60 trojan infecte mon pc a l'aide

Voici le rapport.

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Version de la base de données: 3969

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 6.0.2900.5512

08/04/2010 21:20:53
mbam-log-2010-04-08 (21-20-53).txt

Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 137554
Temps écoulé: 15 minute(s), 32 seconde(s)

Processus mémoire infecté(s): 7
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 6
Valeur(s) du Registre infectée(s): 10
Elément(s) de données du Registre infecté(s): 4
Dossier(s) infecté(s): 11
Fichier(s) infecté(s): 135

Processus mémoire infecté(s):
C:\Documents and Settings\Administrateur\Local Settings\Temp\l97e67zz.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\win.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\mplay32xe.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\services.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\login.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\mdm.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\taskmgr.exe (Trojan.Agent) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\cg9o92ya.dll (Trojan.Vundo.H) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your Protection (Rogue.YourProtection) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Your Protection (Rogue.YourProtection) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\_VOID (Rootkit.TDSS) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hf8wefhuaihf8ewfydiujhfdsfdf (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mplay32xe.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\your protection (Rogue.YourProtection) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\firevall administrating (Trojan.Backdoor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINDOWS\_VOIDdmexuwqecx (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDirtfhtxvbd (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDiuxtivnlps (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDmksmnbqfpj (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDtkosidwprp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDtpetnwoism (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDvotrpvcchq (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDwmqevspphp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDxtqpuxphee (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection (Rogue.YourProtection) -> Delete on reboot.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Your Protection (Rogue.YourProtection) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\cg9o92ya.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Documents and Settings\Administrateur\Local Settings\Temp\l97e67zz.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\win.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\mplay32xe.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\services.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\login.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\mdm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\taskmgr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\80009a1c.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\90e85e08.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\avp32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\bbnar2jd5o.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\dhdhtrdhdrtr5y (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\gm6ax.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\lbj2tuqe9a0vt82f.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\nsty3m201227.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\TMP2F29.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\TMPDABC.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\winamp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\z1zhgkk.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\_VOID315b.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\_VOID387c.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\_VOID3b5e.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\_VOIDdb0a.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9XP37RCP\kkemu[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\a9m41u2bubf55wjs.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\adqsz3g.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\avp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\avp32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\b30tvvmi0rlf6.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\bc30iuje5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\cb9nqc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\cd7s3phk7ys2hhi3.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\csrss.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\cwk9zj4b.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\debug.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\drweb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\eacvjgey.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\esxu2my1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\f997h3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\fldcztjajkrs.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\flq9dycg.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\fn5wuf65o.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\fz4yogyp8.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\gm488.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\iexplarer.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\jfv464bm0y07uhao.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\lj6qm5rkd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\login.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\mdm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\mplay32xe.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\nxy0cft.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\o4e4js59.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\s50wg1j4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\services.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\smss.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\spoolsv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\system.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\t4vr6e8u7k.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\taskmgr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\TMP644.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\TMPCD42.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\TMPD58F.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\TMPD793.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\TMPD8CC.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\TMPD949.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\TMPDAFE.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\TMPDCF2.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\TMPE5AC.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\TMPF77F.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\user.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\win.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\win16.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\win32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\winamp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\winlogon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\yo7l5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOID8160.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOID886.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOIDda81.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOIDe1e4.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOIDfb48.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\b55t7.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iqwqd2.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\j99hc.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lg243at6m.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\r9q4zrh.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\secih.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sggxyd.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\si7be.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\_VOIDrnhlxsmlhr.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDdmexuwqecx\_VOIDd.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDvotrpvcchq\_VOIDd.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDmksmnbqfpj\_VOIDd.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\about.ico (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\activate.ico (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\buy.ico (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\help.ico (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\scan.ico (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\settings.ico (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\splash.mp3 (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\Uninstall.exe (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\update.ico (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\urp.db (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\urpext.dll (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\urphook.dll (Rogue.YourProtection) -> Delete on reboot.
C:\Program Files\Your Protection\urpprot.exe (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Program Files\Your Protection\virus.mp3 (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Your Protection\About.lnk (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Your Protection\Activate.lnk (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Your Protection\Buy.lnk (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Your Protection\Scan.lnk (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Your Protection\Settings.lnk (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Your Protection\Update.lnk (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Your Protection\Your Protection Support.lnk (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Your Protection\Your Protection.lnk (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Favoris\_favdata.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Microsoft\Internet Explorer\Quick Launch\Your Protection.lnk (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Bureau\Your Protection.lnk (Rogue.YourProtection) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\_VOIDuyrmpukbnr.dat (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOIDdbd9.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOIDe32c.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOIDe704.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOIDeaec.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOIDebc7.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\_VOIDf8d7.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Bureau\nudetube.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Bureau\pornotube.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Bureau\youporn.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\csrss.exe (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Administrateur\Local Settings\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Joseline\Local Settings\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

