blank.htm
Default_Page_URL REG_SZ https://www.google.com/webhp?gws_rd=ssl
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/webhp?gws_rd=ssl
Local Page REG_SZ C:\Windows\system32\blank.htm
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
Wlansvc : 0x2 ( OK = 2 )
SharedAccess : 0x4 ( OK = 2 )
windefend : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )
wscsvc : 0x4 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\drivers\atapi.sys
##
21560,2d9c903dc76a66813d350a562de40ed9,82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3,C:\Windows\System32\drivers\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
##
19944,1f05b78ab91c9075565a9d8a4b880bc4,737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd,C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
##
19048,4f4fcb8b6ea06784fb6d475b7ec7300f,6202d85c9a75e3f01f5f94f069c4cd8a2b9295a182301eae5940ec3bc2c1d896,C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
##
21560,2d9c903dc76a66813d350a562de40ed9,82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3,C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
##
21560,2d9c903dc76a66813d350a562de40ed9,82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3,C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
##
19944,1f05b78ab91c9075565a9d8a4b880bc4,737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd,C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

=======
Drive :
=======

D'fragmenteur de disque Windows
Copyright (c) 2006 Microsoft Corp.

Rapport d'analyse pour le volume C:

Taille du volume = 453 Go
Espace libre = 110 Go
tendue d'espace libre la plus grande = 65.44 Go
Pourcentage de fragmentation des fichiers = 3 %

Remarqueÿ: sur les volumes NTFS, les fragments de fichiers de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.

Il n'est pas n'cessaire de d'fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\ProgramData\_VOIDmfeklnmal.dll
Present !! : C:\ProgramData\_VOIDmfeklnmal.dll
Present !! : C:\ProgramData\_VOIDmfeklnmal.dll
Present !! : C:\Program Files\Your Protection
Present !! : C:\Users\Jordy\AppData\Local\d3d9caps.dat
Present !! : C:\Users\Jordy\AppData\Local\GDIPFONTCACHEV1.DAT
Present !! : C:\Users\Jordy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Your Protection
Present !! : C:\Users\Jordy\downloads\setup.exe
Present !! : C:\Users\Jordy\Local Settings\Temp\044.exe
Present !! : C:\Users\Jordy\Local Settings\Temp\1.ico
Present !! : C:\Users\Jordy\Local Settings\Temp\2.ico
Present !! : C:\Users\Jordy\Local Settings\Temp\3.ico
Present !! : C:\Users\Jordy\Local Settings\Temp\864.exe
Present !! : C:\Users\Jordy\Local Settings\Temp\alm.log
Present !! : C:\Users\Jordy\Local Settings\Temp\amt.log
Present !! : C:\Users\Jordy\Local Settings\Temp\urp.dat
Present !! : C:\Users\Jordy\Local Settings\Temp\_VOIDmainqt.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\044.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\864.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\AdobeAIRInstaller.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\AutoRun.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\eauninstall.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5782.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5DE8.EXE
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUADCC.EXE
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC7C1.EXE
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\Hammer0.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\jre-6u15-windows-i586-iftw.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\The Battle for Middle-earth II_uninst.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP5C81.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\Uninstaller.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\_is1545.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\_is6789.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\_is9E3C.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\_isD8AD.exe
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\urp.dat
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\urpr.dat
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\AutoRunGUI.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\comver.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dialogs.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7340007.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7370014.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7410004.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5A4F.DLL
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5F4F.DLL
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC0EF.DLL
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC9C4.DLL
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\gtapi.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\_VOIDmainqt.dll
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP28D4.tmp
Present !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP85E1.tmp

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\hf8wefhuaihf8ewfydiujhfdsfdf
Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\mplay32xe.exe
Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\your protection
Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SearchSettings
Present !! : HKU\S-1-5-21-2582767111-3107744122-1024548549-1000\Software\Microsoft\Windows\CurrentVersion\Run\hf8wefhuaihf8ewfydiujhfdsfdf
Present !! : HKU\S-1-5-21-2582767111-3107744122-1024548549-1000\Software\Microsoft\Windows\CurrentVersion\Run\mplay32xe.exe
Present !! : HKU\S-1-5-21-2582767111-3107744122-1024548549-1000\Software\Microsoft\Windows\CurrentVersion\Run\your protection
Present !! : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Present !! : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKEY_USERS\S-1-5-21-2582767111-3107744122-1024548549-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
Present !! : "HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings"
Present !! : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B922D405-6D13-4A2B-AE89-08A030DA4402}"
Present !! : "HKLM\Software\Search Settings"
Present !! : HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Present !! : HKCU\SOFTWARE\_VOID
Present !! : HKCU\Software\AppDataLow\Software\pdfforge
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4}
Present !! : HKLM\Software\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Present !! : HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\76DA9915C36F3D742951F63351CF5C97
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9B0B0584E80456A4FB98DA3973B1EB3F
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A89F1E0FE544529429C8BF82FE74CE39
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\C9667115F6A9CE340B31B63B680FF26F
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EFB70E89C3D6D354596520DE424F89D6
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\F49A213B5069AC348994D03F81B56C19
Present !! : HKLM\Software\pdfforge
Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NPF
Present !! : HKLM\SYSTEM\ControlSet001\Services\npf
Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_NPF
Present !! : HKLM\SYSTEM\ControlSet002\Services\npf
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF
Present !! : HKLM\SYSTEM\CurrentControlSet\Services\npf

