Comment eliminer winfixer

salut

est ce que tu peux faire analyser ce fichier:
C:\WINNT\system32\ntwdm.exe
ici:
http://www.virustotal.com/xhtml/virustotal_en.html
ou là:
http://virusscan.jotti.org/

et dis moi s'il trouve quelque chose

a+

Salut,
voici la réponse de http://www.virustotal.com/xhtml/virustotal_en.html

Antivirus Version Update Result
AntiVir 6.31.1.0 08.17.2005 no virus found
Avast 4.6.695.0 08.17.2005 no virus found
AVG 718 08.17.2005 no virus found
Avira 6.31.1.0 08.17.2005 no virus found
BitDefender 7.0 08.17.2005 no virus found
CAT-QuickHeal 7.03 08.17.2005 no virus found
ClamAV devel-20050725 08.17.2005 no virus found
DrWeb 4.32b 08.17.2005 no virus found
eTrust-Iris 7.1.194.0 08.17.2005 no virus found
eTrust-Vet 11.9.1.0 08.17.2005 no virus found
Fortinet 2.41.0.0 08.17.2005 no virus found
F-Prot 3.16c 08.17.2005 no virus found
Ikarus 0.2.59.0 08.17.2005 no virus found
Kaspersky 4.0.2.24 08.17.2005 no virus found
McAfee 4561 08.17.2005 no virus found
NOD32v2 1.1195 08.16.2005 no virus found
Norman 5.70.10 08.17.2005 no virus found
Panda 8.02.00 08.17.2005 no virus found
Sophos 3.96.0 08.17.2005 no virus found
Sybari 7.5.1314 08.17.2005 no virus found
Symantec 8.0 08.17.2005 no virus found
TheHacker 5.8.2.090 08.17.2005 no virus found
VBA32 3.10.4 08.17.2005 no virus found

et la réponse de

File: NTVDM.EXE
Status: OK
MD5 2d6255c7b94a6fcc901ae1f7c052cea3
Packers detected: -
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing

ce fichier ne semble pas etre infecté
as-tu d'autres idees

c'est pas celui là lol

c'est
C:\WINNT\system32\ntwdm.exe

avec un w à la place du v

et Moe c'est dans ce post le O20 qui cloche.

Lol, je savais bien que c'etait pour toi mais je ne savais plus ou...lol...

vive les chameaux, trop de fatigue, je repars.

A+

tu as repris le boulot ou il te reste encore du temps pour recupérer ?

tu parles, je reprends Lundi prochain mais je ne sais meme plus l'adresse du bureau alors je crois que je vais reprendre en interim jusqu'à ce qu'il y ai une amelioration... mais je ne sais quand elle va venir.

autant pour moi je n'y vois plus rien

par contre je ne trouve pas de fichier ntwdm.exe dans le répertoire
C:\WINNT\system32 ni sur le disque C:\ d'ailleurs

tu as bien affiché les fichiers cachés??

si non a faire

oui je l'ai fait

bon

telecharge l2mfix ici:
http://www.downloads.subratam.org/l2mfix.exe
ou ici:
http://www.atribune.org/downloads/l2mfix.exe

Double clic sur l2mfix.exe pour lancer l'extraction
Dans le dossier l2mfix, double clic sur l2mfix.bat, appuie sur n'impote quelle touche et choisis l'option #1 (et pas autre chose) et valide avec la touche entrée.
Le bloc note va s'ouvrir avec le resultat du scan.
Fais un copier coller du résultat ici