J'ai redémarré et supprimé la quarantaine, mais une fois de retour en mode normal, je ne peux pas telecharger le programme car un programme essaie de s'installer et paralyse tout, comme au début du problème : menu démarrer inaccessible, barre de tâches paralysée... Et firefox plante au démarrage.

Est-il possible de faire ce que tu proposes en mode sans echec ?

Une question pratique, je dois utiliser toutes les extension de Rkill que tu proposes car je n'ai pas très bien compris, tout à l'heure je n'avais utilisé que celle en .exe

Par contre, je continuerai les manipulations demain car là je dois partir ! je te tiens informé!
Merci!

non les autres liens sont fournis si le précédent échoue...c'est selon l'infection

pour info la tienne d'infection, un rogue( faux antivirus) est assez consistante...mais pas imbattable

@+

List'em by g3n-h@ckm@n 1.7.0.3

User : Administrateur (Administrateurs)
Update on 08/04/2010 by g3n-h@ckm@n ::::: 22.50
Start at: 12:21:49 | 09/04/2010

Intel(R) Atom(TM) CPU N270 @ 1.60GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 6.0.2900.5512
Windows Firewall Status : Disabled
AV : avast! Antivirus 5.0.83886542 [ Enabled | Updated ]

C:\ -> Disque fixe local | 146,12 Go (137 Go free) [XP] | NTFS

Boot: Safeboot


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IgfxTray REG_SZ C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds REG_SZ C:\WINDOWS\system32\hkcmd.exe
Persistence REG_SZ C:\WINDOWS\system32\igfxpers.exe
RTHDCPL REG_SZ RTHDCPL.EXE
Alcmtr REG_SZ ALCMTR.EXE
ITSecMng REG_EXPAND_SZ %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
UCam_Menu REG_SZ "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
HP Software Update REG_SZ C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
<NO NAME> REG_SZ
avast5 REG_SZ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
KernelFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
DisableTaskMgr REG_DWORD 0 (0x0)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 145 (0x91)
NoFolderOptions REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ JOE
DefaultUserName REG_SZ Administrateur
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
DefaultPassword REG_SZ
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Administrateur
AltDefaultDomainName REG_SZ JOE

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe
C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe
C:\Program Files\HP\Digital Imaging\bin\hposid01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe
C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe
C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe
C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe
C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe
C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe REG_SZ C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe
C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe REG_SZ C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe
C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe
C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\DOCUME~1\Joseline\LOCALS~1\Temp\IXP000.TMP\oleke.exe REG_SZ C:\DOCUME~1\Joseline\LOCALS~1\Temp\IXP000.TMP\oleke.exe:*:Enabled:Firevall Administrating

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{41564D57-9980-0010-8000-00AA00389B71}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

==============
BHO :
======

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{665C01D5-65D5-4459-912D-6C5C002068C4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{665C01D5-65D5-4459-912D-6C5C002068C4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{665C01D5-65D5-4459-912D-6C5C002068C4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.thetechguys.com
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\dllcache\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\dllcache\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

=======
Drive :
=======

D'fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
146 Go total, 137 Go libre (93%), 16% fragment' (fragmentation du fichier 32%)

Vous devriez d'fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Documents and Settings\Administrateur\Local Settings\Temp\1.ico
Present !! : C:\Documents and Settings\Administrateur\Local Settings\Temp\2.ico
Present !! : C:\Documents and Settings\Administrateur\Local Settings\Temp\3.ico
Present !! : C:\Documents and Settings\Administrateur\Local Settings\Temp\urp.dat
Present !! : C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\urp.dat
Present !! : C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\urpr.dat

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKEY_USERS\S-1-5-21-3183572086-2217694830-2937275357-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-09 12:30:22
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 29 !