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-08 20:11:35
Windows 6.0.6002 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys spei.sys >>UNKNOWN [0x85CA3938]<<
kernel: MBR read successfully
user & kernel MBR OK

=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/webhp?gws_rd=ssl
Local Page REG_SZ C:\Windows\System32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.google.com/webhp?gws_rd=ssl
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/webhp?gws_rd=ssl
Local Page REG_SZ C:\Windows\system32\blank.htm
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
cval REG_DWORD 0 (0x0)
AntiVirusDisableNotify REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 20:11:37,01

Tojo · Answer

Merci de m'aider =)

gen-hackman · Answer

&#9654 Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :

&#9654 choisis l'Option Clean

ton PC va redemarrer,

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

&#9654 colle le contenu dans ta reponse

Tojo · Answer

Kill'em by g3n-h@ckm@n 1.7.0.3 
 
User : Jordy (Administrateurs) 
Update on 08/04/2010 by g3n-h@ckm@n ::::: 22.50
Start at: 05:15:07 | 09/04/2010

Intel(R) Core(TM)2 Duo CPU     T6400  @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 452,92 Go (111,99 Go free) | NTFS
F:\ -> Disque CD-ROM
G:\ -> Disque CD-ROM
H:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\sony\Network Utility\NSUService.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32unonce.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\cmd.exe
C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
C:\Windows\system32\conime.exe
C:\Program Files\Sony\VAIO Power Management\SPMService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe
 
Detections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\Program Files\Your Protection 
 
Quarantined & Deleted !! : C:\Users\Jordy\AppData\Local\d3d9caps.dat 
Quarantined & Deleted !! : C:\Users\Jordy\AppData\Local\GDIPFONTCACHEV1.DAT 
Quarantined & Deleted !! : C:\Users\Jordy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Your Protection 
Quarantined & Deleted !! : C:\Users\Jordy\downloads\setup.exe 
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\044.exe 
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\1.ico 
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\2.ico 
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\3.ico 
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\317.exe 
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\771.exe 
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\864.exe 
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\alm.log 
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\amt.log 
Quarantined & Deleted !! : C:\Users\Jordy\Local Settings\Temp\urp.dat 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\AdobeAIRInstaller.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\AutoRun.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\eauninstall.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5782.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5DE8.EXE 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUADCC.EXE 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC7C1.EXE 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\Hammer0.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\jre-6u15-windows-i586-iftw.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\mplay32xe.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\The Battle for Middle-earth II_uninst.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP5C81.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\Uninstaller.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\wjkedy.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\_is1545.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\_is6789.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\_is9E3C.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\_isD8AD.exe 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\urpr.dat 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\AutoRunGUI.dll 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\comver.dll 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dialogs.dll 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7340007.dll 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7370014.dll 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\drm_dyndata_7410004.dll 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5A4F.DLL 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBU5F4F.DLL 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC0EF.DLL 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\EBUC9C4.DLL 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\gtapi.dll 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP28D4.tmp 
Quarantined & Deleted !! : C:\Users\Jordy\LOCAL Settings\Temp\TMP85E1.tmp 
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$I2WO1L1.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$I3UZ53Y.lnk   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$I3YYZSQ.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$I4N8A2B.txt   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IBA61VV.xtm   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IBL1BY0.txt   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IDUW4NV.rar   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IHC1SYO.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IJLPS2G.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IRMF5MJ.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$ISCS5ZQ.xtm   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$IVWA8EL.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$R2WO1L1.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$R3UZ53Y.lnk   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$R3YYZSQ.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$R4N8A2B.txt   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RBA61VV.xtm   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RBL1BY0.txt   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RDUW4NV.rar   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RHC1SYO.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RJLPS2G.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RRMF5MJ.avi   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RSCS5ZQ.xtm   
Deleted !! : C:\$Recycle.bin\S-1-5-21-2582767111-3107744122-1024548549-1000\$RVWA8EL.avi   
 