voici le résultat du scan
L2MFIX find log 1.03c
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellCompatibility]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\wZvemsp.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{9A6290E1-836D-B060-4E2B-D8197DC6E7CA}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'interpr‚teur de commandes pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="Extension du Panneau de configuration PlusPack"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'interpr‚teur de commandes"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'interpr‚teur de commandes pour les objets Microsoft Windows Network"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'interpr‚teur de commandes pour la compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension du shell d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'interpr‚teur de commandes pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extension de l'interpr‚teur de commande pour Windows Script Host"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau et accŠs … distance"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{1A9BA3A0-143A-11CF-8350-444553540000}"="Dossier favori du shell"
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="Poste de travail"
"{86747AC0-42A0-1069-A2E6-08002B30309D}"="Porte-documents"
"{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Raccourci vers le dossier"
"{12518493-00B2-11d2-9FA5-9E3420524153}"="Volume mont‚"
"{21B22460-3AEA-1069-A2DC-08002B30309D}"="Extension de la page de propri‚t‚s des fichiers"
"{B091E540-83E3-11CF-A713-0020AFD79762}"="Page des types de fichiers"
"{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="Gestionnaire des types de fichiers MIME"
"{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Service Copier vers Microsoft"
"{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Service D‚placer vers Microsoft"
"{13709620-C279-11CE-A49E-444553540000}"="Service d'automatisation de l'interface"
"{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation Folder View"
"{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Menu D‚marrer"
"{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Service SendTo Microsoft"
"{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Service Nouvel objet Microsoft"
"{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="Ouvrir avec le gestionnaire de menu contextuel"
"{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Afficher les extensions HTML du Panneau de configuration"
"{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop"
"{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Extension de la page de propri‚t‚s des options des dossiers"
"{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon"
"{4657278A-411B-11d2-839A-00C04FD918D0}"="Application d'aide du systŠme pour le glisser-d‚placer"
"{A470F8CF-A1E8-4f65-8335-227475AA5C46}"="Ajouter l'‚l‚ment de cryptage dans les menus contextuels de l'Explorateur"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
"{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Dossier Bureau"
"{5b4dae26-b807-11d0-9815-00c04fd91972}"="Bande de menus"
"{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Suivi du menu Shell"
"{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site"
"{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Barre du Bureau"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Liens"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7487cd30-f71a-11d0-9ea7-00805f714772}"="Image miniature"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Miniatures"
"{EAB841A0-9550-11CF-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Extracteur de miniatures des filtres graphiques Office"
"{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'application du shell"
"{0B124F8C-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Menu Fichiers hors connexion"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Options du dossier Fichiers hors connexion"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{FED7043D-346A-414D-ACD7-550D052499A7}"="dBpowerAMP Music Converter 1"
"{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}"="dBpowerAMP Music Converter"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{472083B0-C522-11CF-8763-00608CC02F24}"="avast"
"{24EAEBCF-8ADE-412D-BDD4-94D587871E75}"=""
"{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}"=""
"{ACBB7531-E567-456C-AC20-D84D91A3E4A8}"=""
"{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{24EAEBCF-8ADE-412D-BDD4-94D587871E75}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{24EAEBCF-8ADE-412D-BDD4-94D587871E75}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{24EAEBCF-8ADE-412D-BDD4-94D587871E75}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{24EAEBCF-8ADE-412D-BDD4-94D587871E75}\InprocServer32]
@="C:\\WINNT\\system32\\wZvemsp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}\InprocServer32]
@="C:\\WINNT\\system32\\fQxcom.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{ACBB7531-E567-456C-AC20-D84D91A3E4A8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ACBB7531-E567-456C-AC20-D84D91A3E4A8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ACBB7531-E567-456C-AC20-D84D91A3E4A8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ACBB7531-E567-456C-AC20-D84D91A3E4A8}\InprocServer32]
@="C:\\WINNT\\system32\\ajicap32.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINNT\SYSTEM32\
ajicap32.dll Wed 17 Aug 2005 17:39:56 ..S.R 417 792 408,00 K
iymui.dll Wed 17 Aug 2005 15:48:06 ..... 417 792 408,00 K
impborl.dll Mon 4 Jul 2005 18:34:58 A.... 12 288 12,00 K
arsnw.dll Mon 4 Jul 2005 19:32:58 A.... 417 792 408,00 K
kndfc.dll Mon 4 Jul 2005 22:29:48 A.... 417 792 408,00 K
imengine.dll Tue 5 Jul 2005 0:06:38 A.... 417 792 408,00 K
dbime.dll Tue 5 Jul 2005 0:07:30 A.... 417 792 408,00 K
msc40u.dll Tue 5 Jul 2005 0:07:56 A.... 417 792 408,00 K
nkevent.dll Tue 5 Jul 2005 0:08:44 A.... 417 792 408,00 K
mcwstr10.dll Tue 5 Jul 2005 0:11:38 A.... 417 792 408,00 K
dzvmgr.dll Tue 5 Jul 2005 0:12:34 A.... 417 792 408,00 K
wzvemsp.dll Sat 23 Jul 2005 11:46:14 ..S.R 417 792 408,00 K

12 items found: 12 files (2 H/S), 0 directories.
Total of file sizes: 4 608 000 bytes 4,39 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 6C8E-FA5C

R‚pertoire de C:\WINNT\System32

17/08/2005 17:39 417ÿ792 ajicap32.dll
23/07/2005 11:46 417ÿ792 wZvemsp.dll
28/12/2000 16:59 <DIR> dllcache
2 fichier(s) 835ÿ584 octets
1 R‚p(s) 1ÿ297ÿ915ÿ904 octets libres

ok, maintenant relance le et choisis l'opion 2
il va te demander pour redemarrer le pc, laisse le faire et accepte
une fois redemarrer il va travailler un moment et afficher un rapport dans le bloc note.(si le bloc note ne s'ouvre pas regarde dans le dossier l2mfix et ouvre le fichier log.txt)
poste ce rapport + un nouvel hijack

a+

voici le rapport l2mfix
L2Mfix 1.03c

Running From:
C:\tmp\l2mfix

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE

Setting registry permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry

Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrateurs
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE

Setting up for Reboot

Starting Reboot!