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 0 (0x0)
FirewallOverride REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 12:30:23,32

je ne peux pas poster le rapport kill'em j'ai fait clean mais je ne peux pas accéder à internet je travaille en mode sans echec et le rapport est sur mon bureau donc impossible d'acces en mode sans echec
la page internet bloque, je ne peux plus arreter correctement mon ordi

que dois je faire ??

merci de ton aide

j'ai un peu peur de faire ça , mon ordi se met parfois en veille quand je ne fais plus rien dessus est ce que si je touche juste le carré il peut planter ?

j'ai désactivé avast il me dit que que le programme a é" arrété que mon systeme n'est pas protégé mais combofix me dit qu'il est actif que faire

ComboFix 10-04-08.06 - Administrateur 09/04/2010 21:47:27.1.2 - x86 NETWORK
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1015.738 [GMT 2:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-5398933763-2448465429-668128005-6850

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-03-09 au 2010-04-09 ))))))))))))))))))))))))))))))))))))
.

2010-04-09 10:21 . 2010-04-09 10:56 -------- d-----w- C:\Kill'em
2010-04-09 10:21 . 2010-04-09 11:22 -------- d-----w- c:\program files\List_Kill'em
2010-04-09 05:29 . 2010-04-09 05:29 34008 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-08 19:45 . 2010-04-08 19:45 -------- d-----w- c:\documents and settings\Joseline\Application Data\Malwarebytes
2010-04-08 19:03 . 2010-04-08 19:03 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2010-04-08 19:02 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-08 19:02 . 2010-04-08 19:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-08 19:02 . 2010-04-08 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-08 19:02 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-08 18:56 . 2010-04-08 18:56 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla
2010-04-08 14:35 . 2008-04-13 09:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-04-08 14:35 . 2008-04-13 09:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-04-08 14:35 . 2008-04-13 09:41 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-04-08 14:35 . 2008-04-13 09:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-04-08 14:34 . 2008-04-13 09:41 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-03-20 15:55 . 2010-03-20 15:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-28 14:41 . 2008-10-09 05:36 80946 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-28 14:41 . 2008-10-09 05:36 501138 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-20 15:57 . 2009-01-24 16:07 -------- d-----w- c:\program files\Alwil Software
2010-03-09 11:24 . 2009-01-24 16:07 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-03-09 11:24 . 2009-01-24 16:07 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-03-09 11:12 . 2009-01-24 16:07 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-03-09 11:12 . 2009-01-24 16:07 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-03-09 11:09 . 2009-01-24 16:07 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-03-09 11:08 . 2009-01-24 16:07 100432 ----a-w- c:\windows\system32\drivers\aswMon2.sys
2010-03-09 11:08 . 2009-01-24 16:07 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-03-09 11:08 . 2009-01-24 16:07 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-03-09 11:08 . 2009-01-24 16:07 28880 ----a-w- c:\windows\system32\drivers\Aavmker4.sys
2010-02-26 05:42 . 2008-10-09 05:36 671232 ----a-w- c:\windows\system32\wininet.dll
2010-02-26 05:42 . 2008-10-09 05:35 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-12 10:03 . 2010-03-04 11:42 293376 ------w- c:\windows\system32\browserchoice.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-27 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-27 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-27 137752]
"RTHDCPL"="RTHDCPL.EXE" [2008-06-26 16875008]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-2-22 2938184]
Boot_Recovery.lnk - c:\applications\OEM\Boot\TGConfigXP.exe [2008-10-9 724992]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
OSD.lnk - c:\windows\Installer\{73289228-1853-4623-982A-EB17FF0270CA}\_2ACF3AE2549EAFB90DD4A8.exe [2008-10-11 21630]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [09/10/2008 11:06 156160]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [24/01/2009 18:07 162640]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [24/01/2009 18:07 19024]
S2 OsdService;OSD Service;c:\program files\OEM\OSD_1.41\OsdService.exe [22/02/2008 09:24 94208]
S3 GpdDevDPort;GpdDevDPort;c:\windows\system32\directport.sys [17/06/2008 21:27 7168]
S3 GpdKbFilter;GpdKbFilter;c:\windows\system32\kbfiltr.sys [22/04/2008 19:06 8192]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.thetechguys.com
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\fmicahoc.default\
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************
.
Heure de fin: 2010-04-09 21:52:41
ComboFix-quarantined-files.txt 2010-04-09 19:52