==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\mplay32xe.exe  
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SearchSettings  
Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B922D405-6D13-4A2B-AE89-08A030DA4402}  
Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr  
Deleted : "HKCU\Software\Malware Defense"  
Deleted : "HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings"  
Deleted : "HKCU\SOFTWARE\Paladin Antivirus"  
Deleted : "HKLM\SOFTWARE\Malware Defense"  
Deleted : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B922D405-6D13-4A2B-AE89-08A030DA4402}"  
Deleted : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}"  
Deleted : "HKLM\SOFTWARE\Paladin Antivirus"  
Deleted : "HKLM\Software\Search Settings"  
Deleted : HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}  
Deleted : HKCU\SOFTWARE\_VOID  
Deleted : HKCU\Software\AppDataLow\Software\pdfforge  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4}  
Deleted : HKLM\SOFTWARE\_VOID  
Deleted : HKLM\Software\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}  
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\76DA9915C36F3D742951F63351CF5C97  
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9B0B0584E80456A4FB98DA3973B1EB3F  
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A89F1E0FE544529429C8BF82FE74CE39  
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\C9667115F6A9CE340B31B63B680FF26F  
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EFB70E89C3D6D354596520DE424F89D6  
Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\F49A213B5069AC348994D03F81B56C19  
Deleted : HKLM\Software\pdfforge  
Deleted : HKLM\SYSTEM\ControlSet001\Services\_VOIDd.sys  
Deleted : HKLM\SYSTEM\ControlSet001\Services
pf  
Deleted : HKLM\SYSTEM\ControlSet002\Services\_VOIDd.sys  
Deleted : HKLM\SYSTEM\ControlSet002\Services
pf  
Deleted : HKLM\SYSTEM\CurrentControlSet\Services\_VOIDd.sys  
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Local Page	REG_SZ         	C:\WINDOWS\system32\blank.htm
Default_Search_URL	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.google.com/?gws_rd=ssl
Local Page	REG_SZ         	C:\WINDOWS\system32\blank.htm
Search Page	REG_SZ         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 
cval	REG_DWORD      	0 (0x0) 
AntiVirusDisableNotify	REG_DWORD      	0 (0x0) 
FirstRunDisabled	REG_DWORD      	1 (0x1) 
FirewallDisableNotify	REG_DWORD      	0 (0x0) 
UpdatesDisableNotify	REG_DWORD      	0 (0x0) 
AntiVirusOverride	REG_DWORD      	1 (0x1) 
FirewallOverride	REG_DWORD      	1 (0x1) 
========
Services
=========

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Wlansvc : Start = 2   
 SharedAccess : Start = 2   
 windefend : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
============
 
=================
anti-ver blaster : OK !! 
=================

================
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 





au fait c'est normal que des périphériques se désactivent ( je pense a la batterie qui déconne et a la souris aussi )

gen-hackman · Answer

essaie avec une autre souris pour certitude

Télécharge OTL de OLDTimer

&#9654 enregistre le sur ton Bureau.

&#9654 Double clic ( pour vista / 7 => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

&#9654 Coche les 2 cases Lop et Purity

&#9654 Coche la case devant scan all users

&#9654 règle-le sur "60 Days"

&#9654 dans la moitié gauche , mets tout sur "all"

ne modifie pas ceci : 

"files created whithin" et "files modified whithin" 

&#9654Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

&#9654&#9654 Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.

Tojo · Answer

http://www.cijoint.fr/cjlink.php?file=cj201004/cijwGst3Na.txt




http://www.cijoint.fr/cjlink.php?file=cj201004/cijFbWw6wh.txt


voilou

gen-hackman · Answer

&#9654 Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
* - Coche    Afficher les fichiers et dossiers cachés
* - Décoche Masquer les extensions des fichiers dont le type est connu
* - Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)

&#9654 clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

    * Clique sur Parcourir en haut, choisis Poste de travail et cherche ces fichiers :

C:\Windows\System32\drivers\ihazni.sys


    * Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
    * Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
    * Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
    * Une nouvelle fenêtre de ton navigateur va apparaître
    * Clique alors sur les deux fleches
    * Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
    * Enfin colle le résultat dans ta prochaine réponse.

Note : Pour analyser un autre fichier, clique en bas sur Autre fichier.

ensuite :

&#9654 clic droit "executer en tant qu'administrateur" sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous Customs Scans/Fixes :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O20 - HKLM Winlogon: TaskMan - (C:\Users\Jordy\csrss.exe) - C:\Users\Jordy\csrss.exe ()

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"iTunesHelper"=-
"QuickTime Task"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your Protection]

:Files
C:\Users\Jordy\Desktop\Your Protection Support.lnk
C:\Users\Jordy\Desktop\Your Protection.lnk
C:\Users\Jordy\csrss.exe
C:\Users\Jordy\AppData\Roaming\wklnhst.dat

:commands
[emptytemp]
[start explorer]
[reboot]


&#9654 Clique sur RunFix pour lancer la suppression.


&#9654 Poste le rapport.

