A laide virus

salut :

Télécharge OTL de OLDTimer

▶ enregistre le sur ton Bureau.

▶ Double clic ( pour vista / 7 => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

▶ Coche les 2 cases Lop et Purity

▶ Coche la case devant tous les utilisateurs

▶ règle age du fichier sur "60 jours"

▶ dans la moitié gauche , mets tout sur "tous"

ne modifie pas ceci :

"fichiers créés" et "fichiers Modifiés"

▶Clic sur Analyse.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

▶▶▶ NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier ci-dessus.

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

▶ Copie ce lien dans ta réponse.

▶▶ Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.

si je peux pas aller sur le net je fais comment car jessais de me connecter et cela fonctionne pas
es ce ce virus qui menpeche ma connection a internet

merci

jai tout fais de ce que tu ma ecris je tenvois la copie du lien

http://www.cijoint.fr/cjlink.php?file=cj201005/cij8KV3j7G.txt avec mon autre ordi jai pu aller chercher tout ca sur internet en mettant tout sur cd

ensuite je fais quoi avec ce virus

merci et en passant tu explique tres bien

Choucas

jai oublié l autre extra le voici

http://www.cijoint.fr/cjlink.php?file=cj201005/ciji5uwuAi.txt

Choucas

tu as un rogue et plusieurs cochonneires qu'on va deja virer

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

▶ Télécharge List_Kill'em et enregistre le sur ton bureau

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

Laisse coché :

♦ Executer Shortcut
♦ Executer List_Kill'em

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis l'option Search

▶ laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

encore une autre question jai finalement l internet je peux me connecter a msn mais quand je clique sur explorer ou que je veux aller sur un site ca fonctionne pas il ecrit internet explorer ne peux pas afficher cette pas ge Web

c'est normal vu l infection que tu as ;)

https://forums.commentcamarche.net/forum/affich-17610087-a-laide-virus#5

faut il que je reste la connection internet dessus ou bien je la deconnecte

pour la poster cest a quelle adresse ??? et ensuite je fais quoi ?

Désolé pour toute ces questions je suis loin detre une pro mais jaime bien apprendre .
Ca fais quelque temps que je viens sur ce site et jen parles a mes amis car vous faites (ceux qui repond a toutes les questions ) du bon travail

merci encore
choucas

tu peux laisser internet pour l instant

pour poster lol tu colles le contenu du texte qui s ouvrira seul en fin de scan ici dans ta reponse :)

HKLM\SYSTEM\CS1\Services\Tcpip\..\{EDF59F60-E6C7-4E28-A66E-D2A4D20E90F4}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3B050811-DCE2-4634-9682-3899C104DB39}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{EDF59F60-E6C7-4E28-A66E-D2A4D20E90F4}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3B050811-DCE2-4634-9682-3899C104DB39}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{EDF59F60-E6C7-4E28-A66E-D2A4D20E90F4}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

voici le contenu et apres je fais quoi ???

Merci
Choucas

tu n'as pas lancé le programme avec le clic droit "executer en tant que......"

relancé le programe de List_Kill'em que tu parles ? et en tant que administrateur

Pour tant il me demande l autorisation

je vais le refaire
merci

ce n'est pas la meme chose :)

je tenvois les autres rapports

List'em by g3n-h@ckm@n 1.7.2.7

User : Sylvie (Administrateurs)
Update on 04/05/2010 by g3n-h@ckm@n ::::: 00.00
Start at: 13:09:16 | 2010-05-04

Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz
Microsoft® Windows Vista(TM) Édition Familiale Basique (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 43,95 Go (1,95 Go free) [OS_Install] | NTFS
D:\ -> Disque fixe local | 181,13 Go (170,35 Go free) [Data] | NTFS
F:\ -> Disque CD-ROM
G:\ -> Disque CD-ROM