C:\tmp\l2mfix
System Rebooted!

Running From:
C:\tmp\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1188 'explorer.exe'
Killing PID 1188 'explorer.exe'
Error 0x5 : Accès refusé.

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1256 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINNT\system32\ajicap32.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\ajicap32.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\iymui.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\iymui.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\arsnw.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\arsnw.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\kndfc.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\kndfc.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\imengine.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\imengine.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\dbime.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\dbime.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\msc40u.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\msc40u.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\nkevent.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\nkevent.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\mcwstr10.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\mcwstr10.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\dzvmgr.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\dzvmgr.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\wZvemsp.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\wZvemsp.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\oqbc16gt.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\oqbc16gt.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\guard.tmp
1 fichier(s) copi‚(s).
Backing Up: C:\WINNT\system32\guard.tmp
1 fichier(s) copi‚(s).
deleting: C:\WINNT\system32\ajicap32.dll
Successfully Deleted: C:\WINNT\system32\ajicap32.dll
deleting: C:\WINNT\system32\ajicap32.dll
Successfully Deleted: C:\WINNT\system32\ajicap32.dll
deleting: C:\WINNT\system32\iymui.dll
Successfully Deleted: C:\WINNT\system32\iymui.dll
deleting: C:\WINNT\system32\iymui.dll
Successfully Deleted: C:\WINNT\system32\iymui.dll
deleting: C:\WINNT\system32\arsnw.dll
Successfully Deleted: C:\WINNT\system32\arsnw.dll
deleting: C:\WINNT\system32\arsnw.dll
Successfully Deleted: C:\WINNT\system32\arsnw.dll
deleting: C:\WINNT\system32\kndfc.dll
Successfully Deleted: C:\WINNT\system32\kndfc.dll
deleting: C:\WINNT\system32\kndfc.dll
Successfully Deleted: C:\WINNT\system32\kndfc.dll
deleting: C:\WINNT\system32\imengine.dll
Successfully Deleted: C:\WINNT\system32\imengine.dll
deleting: C:\WINNT\system32\imengine.dll
Successfully Deleted: C:\WINNT\system32\imengine.dll
deleting: C:\WINNT\system32\dbime.dll
Successfully Deleted: C:\WINNT\system32\dbime.dll
deleting: C:\WINNT\system32\dbime.dll
Successfully Deleted: C:\WINNT\system32\dbime.dll
deleting: C:\WINNT\system32\msc40u.dll
Successfully Deleted: C:\WINNT\system32\msc40u.dll
deleting: C:\WINNT\system32\msc40u.dll
Successfully Deleted: C:\WINNT\system32\msc40u.dll
deleting: C:\WINNT\system32\nkevent.dll
Successfully Deleted: C:\WINNT\system32\nkevent.dll
deleting: C:\WINNT\system32\nkevent.dll
Successfully Deleted: C:\WINNT\system32\nkevent.dll
deleting: C:\WINNT\system32\mcwstr10.dll
Successfully Deleted: C:\WINNT\system32\mcwstr10.dll
deleting: C:\WINNT\system32\mcwstr10.dll
Successfully Deleted: C:\WINNT\system32\mcwstr10.dll
deleting: C:\WINNT\system32\dzvmgr.dll
Successfully Deleted: C:\WINNT\system32\dzvmgr.dll
deleting: C:\WINNT\system32\dzvmgr.dll
Successfully Deleted: C:\WINNT\system32\dzvmgr.dll
deleting: C:\WINNT\system32\wZvemsp.dll
Successfully Deleted: C:\WINNT\system32\wZvemsp.dll
deleting: C:\WINNT\system32\wZvemsp.dll
Successfully Deleted: C:\WINNT\system32\wZvemsp.dll
deleting: C:\WINNT\system32\oqbc16gt.dll
Successfully Deleted: C:\WINNT\system32\oqbc16gt.dll
deleting: C:\WINNT\system32\oqbc16gt.dll
Successfully Deleted: C:\WINNT\system32\oqbc16gt.dll
deleting: C:\WINNT\system32\guard.tmp
Successfully Deleted: C:\WINNT\system32\guard.tmp
deleting: C:\WINNT\system32\guard.tmp
Successfully Deleted: C:\WINNT\system32\guard.tmp