Tojo · Answer

y'a une erreur quand j'essaie d'envoyer ihazni.sys sur virus total.
Une boite de message s'affiche et indique:
"ihazni.sys , un périphérique attaché au système ne fonctionne par correctement"

gen-hackman · Answer

essaie de le copier sur ton bureau et de retenter une analyse avec la copie

Tojo · Answer

Copie impossible.
Impossible de lire a partir du fichier ou de la disquette source.

gen-hackman · Answer

t'es-t-il possible de le zipper ?

Tojo · Answer

non ça créer un fichier zip vide. Pendant l'opération de zippage une console d'erreur s'affiche avec le même diagnostique qu'auparavant"un périphérique attaché au système ne fonctionne par correctement"

gen-hackman · Answer

ok passe à la suite on y reviendra

Tojo · Answer

voilà le rapport:

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


Sinon OTL a planté pendant l'opération, j'ai arreté l'ordinateur et j'ai eu bcp de mal a le rallumer. Voila la description de l'arret non planifié :
Signature du problème :
  Nom d'événement de problème:	BlueScreen
  Version du système:	6.0.6002.2.2.0.768.3
  Identificateur de paramètres régionaux:	1036

Informations supplémentaires sur le problème :
  BCCode:	1000007e
  BCP1:	C0000005
  BCP2:	807D4C48
  BCP3:	8BB673B0
  BCP4:	8BB670AC
  OS Version:	6_0_6002
  Service Pack:	2_0
  Product:	768_1

Fichiers aidant à décrire le problème :
  C:\Windows\Minidump\Mini040910-01.dmp
  C:\Users\Jordy\AppData\Local\Temp\WER-80980-0.sysdata.xml
  C:\Users\Jordy\AppData\Local\Temp\WER733B.tmp.version.txt

gen-hackman · Answer

ok retente la manip avec OTL en mode sans echec stp

Tojo · Answer

OTL plante plus mais le redémarrage échoue. Je dirais même plus que le démarrage échoue systématiquement ensuite (sauf quand je lance l'ordi en mode sans echec).

Signature du problème :
  Nom d'événement de problème:	BlueScreen
  Version du système:	6.0.6002.2.2.0.768.3
  Identificateur de paramètres régionaux:	1036

Informations supplémentaires sur le problème :
  BCCode:	1000007e
  BCP1:	C0000005
  BCP2:	807D1C48
  BCP3:	8BB673B0
  BCP4:	8BB670AC
  OS Version:	6_0_6002
  Service Pack:	2_0
  Product:	768_1

Fichiers aidant à décrire le problème :
  C:\Windows\Minidump\Mini040910-03.dmp
  C:\Users\Jordy\AppData\Local\Temp\WER-71635-0.sysdata.xml
  C:\Users\Jordy\AppData\Local\Temp\WERA820.tmp.version.txt

gen-hackman · Answer

ok tu peux m'obtenir le rapport ?

i · Answer

ha voila j'ai réussi a redémarrer. 

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Prefs.js: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15 removed from extensions.enabledItems
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\DisableTaskMgr not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\TaskMan:C:\Users\Jordy\csrss.exe deleted successfully.
File C:\Users\Jordy\csrss.exe not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\iTunesHelper not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your Protection\ not found.
========== FILES ==========
File\Folder C:\Users\Jordy\Desktop\Your Protection Support.lnk not found.
File\Folder C:\Users\Jordy\Desktop\Your Protection.lnk not found.
File\Folder C:\Users\Jordy\csrss.exe not found.
File\Folder C:\Users\Jordy\AppData\Roaming\wklnhst.dat not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Jordy
->Temp folder emptied: 28452 bytes
->Temporary Internet Files folder emptied: 2569916 bytes
->Java cache emptied: 50915485 bytes
->FireFox cache emptied: 38508541 bytes
->Flash cache emptied: 25201728 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 47823132 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 449195 bytes
 
Total Files Cleaned = 158,00 mb
 
 
OTL by OldTimer - Version 3.2.1.1 log created on 04092010_180631

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

gen-hackman · Answer

refais un scan OTL stp

tojo · Answer

et ...

gen-hackman · Answer

https://forums.commentcamarche.net/forum/affich-17298777-virus-your-protection-rogue?full#20

tojo · Answer

oups je pensais l'avoir fait

http://www.cijoint.fr/cjlink.php?file=cj201004/cij3d1l2mi.txt

http://www.cijoint.fr/cjlink.php?file=cj201004/cijhiEhGvt.txt

gen-hackman · Answer

* Télécharge MyHosts.exe (de jeanmimigab) sur ton bureau.
https://www.sfr.fr/fermeture-des-pages-perso.html
* Clic sur l'icône du programme, et sur exécuter en tant qu'administrateur pour le lancer.
* Poste le contenu du rapport qui s'ouvre.
* Si aucun rapport ne s'ouvre, tu peux le retrouver à l'emplacement suivant : C:\MyHosts.txt

ensuite :


&#9654 Télécharge DAFT !