Boot: Normal
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Intel\AMT\UNS.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Protector Suite QL\upeksvr.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\Sylvie\AppData\Local\MétéoMédia\MétéoÉclair\WeatherEye.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\findstr.exe
C:\Windows\system32\ctfmon.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
swg REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
WeatherEye REG_SZ C:\Users\Sylvie\AppData\Local\MétéoMédia\MétéoÉclair\WeatherEye.exe
igndlm.exe REG_SZ C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
uTorrent Turbo Booster REG_SZ "D:\uTorrent Turbo Booster\uTorrent Turbo Booster.exe" -tray
LosAlamos REG_SZ rundll32.exe C:\Windows\system32\sshnas.dll,AddAtomAW
J8RPLTROBQ REG_SZ C:\Users\Sylvie\AppData\Local\Temp\c.exe
DAEMON Tools Lite REG_SZ "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
C:\Windows\System32\drivers\atapi.sys :
MD5 :: [1f05b78ab91c9075565a9d8a4b880bc4]
SHA256 :: [737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd]

C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys :
MD5 :: [1f05b78ab91c9075565a9d8a4b880bc4]
SHA256 :: [737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd]

C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys :
MD5 :: [4f4fcb8b6ea06784fb6d475b7ec7300f]
SHA256 :: [6202d85c9a75e3f01f5f94f069c4cd8a2b9295a182301eae5940ec3bc2c1d896]

C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys :
MD5 :: [2d9c903dc76a66813d350a562de40ed9]
SHA256 :: [82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3]

C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys :
MD5 :: [2d9c903dc76a66813d350a562de40ed9]
SHA256 :: [82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3]

C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys :
MD5 :: [1f05b78ab91c9075565a9d8a4b880bc4]
SHA256 :: [737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd]

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

=======
Drive :
=======

D'fragmenteur de disque Windows
Copyright (c) 2006 Microsoft Corp.

Rapport d'analyse pour le volume C: OS_Install

Taille du volume = 43.95 Go
Espace libre = 1.96 Go
tendue d'espace libre la plus grande = 270 Mo
Pourcentage de fragmentation des fichiers = 2 %

Remarqueÿ: sur les volumes NTFS, les fragments de fichiers de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.