Avant-CF: 147 004 874 752 octets libres
Après-CF: 147 502 362 624 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - E2F852E6457D1F2744516F462DDCCA45

je ne peux toujours pas accéder à internet normalement cela bloque et je ne peux plus aller sur démarrer il y a le sablier
dois je faire la manip au dessus en mode sans échec

http://www.cijoint.fr/cjlink.php?file=cj201004/cijvKP8hY6.txt

je fais toujours en mode sans echec

merci
est ce qu'on va arriver à débloquer mon ordi ?

au moment de nettoyer on me demande de désinstaller des fichiers est ce que je dois le faire ?

je n'ai pas trouvé les lignes helper je ne peux pas coller les autres lignes car quand je réduis ma page elle disparait j'ai pu me connecter normalement

ZHPFix v1.12.3084 by Nicolas Coolman - Rapport de suppression du 10/04/2010 15:50:10
Fichier d'export Registre : C:\ZHPExportRegistry-10-04-2010-15-50-10.txt
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html


Processus mémoire :
C:\Program Files\OEM\OSD_1.41\OsdService.exe [94208] => Supprimé et mis en quarantaine

Module mémoire :
(Néant)

Clé du Registre :
O23 - Service: OSD Service (OsdService) . (.TODO: <????> - TODO: <????>.) - C:\Program Files\OEM\OSD_1.41\OsdService.exe => Clé supprimée avec succès

Valeur du Registre :
(Néant)

Elément de données du Registre :
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: Modified => Donnée supprimée avec succès
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: Modified => Donnée supprimée avec succès

Dossier :
(Néant)

Fichier :
O4 - Global Startup: OSD.lnk . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Installer\{73289228-1853-4623-982A-EB17FF0270CA}\_2ACF3AE2549EAFB90DD4A8.exe => Supprimé et mis en quarantaine
c:\program files\oem\osd_1.41\osdservice.exe => Fichier absent

Logiciel :
O42 - Logiciel: OSD_1.41 - (.OEM.) => Logiciel supprimé avec succès
O42 - Logiciel: OSD_1.41 - (.OEM.) => Logiciel absent

Script Registre :
(Néant)

Autre :
(Néant)


Récapitulatif :
Processus mémoire : 1
Module mémoire : 0
Clé du Registre : 1
Valeur du Registre : 0
Elément de données du Registre : 2
Dossier : 0
Fichier : 2
Logiciel : 2
Autre : 0


End of the scan

je ne sais pas si c'est ça j'ai eu beaucoup de mal pour copier je ne crois pas y etre arrivé cela ne
marchait pas , et j'ai des tas de fenetres qui me demandaient de désinstallé j'ai dit non , mais j'en ai euen anglais bref je ne sais pas si c'est bon

merci encore de me guider

voilà j'ai redémarré j'ai OSD_1.41 qui veut s'installer je ne sais pas ce que c'est j'ai dit non je peux me connecter mais je ne peux pas aller sur démarrer le sablier tourne
j'ai des fonctions de mon odi qui ne marche plus comme le logo qui me dit quand je suis en majuscule, il me manque des choses dans la barre de tache

au bout d'un quart d'heure toutes les fonctions sont revenues
est ce que je peux enlever sur le bureau mode sans echec tous les programmes que j'ai installé ?
merci encore

je n'ai pas tout compris

le pc fonctionne t il correctement en mode normal ?

je peux aller sur internet en mode normal mais je ne peux pas aller dans démarrer le sablier se met, je ne peux pas arréter mon ordi correctement , certaine fonction de mon ordi ne marche plus comme quand je met la majuscule j'ai normalement une fenetre qui apparait

le son de window ne se met pas au démarrage

si j'attends un moment tout redevient normal, mes icones dans la barre de tache reviennent et le sablier s'enlève

est ce que tu comprends ce que je veux dire ?

je n'arrive pas à télécharger la fenetre de téléchargement reste blanche puis tout ce bloque je ne peux rien faire j'ai le sablier je dois éteindre l'ordi par le bouton
tu n'a pas un autre site ou je peux télécharger ?

merci encore de prendre du temps pour moi un dimanche

j'ai téléchargé installé et redémarré cela ne fait rien quand je déplace ma souris vers démarré c'est le sablier que j'ai je ne peux pas accédé au menu démarré