  &#9654  Sauvegarde-le sur ton Bureau.
  &#9654  Dézippe le dossier le contenant (clic droit , extraire ici)
  &#9654  clique-droit exécuter en tant qu'administrateur  sur l'icône de DAFT se trouvant dans son dossier dézippé, présent sur ton bureau.
  &#9654  Clique sur le bouton Scan.
  &#9654  Sélectionne tout ce qui apparaît.
  &#9654  Clique sur le bouton Fix.
  &#9654  Ensuite relance DAFT. Si tout est OK, un message du type "All associations are OK" devrait apparaître.
  &#9654  Ferme DAFT.

ensuite :

&#9654 clic droit "executer en tant qu'administrateur" sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous Customs Scans/Fixes :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
O33 - MountPoints2\{350104ac-0f21-11df-a524-001dbaefaf5b}\Shell - "" = AutoRun
O33 - MountPoints2\{350104ac-0f21-11df-a524-001dbaefaf5b}\Shell\AutoRun\command - "" = G:\autorun.exe -- File not found
O33 - MountPoints2\{47230b10-01f2-11df-aaa2-001dbaefaf5b}\Shell\AutoRun\command - "" = I:\setupSNK.exe -- File not found
O33 - MountPoints2\{5f953a72-22af-11df-bc8a-001dbaefaf5b}\Shell\AutoRun\command - "" = G:\SAVEST\cista.exe -- File not found
O33 - MountPoints2\{5f953a72-22af-11df-bc8a-001dbaefaf5b}\Shell\open\command - "" = G:\SAVEST\cista.exe -- File not found
O33 - MountPoints2\{8451f041-10d0-11df-a904-001dbaefaf5b}\Shell - "" = AutoRun
O33 - MountPoints2\{8451f041-10d0-11df-a904-001dbaefaf5b}\Shell\AutoRun\command - "" = I:\WD SmartWare.exe -- File not found
O33 - MountPoints2\{8451f04f-10d0-11df-a904-001dbaefaf5b}\Shell - "" = AutoRun
O33 - MountPoints2\{8451f04f-10d0-11df-a904-001dbaefaf5b}\Shell\AutoRun\command - "" = H:\autorun.exe -- File not found
O33 - MountPoints2\{b778e373-b9a0-11de-9048-002433746777}\Shell\AutoRun\command - "" = G:\start.exe -- File not found

:Files
C:\Windows\System32\drivers\ihazni.sys
C:\Users\Jordy\AppData\Roaming\app

:commands
[emptytemp]
[start explorer]
[reboot]


&#9654 Clique sur "Correction" pour lancer la suppression.


&#9654 Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

tojo · Answer

Le redémmarage s'est pas passé correctement. Le systeme plante systematiquement ( blue screen)


All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{350104ac-0f21-11df-a524-001dbaefaf5b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{350104ac-0f21-11df-a524-001dbaefaf5b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{350104ac-0f21-11df-a524-001dbaefaf5b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{350104ac-0f21-11df-a524-001dbaefaf5b}\ not found.
File G:\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{47230b10-01f2-11df-aaa2-001dbaefaf5b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47230b10-01f2-11df-aaa2-001dbaefaf5b}\ not found.
File I:\setupSNK.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5f953a72-22af-11df-bc8a-001dbaefaf5b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5f953a72-22af-11df-bc8a-001dbaefaf5b}\ not found.
File G:\SAVEST\cista.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5f953a72-22af-11df-bc8a-001dbaefaf5b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5f953a72-22af-11df-bc8a-001dbaefaf5b}\ not found.
File G:\SAVEST\cista.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8451f041-10d0-11df-a904-001dbaefaf5b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8451f041-10d0-11df-a904-001dbaefaf5b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8451f041-10d0-11df-a904-001dbaefaf5b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8451f041-10d0-11df-a904-001dbaefaf5b}\ not found.
File I:\WD SmartWare.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8451f04f-10d0-11df-a904-001dbaefaf5b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8451f04f-10d0-11df-a904-001dbaefaf5b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8451f04f-10d0-11df-a904-001dbaefaf5b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8451f04f-10d0-11df-a904-001dbaefaf5b}\ not found.
File H:\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b778e373-b9a0-11de-9048-002433746777}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b778e373-b9a0-11de-9048-002433746777}\ not found.
File G:\start.exe not found.
========== FILES ==========
File move failed. C:\Windows\System32\drivers\ihazni.sys scheduled to be moved on reboot.
C:\Users\Jordy\AppData\Roaming\app folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Jordy
->Temp folder emptied: 497897 bytes
->Temporary Internet Files folder emptied: 947209 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 87377475 bytes
->Flash cache emptied: 3072 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2431246 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 87,00 mb
 
 
OTL by OldTimer - Version 3.2.1.1 log created on 04132010_175324

Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\drivers\ihazni.sys scheduled to be moved on reboot.