Il n'est pas n'cessaire de d'fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\ProgramData\LuUninstall.LiveUpdate
Present !! : C:\ProgramData\LuUninstall.LiveUpdate
Present !! : C:\ProgramData\LuUninstall.LiveUpdate
Present !! : C:\ProgramData\LuUninstall.LiveUpdate
Present !! : C:\ProgramData\Trymedia
Present !! : C:\Program Files\Windows Live\Messenger\Riched20.dll
Present !! : C:\Windows\silentOnce.tmp
Present !! : C:\Windows\System32\log.txt
Present !! : C:\Windows\System32\MSWINSCK.OCX
Present !! : C:\Windows\System32\psqlpwd.dll
Present !! : C:\Windows\System32\samsvc.exe
Present !! : C:\Windows\Temp\90AB.tmp
Present !! : C:\Windows\Temp\A84F.tmp
Present !! : C:\Windows\Temp\D432.tmp
Present !! : C:\Windows\Temp\DCC8.tmp
Present !! : C:\Windows\Temp\ddjs9g8gjisghi8gdijgd.tmp
Present !! : C:\Windows\Temp\DMI1209.tmp
Present !! : C:\Windows\Temp\DMI1D6E.tmp
Present !! : C:\Windows\Temp\DMI1E87.tmp
Present !! : C:\Windows\Temp\DMI3FA1.tmp
Present !! : C:\Windows\Temp\DMI7B37.tmp
Present !! : C:\Windows\Temp\DMI8748.tmp
Present !! : C:\Windows\Temp\DMI8861.tmp
Present !! : C:\Windows\Temp\DMI8979.tmp
Present !! : C:\Windows\Temp\DMICE94.tmp
Present !! : C:\Windows\Temp\flaC950.tmp
Present !! : C:\Windows\Temp\flaD7C3.tmp
Present !! : C:\Windows\Temp\GUR22BC.tmp
Present !! : C:\Windows\Temp\GUR62E6.tmp
Present !! : C:\Windows\Temp\GUR82A.tmp
Present !! : C:\Windows\Temp\GUR8999.tmp
Present !! : C:\Windows\Temp\GUR9CEA.tmp
Present !! : C:\Windows\Temp\GURB2F9.tmp
Present !! : C:\Windows\Temp\hs9fajsfgy389joidjfs9eg.tmp
Present !! : C:\Windows\Temp\hu_C1F6.tmp
Present !! : C:\Windows\Temp\is271A.tmp
Present !! : C:\Windows\Temp\is355C.tmp
Present !! : C:\Windows\Temp\is4C32.tmp
Present !! : C:\Windows\Temp\is8686.tmp
Present !! : C:\Windows\Temp\is8EE0.tmp
Present !! : C:\Windows\Temp\isC9DB.tmp
Present !! : C:\Windows\Temp\JET4430.tmp
Present !! : C:\Windows\Temp\JET7898.tmp
Present !! : C:\Windows\Temp\JET8130.tmp
Present !! : C:\Windows\Temp\JET8786.tmp
Present !! : C:\Windows\Temp\JET8C18.tmp
Present !! : C:\Windows\Temp\JET8E69.tmp
Present !! : C:\Windows\Temp\JET950D.tmp
Present !! : C:\Windows\Temp\JET9617.tmp
Present !! : C:\Windows\Temp\JET96F1.tmp
Present !! : C:\Windows\Temp\JET979D.tmp
Present !! : C:\Windows\Temp\JET98C5.tmp
Present !! : C:\Windows\Temp\JET9A1C.tmp
Present !! : C:\Windows\Temp\JET9D47.tmp
Present !! : C:\Windows\Temp\JET9F5A.tmp
Present !! : C:\Windows\Temp\JET9F98.tmp
Present !! : C:\Windows\Temp\JETA3CD.tmp
Present !! : C:\Windows\Temp\JETB54A.tmp
Present !! : C:\Windows\Temp\JETD171.tmp
Present !! : C:\Windows\Temp\JETE983.tmp
Present !! : C:\Windows\Temp\jisfije9fjoiee.tmp
Present !! : C:\Windows\Temp\Set1C79.tmp
Present !! : C:\Windows\Temp\Set4144.tmp
Present !! : C:\Windows\Temp\Set63E2.tmp
Present !! : C:\Windows\Temp\set6426.tmp
Present !! : C:\Windows\Temp\Set8CB7.tmp
Present !! : C:\Windows\Temp\SetB251.tmp
Present !! : C:\Windows\Temp\setF65A.tmp
Present !! : C:\Windows\Temp\TMP5322.tmp
Present !! : C:\Windows\Temp\~DF419.tmp
Present !! : C:\Windows\Temp\~DF5BE6.tmp
Present !! : C:\Windows\Temp\winamp.exe
Present !! : C:\Users\Sylvie\AppData\Local\d3d8caps.dat
Present !! : C:\Users\Sylvie\AppData\Local\d3d9caps.dat
Present !! : C:\Users\Sylvie\AppData\Local\GDIPFONTCACHEV1.DAT
Present !! : C:\Users\Sylvie\Local Settings\Temp\0.zip
Present !! : C:\Users\Sylvie\Local Settings\Temp\1.zip
Present !! : C:\Users\Sylvie\Local Settings\Temp\2.zip
Present !! : C:\Users\Sylvie\Local Settings\Temp\3.zip
Present !! : C:\Users\Sylvie\Local Settings\Temp\a.dat
Present !! : C:\Users\Sylvie\Local Settings\Temp\BB3.tmp
Present !! : C:\Users\Sylvie\Local Settings\Temp\mp0
Present !! : C:\Users\Sylvie\Local Settings\Temp\tdm.log
Present !! : C:\Users\Sylvie\Local Settings\Temp\url.txt
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\bfguni.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\contentDATs.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\FP_PL_MSI_INSTALLER.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\IE8-Setup-Full-Vista.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\ijjiOptimizer.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\jCym.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\PurpleBean.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\SecurityScan_Release.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\Uninstall.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\uttF424.tmp.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\wlsetup-cvr.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\xGle.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\_is1CA6.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\a.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\DefInstAction.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\FW_Register_Plugin_Action.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\isconfig.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\QBackupInst.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\srtspse.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\srtspso.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\srtspsp.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\drm_dialogs.dll
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\GLF2947.tmp.tbAstr.dll
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\tmp5BA.tmp
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\tmp9D95.tmp
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\tmpD0B6.tmp