Je viens d'essayer mon imprimante cela ne marche plus non plus pourtant elle est prète le document en attente il me dit erreur
je crois que je ne vais pas m'en sortir

je dois m'absenter..

as tu le cd de windows, car je pense qu'il faudrait envisager une réparation...

oui je l'ai mais je ne voudrais pas reformater est ce possible ?

bon dimanche

bon j'ai essayé de branché mon lecteur de cd car j'ai un netbook et pas moyen je pense que l'ordi ne reconnait plus le port usb, cela ne vient pas de mon imprimante qui n'est plus reconnue

est ce que les virus sont encore là ou est eux qui ont endommagé mon ordi ?

j'ai des points jaunes mais pas devant usb

je vais rallumer mon ordi car il faut du temps pour qu'il fonctionne presque normalement pour avoir acces à la souris

je reviens dès qu'il marche

j'ai des points jaunes mais pas devant usb

il ne devrait pas y en avoir

vas ici https://www.touslesdrivers.com/
onglet mes drivers
installes l'active X

il va scanné ton pc et te proposer, j'espère ce qu'il te manque

j'ai des point ! jaunes devant

splitter audio du noyau microsoft

suppresseur d4echo acoustique

synthétiseur de table se sons

aussi
mélangeur audio wave de noyau microsoft

ou se trouve active x
est ce que je dois installer window 32 ou 64

je ne sais pas si avast s'est bien désisntallé car il a l'air toujours là

voici le rapport


Avira AntiVir Personal
Date de création du fichier de rapport : lundi 12 avril 2010 20:05

La recherche porte sur 1265407 souches de virus.

Détenteur de la licence : Avira AntiVir Personal - FREE Antivirus
Numéro de série : 0000149996-ADJIE-0000001
Plateforme : Windows XP
Version de Windows : (Service Pack 3) [5.1.2600]
Mode Boot : Mode sans échec avec assistance réseau
Identifiant : Administrateur
Nom de l'ordinateur : JOE