Registry entries deleted on Reboot...

gen-hackman · Answer

/!\ ATTENTION SUIVRE SCRUPULEUSEMENT A LA LETTRE CES INDICATIONS/!\ ________________________________________________________________ >Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.< >>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<< ===================================================== ▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" avant qu'il soit enregistré sur ton disque dur ▶ On va utiliser ComboFix.exe. Rends toi sur cette page web pour obtenir les liens de téléchargement, ainsi que des instructions pour exécuter l'outil: https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix Avant d'utiliser ComboFix : ______________________________________________________________________ >> referme les fenêtres de tous les programmes en cours. >> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, >>la protection en temps réel de ton Antivirus et de tes Antispywares, >>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°° ▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!! ▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. ▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

tojoo · Answer

j'ai oublié de le renommer en monprenom.exe Et l'antivirus s'est pas vraiment desactivé, néanmoins ça a pas l'air de l'avoir empeche de faire son travail voila le rapport : ComboFix 10-04-13.02 - Jordy 13/04/2010 18:32:57.1.2 - x86 Lancé depuis: c:\users\Jordy\Desktop\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-3030196316-536579104-2439416212-500 c:\$recycle.bin\S-1-5-21-3066476807-2649691290-3316902314-500 c:\programdata\_VOIDmfeklnmal.dll c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk c:\windows\system32\driVERs\ihazni.sys . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF -------\Legacy_ihazni -------\Service_ihazni ((((((((((((((((((((((((((((( Fichiers créés du 2010-03-13 au 2010-04-13 )))))))))))))))))))))))))))))))))))) . 2010-04-13 16:41 . 2010-04-13 16:43 -------- d-----w- c:\users\Jordy\AppData\Local emp 2010-04-13 16:41 . 2010-04-13 16:41 -------- d-----w- c:\users\Default\AppData\Local emp 2010-04-11 21:09 . 2010-04-11 21:09 -------- d-sh--w- c:\windows\system32\%APPDATA% 2010-04-11 16:42 . 2010-04-11 17:20 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2010-04-11 16:42 . 2010-04-11 16:42 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-04-11 16:29 . 2010-04-11 16:40 -------- d-----w- c:\program files\RegCleaner 2010-04-11 16:25 . 2010-04-12 10:36 680 ----a-w- c:\users\Jordy\AppData\Local\d3d9caps.dat 2010-04-09 17:38 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-09 17:38 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-04-09 14:58 . 2010-04-09 14:58 -------- d-----w- C:\_OTL 2010-04-09 03:39 . 2010-04-09 03:39 -------- d-----w- C:\Kill'em 2010-04-09 03:34 . 2010-04-09 03:34 88808 ----a-w- c:\users\Jordy\AppData\Local\GDIPFONTCACHEV1.DAT 2010-04-08 17:59 . 2010-04-11 17:46 -------- d-----w- c:\program files\List_Kill'em 2010-04-08 13:36 . 2010-04-08 13:36 -------- d-----w- c:\users\Jordy\AppData\Roaming\Malwarebytes 2010-04-08 13:35 . 2010-04-09 17:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-04-08 13:35 . 2010-04-08 13:35 -------- d-----w- c:\programdata\Malwarebytes 2010-04-02 15:46 . 2010-04-03 11:13 -------- d-----w- c:\users\Jordy\AppData\Local\My Games 2010-04-02 15:24 . 2010-04-02 15:24 -------- d-----w- c:\program files\Firaxis Games 2010-03-19 15:24 . 2010-03-19 15:24 -------- d-----w- c:\users\Jordy\AppData\Roaming\Template . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-13 16:41 . 2009-03-23 01:15 12 ----a-w- c:\windows\bthservsdp.dat 2010-04-13 05:52 . 2009-07-14 22:11 -------- d-----w- c:\users\Jordy\AppData\Roaming\vlc 2010-04-13 05:52 . 2009-07-12 13:16 -------- d-----w- c:\users\Jordy\AppData\Roaming\Thunderbird 2010-04-13 05:52 . 2010-03-14 13:51 -------- d-----w- c:\users\Jordy\AppData\Roaming\La Bataille pour la Terre du Milieu (TM) II 2010-04-13 05:52 . 2010-02-13 02:15 -------- d-----w- c:\users\Jordy\AppData\Roaming\Bioshock2 2010-04-13 05:52 . 2010-02-03 16:26 -------- d-----w- c:\users\Jordy\AppData\Roaming\Bioshock 2010-04-13 05:52 . 2009-08-25 21:10 -------- d-----w- c:\users\Jordy\AppData\Roaming\dvdcss 2010-04-13 05:52 . 2009-10-13 16:59 -------- d-----w- c:\programdata\FLEXnet 2010-04-11 16:22 . 2009-07-12 15:31 1 ----a-w- c:\users\Jordy\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-04-09 02:55 . 2008-01-21 08:40 669566 ----a-w- c:\windows\system32\perfh00C.dat 2010-04-09 02:55 . 2008-01-21 08:40 123556 ----a-w- c:\windows\system32\perfc00C.dat 2010-04-02 15:36 . 