Desktop.ini sucessfully removed

Zipping up files for submission:
adding: ajicap32.dll (deflated 48%)
adding: iymui.dll (deflated 48%)
adding: arsnw.dll (deflated 48%)
adding: kndfc.dll (deflated 48%)
adding: imengine.dll (deflated 48%)
adding: dbime.dll (deflated 48%)
adding: msc40u.dll (deflated 48%)
adding: nkevent.dll (deflated 48%)
adding: mcwstr10.dll (deflated 48%)
adding: dzvmgr.dll (deflated 48%)
adding: wZvemsp.dll (deflated 48%)
adding: oqbc16gt.dll (deflated 48%)
adding: guard.tmp (deflated 48%)
adding: echo.reg (deflated 6%)
adding: clear.reg (deflated 46%)
adding: desktop.ini (stored 0%)
adding: readme.txt (deflated 50%)
adding: direct.txt (stored 0%)
adding: report.txt (deflated 64%)
adding: lo2.txt (deflated 85%)
adding: test2.txt (deflated 27%)
adding: test3.txt (deflated 27%)
adding: test5.txt (deflated 27%)
adding: test.txt (deflated 87%)
adding: xfind.txt (deflated 83%)
adding: backregs/notibac.reg (deflated 63%)
adding: backregs/shell.reg (deflated 75%)
adding: backregs/24EAEBCF-8ADE-412D-BDD4-94D587871E75.reg (deflated 70%)
adding: backregs/E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82.reg (deflated 70%)
adding: backregs/ACBB7531-E567-456C-AC20-D84D91A3E4A8.reg (deflated 70%)

Restoring Registry Permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!

Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE

Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... failed (GetAccountSid(Administrators)=1332

Restoring Windows Update Certificates.:

deleting local copy: ajicap32.dll
deleting local copy: ajicap32.dll
deleting local copy: iymui.dll
deleting local copy: iymui.dll
deleting local copy: arsnw.dll
deleting local copy: arsnw.dll
deleting local copy: kndfc.dll
deleting local copy: kndfc.dll
deleting local copy: imengine.dll
deleting local copy: imengine.dll
deleting local copy: dbime.dll
deleting local copy: dbime.dll
deleting local copy: msc40u.dll
deleting local copy: msc40u.dll
deleting local copy: nkevent.dll
deleting local copy: nkevent.dll
deleting local copy: mcwstr10.dll
deleting local copy: mcwstr10.dll
deleting local copy: dzvmgr.dll
deleting local copy: dzvmgr.dll
deleting local copy: wZvemsp.dll
deleting local copy: wZvemsp.dll
deleting local copy: oqbc16gt.dll
deleting local copy: oqbc16gt.dll
deleting local copy: guard.tmp
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

The following are the files found:
****************************************************************************
C:\WINNT\system32\ajicap32.dll
C:\WINNT\system32\ajicap32.dll
C:\WINNT\system32\iymui.dll
C:\WINNT\system32\iymui.dll
C:\WINNT\system32\arsnw.dll
C:\WINNT\system32\arsnw.dll
C:\WINNT\system32\kndfc.dll
C:\WINNT\system32\kndfc.dll
C:\WINNT\system32\imengine.dll
C:\WINNT\system32\imengine.dll
C:\WINNT\system32\dbime.dll
C:\WINNT\system32\dbime.dll
C:\WINNT\system32\msc40u.dll
C:\WINNT\system32\msc40u.dll
C:\WINNT\system32\nkevent.dll
C:\WINNT\system32\nkevent.dll
C:\WINNT\system32\mcwstr10.dll
C:\WINNT\system32\mcwstr10.dll
C:\WINNT\system32\dzvmgr.dll
C:\WINNT\system32\dzvmgr.dll
C:\WINNT\system32\wZvemsp.dll
C:\WINNT\system32\wZvemsp.dll
C:\WINNT\system32\oqbc16gt.dll
C:\WINNT\system32\oqbc16gt.dll
C:\WINNT\system32\guard.tmp
C:\WINNT\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{24EAEBCF-8ADE-412D-BDD4-94D587871E75}"=-
"{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}"=-
"{ACBB7531-E567-456C-AC20-D84D91A3E4A8}"=-
[-HKEY_CLASSES_ROOT\CLSID\{24EAEBCF-8ADE-412D-BDD4-94D587871E75}]
[-HKEY_CLASSES_ROOT\CLSID\{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}]
[-HKEY_CLASSES_ROOT\CLSID\{ACBB7531-E567-456C-AC20-D84D91A3E4A8}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
****************************************************************************