Informations de version :
BUILD.DAT : 9.0.0.74 21698 Bytes 04/12/2009 13:56:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 13/10/2009 09:25:46
AVSCAN.DLL : 9.0.3.0 49409 Bytes 03/03/2009 08:21:02
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 09:35:11
LUKERES.DLL : 9.0.2.0 13569 Bytes 03/03/2009 08:21:31
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 05:35:52
VBASE001.VDF : 7.10.0.1 2048 Bytes 06/11/2009 05:35:56
VBASE002.VDF : 7.10.0.2 2048 Bytes 06/11/2009 05:35:58
VBASE003.VDF : 7.10.0.3 2048 Bytes 06/11/2009 05:36:02
VBASE004.VDF : 7.10.0.4 2048 Bytes 06/11/2009 05:36:04
VBASE005.VDF : 7.10.0.5 2048 Bytes 06/11/2009 05:36:08
VBASE006.VDF : 7.10.0.6 2048 Bytes 06/11/2009 05:36:12
VBASE007.VDF : 7.10.0.7 2048 Bytes 06/11/2009 05:36:16
VBASE008.VDF : 7.10.0.8 2048 Bytes 06/11/2009 05:36:18
VBASE009.VDF : 7.10.0.9 2048 Bytes 06/11/2009 05:36:22
VBASE010.VDF : 7.10.0.10 2048 Bytes 06/11/2009 05:36:30
VBASE011.VDF : 7.10.0.11 2048 Bytes 06/11/2009 05:36:34
VBASE012.VDF : 7.10.0.12 2048 Bytes 06/11/2009 05:36:38
VBASE013.VDF : 7.10.0.13 2048 Bytes 06/11/2009 05:36:40
VBASE014.VDF : 7.10.0.14 2048 Bytes 06/11/2009 05:36:44
VBASE015.VDF : 7.10.0.15 2048 Bytes 06/11/2009 05:36:46
VBASE016.VDF : 7.10.0.16 2048 Bytes 06/11/2009 05:36:48
VBASE017.VDF : 7.10.0.17 2048 Bytes 06/11/2009 05:36:50
VBASE018.VDF : 7.10.0.18 2048 Bytes 06/11/2009 05:36:54
VBASE019.VDF : 7.10.0.19 2048 Bytes 06/11/2009 05:36:56
VBASE020.VDF : 7.10.0.20 2048 Bytes 06/11/2009 05:36:58
VBASE021.VDF : 7.10.0.21 2048 Bytes 06/11/2009 05:37:00
VBASE022.VDF : 7.10.0.22 2048 Bytes 06/11/2009 05:37:04
VBASE023.VDF : 7.10.0.23 2048 Bytes 06/11/2009 05:37:06
VBASE024.VDF : 7.10.0.24 2048 Bytes 06/11/2009 05:37:10
VBASE025.VDF : 7.10.0.25 2048 Bytes 06/11/2009 05:37:12
VBASE026.VDF : 7.10.0.26 2048 Bytes 06/11/2009 05:37:14
VBASE027.VDF : 7.10.0.27 2048 Bytes 06/11/2009 05:37:16
VBASE028.VDF : 7.10.0.28 2048 Bytes 06/11/2009 05:37:18
VBASE029.VDF : 7.10.0.29 2048 Bytes 06/11/2009 05:37:20
VBASE030.VDF : 7.10.0.30 2048 Bytes 06/11/2009 05:37:22
VBASE031.VDF : 7.10.0.33 2048 Bytes 06/11/2009 05:37:24
Version du moteur : 8.2.1.59
AEVDF.DLL : 8.1.1.2 106867 Bytes 08/11/2009 05:38:52
AESCRIPT.DLL : 8.1.2.43 528764 Bytes 08/11/2009 05:38:48
AESCN.DLL : 8.1.2.5 127346 Bytes 08/11/2009 05:38:46
AESBX.DLL : 8.1.1.1 246132 Bytes 08/11/2009 05:38:44
AERDL.DLL : 8.1.3.2 479604 Bytes 08/11/2009 05:38:42
AEPACK.DLL : 8.2.0.3 422261 Bytes 08/11/2009 05:38:40
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 08/11/2009 05:38:38
AEHEUR.DLL : 8.1.0.178 2093431 Bytes 08/11/2009 05:38:34
AEHELP.DLL : 8.1.7.0 237940 Bytes 08/11/2009 05:38:30
AEGEN.DLL : 8.1.1.71 364916 Bytes 08/11/2009 05:38:28
AEEMU.DLL : 8.1.1.0 393587 Bytes 08/11/2009 05:38:26
AECORE.DLL : 8.1.8.2 184694 Bytes 08/11/2009 05:38:24
AEBB.DLL : 8.1.0.3 53618 Bytes 08/11/2009 05:38:20
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 06:47:30
AVPREF.DLL : 9.0.3.0 44289 Bytes 26/08/2009 13:13:31
AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 12:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 07/11/2008 13:24:42
AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 13:05:22
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 08:36:37
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 13:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 06:20:57
NETNT.DLL : 9.0.0.0 11521 Bytes 07/11/2008 13:40:59
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 17/06/2009 11:44:26
RCTEXT.DLL : 9.0.73.0 88321 Bytes 02/11/2009 14:58:32

Configuration pour la recherche actuelle :
Nom de la tâche...............................: Bref contrôle système après installation
Fichier de configuration......................: c:\program files\avira\antivir desktop\setupprf.dat
Documentation.................................: bas
Action principale.............................: interactif
Action secondaire.............................: ignorer
Recherche sur les secteurs d'amorçage maître..: marche
Recherche sur les secteurs d'amorçage.........: marche
Recherche dans les programmes actifs..........: marche
Recherche en cours sur l'enregistrement.......: marche
Recherche de Rootkits.........................: arrêt
Contrôle d'intégrité de fichiers système......: arrêt
Fichier mode de recherche.....................: Sélection de fichiers intelligente
Recherche sur les archives....................: marche
Limiter la profondeur de récursivité..........: 20
Archive Smart Extensions......................: marche
Heuristique de macrovirus.....................: marche
Heuristique fichier...........................: élevé

Début de la recherche : lundi 12 avril 2010 20:05

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avconfig.exe' - '1' module(s) sont contrôlés
Processus de recherche 'notepad.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'setup.exe' - '1' module(s) sont contrôlés
Processus de recherche 'presetup.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avira_antivir_personal_fr.exe' - '1' module(s) sont contrôlés
Processus de recherche 'firefox.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'19' processus ont été contrôlés avec '19' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
[INFO] Aucun virus trouvé !

La recherche sur les secteurs d'amorçage commence :

La recherche sur les renvois aux fichiers exécutables (registre) commence :
Le registre a été contrôlé ( '54' fichiers).