2009-03-23 02:08 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-03-17 12:02 . 2009-07-11 16:59 -------- d-----w- c:\program files\Mozilla Thunderbird 2010-03-14 13:38 . 2010-03-14 13:38 -------- d-----w- c:\program files\Electronic Arts 2010-03-11 02:17 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-03-11 02:05 . 2009-05-05 12:13 -------- d-----w- c:\programdata\Microsoft Help 2010-03-01 17:00 . 2009-07-17 12:16 139456 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2010-03-01 17:00 . 2009-07-17 12:16 190160 ----a-w- c:\windows\system32\PnkBstrB.exe 2010-02-26 12:00 . 2010-03-01 16:58 724992 ----a-w- c:\users\Jordy\AppData\Roaming\Mozilla\Firefox\Profiles\z5p76d5o.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins pBFHUpdater.dll 2010-02-26 12:00 . 2010-03-01 16:58 1291640 ----a-w- c:\users\Jordy\AppData\Roaming\Mozilla\Firefox\Profiles\z5p76d5o.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe 2010-02-24 09:16 . 2009-10-03 09:23 181632 ------w- c:\windows\system32\MpSigStub.exe 2010-02-23 06:39 . 2010-03-31 10:10 916480 ----a-w- c:\windows\system32\wininet.dll 2010-02-23 06:33 . 2010-03-31 10:10 71680 ----a-w- c:\windows\system32\iesetup.dll 2010-02-23 06:33 . 2010-03-31 10:10 109056 ----a-w- c:\windows\system32\iesysprep.dll 2010-02-23 04:55 . 2010-03-31 10:10 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2010-02-20 23:06 . 2010-03-11 02:00 24064 ----a-w- c:\windows\system32 shhttp.dll 2010-02-20 23:05 . 2010-03-11 02:00 30720 ----a-w- c:\windows\system32\httpapi.dll 2010-02-20 20:53 . 2010-03-11 02:00 411648 ----a-w- c:\windows\system32\drivers\http.sys 2010-02-17 17:27 . 2009-05-05 12:06 -------- d-----w- c:\program files\Google 2010-02-13 18:12 . 2009-07-25 02:21 -------- d-----w- c:\users\Jordy\AppData\Roaming\Apple Computer 2010-02-13 18:12 . 2010-02-13 18:12 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf 2010-02-13 18:12 . 2009-07-12 15:20 -------- d-----w- c:\programdata\Apple 2010-02-13 02:11 . 2010-02-13 02:11 -------- d-sh--w- c:\programdata\SecuROM 2010-02-13 02:10 . 2010-02-13 02:10 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE 2010-02-13 01:55 . 2010-02-03 15:35 -------- d-----w- c:\program files\2K Games 2010-02-12 10:32 . 2010-02-27 01:25 293376 ----a-w- c:\windows\system32\browserchoice.exe 2010-02-01 11:00 . 2010-02-01 11:00 691696 ----a-w- c:\windows\system32\drivers\sptd.sys 2010-01-25 12:00 . 2010-02-23 18:48 471552 ----a-w- c:\windows\system32\secproc_isv.dll 2010-01-25 12:00 . 2010-02-23 18:48 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll 2010-01-25 12:00 . 2010-02-23 18:48 152064 ----a-w- c:\windows\system32\secproc_ssp.dll 2010-01-25 12:00 . 2010-02-23 18:48 471552 ----a-w- c:\windows\system32\secproc.dll 2010-01-25 11:58 . 2010-02-23 18:48 332288 ----a-w- c:\windows\system32\msdrm.dll 2010-01-25 08:21 . 2010-02-23 18:48 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe 2010-01-25 08:21 . 2010-02-23 18:48 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe 2010-01-25 08:21 . 2010-02-23 18:48 518144 ----a-w- c:\windows\system32\RMActivate.exe 2010-01-25 08:21 . 2010-02-23 18:48 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe 2010-01-23 09:26 . 2010-02-23 18:49 2048 ----a-w- c:\windows\system32 zres.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-12-21 274432] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-05 39408] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-01-06 6703648] "Apoint"="c:\program files\Apoint\Apoint.exe" [2008-09-30 122880] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-12-18 317288] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-02 61440] "AML"="c:\program files\Sony\VAIO Launcher\AML.exe" [2009-03-09 1101824] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280] c:\users\Jordy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Audio Filter.lnk - c:\program files\sony\SonicStage Mastering Studio\Audio Filter\SSMSFilter.exe [2009-5-5 3344680] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\VESWinlogon] 2009-01-19 10:49 98304 ----a-w- c:\windows\System32\VESWinlogon.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDDMStatus.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk backup=c:\windows\pss\WDDMStatus.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDSmartWare.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDSmartWare.lnk backup=c:\windows\pss\WDSmartWare.