et le nouveau hijack
Logfile of HijackThis v1.99.1
Scan saved at 20:44:50, on 17/08/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\System32\ZipToA.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINNT\loadqm.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\WINNT\explorer.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O3 - Toolbar: @msdxmLC.dll,-1@1036,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Détecteur de disque] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CreativeMixer] C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE /t
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Service] C:\WINNT\system32\ntwdm.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Smile Brush] "C:\Program Files\Smile Brush\Smile Brush.exe" a
O4 - Global Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINNT\System32\ZipToA.exe

maintenant, vérifie ces dossiers existent sur ton pc:
C:\Program files\OutLaster
ou
C:\Programme\OutLaster

ensuite fais un nettoyage de tous les fichier temporaires c'est important, et en mode sans echec si tu peux:

* C:\Documents and Settings\ton compte\Local Settings\Temp
* C:\Documents and Settings\tous les autres comptes\Local Settings\Temp
* C:\Temp
* C:\Windows\Temp
vider tout le contenu de ces dossiers.

redemarre le pc et dis moi si tu as toujours des problemes avec winfixer

a+

pour l'instant je n'ai pas de fenetre "winfixer " qui s'ouvre

est-ce que tu pourrais m'expliquer un peu ce qui s'est passé et quoi faire pour se protéger de ce genre de probleme à l'avenir

merci

maintient ton systeme et ton navigateur le plus à jour possible via windows update.

pour winfixer il est assez nouveau, ca peut venir d'un controle active x que tu as accepté, ou d'une page piégé qui exploite une des nombreuses failles d'internet explorer et qui permet d'executer un fichier à distance.

dans ton cas ce serait plutot la seconde possibilité, personnellement j'ai laissé tomber IE et remplacé par mozilla ou firefox.
ils ne sont pas infaillibles mais leurs editeurs corrigent tres rapidement une faille lorsqu'elle est decouverte contrairement à microsoft.
le seul inconvenient c'est qu'il faut verifier souvent si une nouvelle version existe mais tu ne pert ni tes favoris ni tes reglages.
http://frenchmozilla.sourceforge.net/

par contre je vois dans ton hijack C:\WINNT\system32\ntwdm.exe

essaye de faire ceci:
va sur ce site
http://virusscan.jotti.org/
clic sur parcourir, mais au lieu de rechercher manuellement le fichier, copie et colle ceci:
C:\WINNT\system32\ntwdm.exe
dans "nom du fichier"
valide et clic sur submit

et dis moi s'il trouve quelque chose

voici ce que j'obtiens

The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

et aussi cela
Last file scanned at least one scanner reported something about: Tibia3D.rar, detected by:

Scanner Malware name
AntiVir TR/Spy.Perfloger.T
ArcaVir X
Avast X
AVG Antivirus X
BitDefender X
ClamAV X
Dr.Web X
F-Prot Antivirus X
Fortinet X
Kaspersky Anti-Virus not-a-virus:Monitor.Win32.Perflogger.12
NOD32 X
Norman Virus Control X
UNA X
VBA32 X

mouais, je trouve pas trop d'infos précises sur ce fichier.

si tu as le temps ou quand tu l'auras, fais un scan av en ligne ici:
http://webscanner.kaspersky.fr/
et/ou là
http://www.bitdefender.fr

et poste le rapport

a+

bonjour,

voici les rapports de scan bitfinder et kaspery:apparament rien à signaler. En tout cas merci pour ton aide
a+

BitDefender Online Scanner - Rapport virus en temps réel

Généré à: Thu, Aug 18, 2005 - 11:12:55

--------------------------------------------------------------------------------

Info d'analyse

Fichiers scannés
94272

Infectés Fichiers
0

Virus Détectés

Aucun virus trouvé.

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Thursday, August 18, 2005 01:42:02
Operating System: Microsoft Windows 2000 Professional, Service Pack 2 (Build 2195)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 17/08/2005
Kaspersky Anti-Virus database records: 135666
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 26301
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 5900 sec
No malware has been detected. The sections that have been scanned are CLEAN.

Scan process completed.

--------------------------------------------------------------------------------

Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.