Fin de la recherche : lundi 12 avril 2010 20:05
Temps nécessaire: 00:17 Minute(s)

La recherche a été effectuée intégralement

0 Les répertoires ont été contrôlés
470 Des fichiers ont été contrôlés
0 Des virus ou programmes indésirables ont été trouvés
0 Des fichiers ont été classés comme suspects
0 Des fichiers ont été supprimés
0 Des virus ou programmes indésirables ont été réparés
0 Les fichiers ont été déplacés dans la quarantaine
0 Les fichiers ont été renommés
0 Impossible de contrôler des fichiers
470 Fichiers non infectés
3 Les archives ont été contrôlées
0 Avertissements
0 Consignes

avast est désactivé mais toujours présent dans programme

l'ordi a mis un peu moins de temps pour retrouver ses fonctions car au démarrage c'est toujours bloqué

par contre le port usb ne marche toujours pas

j'ai fait comme tu m'a dit mais je n'ai rien vu qui m'indique qu'il est désinstallé je ne sais pas si cela a marché, si je le désinstalle par supprimé un programme c'est pas bien ?

c'est mieux avec l'utilitaire fourni
https://www.commentcamarche.net/telecharger/securite/22859-utilitaire-de-desinstallation-de-avast/

...sinon fais le ainsi

là je l'ai désinstallé

si on n'arrive pas a faire mieux me conseilles tu d'aller voir un dépanneur ?

je te remercie infiniment d'avoir passé du temps sur mon problème

mais si c'est plus grave je ne sais pas quoi faire sauf tout remettre à 0

mais est là cela remarchera comme avant ???

voilà j'ai pas de lignes rouges

a demain

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-12 22:28:44
Windows 5.1.2600 Service Pack 3
Running: eunioner.exe; Driver: C:\DOCUME~1\Joseline\LOCALS~1\Temp\pgtdypow.sys


---- System - GMER 1.0.15 ----

SSDT F7CB5D9E ZwCreateKey
SSDT F7CB5D94 ZwCreateThread
SSDT F7CB5DA3 ZwDeleteKey
SSDT F7CB5DAD ZwDeleteValueKey
SSDT F7CB5DB2 ZwLoadKey
SSDT F7CB5D80 ZwOpenProcess
SSDT F7CB5D85 ZwOpenThread
SSDT F7CB5DBC ZwReplaceKey
SSDT F7CB5DB7 ZwRestoreKey
SSDT F7CB5DA8 ZwSetValueKey
SSDT F7CB5D8F ZwTerminateProcess

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 kbfiltr.sys (Example Keyboard Filter Driver/Windows (R) Codename Longhorn DDK provider)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 kbfiltr.sys (Example Keyboard Filter Driver/Windows (R) Codename Longhorn DDK provider)

Device \FileSystem\Fastfat \Fat A9269D20

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 29: copy of MBR

---- EOF - GMER 1.0.15 ----

Désactive tes protections et coupe la connexion. (Antivirus et antispywares, HIPS et autre résident)

COMMENT couper les connexions, ai je autre chose qu'un antivirus et pare feu ?

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 29 !

pour avenger j'ai fait comme tu m'a dit mais rien ne se passe le scan ne se fait pas et le pc ne redémarre pas

est ce que tu pense comme ordinateur informatique qui m'a répondu plus haut ?

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "jfcrsce" found!
ImagePath: system32\drivers\ykojidq.sys
Start Type: 0 (Boot)

Rootkit scan completed.


Warning: Invalid contents in ServiceGroupOrder key!
There may be a driver loading earlier than Avenger!


Completed script processing.

*******************

Finished! Terminate.



Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "jfcrsce" found!
ImagePath: system32\drivers\ykojidq.sys
Start Type: 0 (Boot)

Hidden driver "usdumru" found!
Could not open driver usdumru for rootkit scan. Error:c0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Rootkit scan completed.


Warning: Invalid contents in ServiceGroupOrder key!
There may be a driver loading earlier than Avenger!


Completed script processing.

*******************

Finished! Terminate.



Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.

ok s'il n'y a plus de virus

mais pense tu que si je mets mon lecteur cd en mode sans echec il pourrait marcher pour une réparation

donne moi les indication à suivre si on peut réparer avant tout

merci encore du mal que tu te donne