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] 2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):9c,8c,e2,68,2b,53,ca,01 R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-17 135664] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-02-10 29736] S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-12-08 169312] S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-07-14 108289] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2008-04-24 17920] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contenu du dossier 'Tâches planifiées' 2010-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-17 17:27] 2010-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-17 17:27] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html TCP: {9FC43582-197F-4958-AA24-8465DC761A8B} = 212.27.54.252 FF - ProfilePath - c:\users\Jordy\AppData\Roaming\Mozilla\Firefox\Profiles\z5p76d5o.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - plugin: c:\program files\Google\Update\1.2.183.23 pGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins p-mswmp.dll FF - plugin: c:\users\Jordy\AppData\Roaming\Mozilla\Firefox\Profiles\z5p76d5o.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins pBFHUpdater.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- PARAMETRES FIREFOX ---- c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-13 18:43 Windows 6.0.6002 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys spls.sys >>UNKNOWN [0x85CA2938]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0x8b1a1d24 \Driver\ACPI -> acpi.sys @ 0x807bbd68 \Driver\iaStor -> iaStor.sys @ 0x8aa4beb0 IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-2582767111-3107744122-1024548549-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:63,b9,e2,f3,bd,ca,33,9c,22,97,72,74,5d,ca,4f,36,b7,09,bf,1b,47,d8,43, bf,41,87,68,33,14,87,e1,77,59,e4,66,ed,ad,c7,a8,1e,65,b9,c1,9c,54,c1,08,3c,\ "??"=hex:51,33,ff,71,0c,16,5a,94,47,be,98,7c,ea,02,81,dd [HKEY_USERS\S-1-5-21-2582767111-3107744122-1024548549-1000\Software\SecuROM\License information*] "datasecu"=hex:1e,ab,10,76,89,af,b8,85,6c,1b,e0,bc,f6,8b,c3,eb,a9,bc,9f,2a,99, 9c,f8,0e,f7,2c,72,17,ba,24,d5,27,b3,5e,f1,db,2e,14,92,ae,91,7d,f4,fb,db,97,\ "rkeysecu"=hex:32,e3,13,6d,8f,cc,9a,4a,df,68,66,51,d2,b6,42,a7 [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'Explorer.exe'(5404) c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\Ati2evxx.exe c:\program files\Realtek\Audio\HDA\RtkAudioService.exe c:\windows\system32\WLANExt.exe c:\windows\system32\Ati2evxx.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe c:\program files\Intel\WiFi\bin\EvtEng.exe c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe c:\program files\sony\Network Utility\NSUService.exe c:\windows\system32\PnkBstrA.exe c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe c:\program files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe c:\program files\Sony\VAIO Power Management\SPMService.exe c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe c:\windows\system32\WUDFHost.exe c:\windows\system32\DRIVERS\xaudio.exe c:\program files\Sony\VAIO Update 4\VAIOUpdt.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe c:\program files\Sony\VAIO Power Management\SPMgr.exe c:\windows\system32\conime.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\Apoint\ApMsgFwd.exe c:\program files\Apoint\Apntex.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\program files\Windows Media Player\wmpnetwk.exe . ************************************************************************** . Heure de fin: 2010-04-13 18:51:09 - La machine a redémarré ComboFix-quarantined-files.txt 2010-04-13 16:51 Avant-CF: 124 972 199 936 octets libres Après-CF: 124 555 509 760 octets libres - - End Of File - - CACEAD9B5E5E5892549193DCAF4AD031

gen-hackman · Answer

demarrer / accessoires / executer

tape :

SFC /SCANNOW (espace avant le "/" )

laiise faire l'ordi , le cd de windows d'origine te sera demandé si fichier corrompu.................

tojo · Answer

ça marche pas quand je tape ça dans executer.

tojo · Answer

2010-04-13 23:24:18, Info                  CSI    0000015e [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-04-13 23:24:21, Info                  CSI    00000160 [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-04-13 23:38:25, Info                  CSI    00000337 [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-04-13 23:38:27, Info                  CSI    00000339 [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-04-13 23:41:21, Info                  CSI    000003bb [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-04-13 23:41:21, Info                  CSI    000003bd [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch




Avec l'invite de commande voila ce qu'il arrive pas à réparer.

gen-hackman · Answer

hello

ça marche pas quand je tape ça dans executer.

un message d'erreur ?

Virus: Your protection (rogue)

31 réponses

Discussions similaires