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\losalamos
Present !! : HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd
Present !! : HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87sdhfush87fsufhuie3fddf
Present !! : HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcexecwin
Present !! : HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd
Present !! : HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87sdhfush87fsufhuie3fddf
Present !! : HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcexecwin
Present !! : HKU\S-1-5-21-3117738710-352053017-3202849153-1000\Software\Microsoft\Windows\CurrentVersion\Run\losalamos
Present !! : HKU\S-1-5-21-3117738710-352053017-3202849153-1000\Software\Microsoft\Windows\CurrentVersion\Run\losalamos
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}
Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{A2BA40A0-74F1-52BD-F411-00B15A2C8953}
Present !! : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}"
Present !! : "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}"
Present !! : "HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}"
Present !! : "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}"
Present !! : "HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A2BA40A0-74F1-52BD-F411-00B15A2C8953}"
Present !! : "HKLM\Software\Trymedia Systems"
Present !! : HKCR\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239}
Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc}
Present !! : HKCR\interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff}
Present !! : HKCR\interface\{cf54be1c-9359-4395-8533-1657cf209cfe}
Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
Present !! : HKCU\SOFTWARE\avsoft
Present !! : HKCU\Software\avsuite
Present !! : HKCU\SOFTWARE\J8RPLTROBQ
Present !! : HKCU\SOFTWARE\LEO0WTUNO7
Present !! : HKCU\SOFTWARE\Microsoft\Handle
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d}
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca}
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca}
Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb}
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a2ba40a0-74f1-52bd-f411-00b15a2c8953}
Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore
Present !! : "HKCU\SOFTWARE\Trymedia Systems"
Present !! : HKCU\SOFTWARE\XML
Present !! : HKLM\SOFTWARE\avsoft
Present !! : HKLM\SOFTWARE\avsuite
Present !! : HKLM\Software\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
Present !! : HKLM\Software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
Present !! : HKLM\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
Present !! : HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
Present !! : HKLM\SYSTEM\ControlSet001\Services\Irmon
Present !! : HKLM\SYSTEM\ControlSet002\Services\Irmon
Present !! : HKLM\SYSTEM\ControlSet003\Services\Irmon
Present !! : HKLM\SYSTEM\ControlSet004\Services\Irmon
Present !! : HKLM\SYSTEM\CurrentControlSet\Services\Irmon

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-04 13:44:43
Windows 6.0.6002 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x859EF1F8]<<
kernel: MBR read successfully
BIOS signateure not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
cval REG_DWORD 1 (0x1)
UacDisableNotify REG_DWORD 0 (0x0)
InternetSettingsDisableNotify REG_DWORD 0 (0x0)
AutoUpdateDisableNotify REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 13:44:45,48

as tu besoin autres choses
jattends la suite
Choucas

je tenvois les autres rapports

List'em by g3n-h@ckm@n 1.7.2.7

User : Sylvie (Administrateurs)
Update on 04/05/2010 by g3n-h@ckm@n ::::: 00.00
Start at: 13:09:16 | 2010-05-04

Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz
Microsoft® Windows Vista(TM) Édition Familiale Basique (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 43,95 Go (1,95 Go free) [OS_Install] | NTFS
D:\ -> Disque fixe local | 181,13 Go (170,35 Go free) [Data] | NTFS
F:\ -> Disque CD-ROM
G:\ -> Disque CD-ROM

Boot: Normal
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Intel\AMT\UNS.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Protector Suite QL\upeksvr.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\Sylvie\AppData\Local\MétéoMédia\MétéoÉclair\WeatherEye.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\findstr.exe
C:\Windows\system32\ctfmon.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
swg REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
WeatherEye REG_SZ C:\Users\Sylvie\AppData\Local\MétéoMédia\MétéoÉclair\WeatherEye.exe
igndlm.exe REG_SZ C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
uTorrent Turbo Booster REG_SZ "D:\uTorrent Turbo Booster\uTorrent Turbo Booster.exe" -tray
LosAlamos REG_SZ rundll32.exe C:\Windows\system32\sshnas.dll,AddAtomAW
J8RPLTROBQ REG_SZ C:\Users\Sylvie\AppData\Local\Temp\c.exe
DAEMON Tools Lite REG_SZ "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
C:\Windows\System32\drivers\atapi.sys :
MD5 :: [1f05b78ab91c9075565a9d8a4b880bc4]
SHA256 :: [737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd]

C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys :
MD5 :: [1f05b78ab91c9075565a9d8a4b880bc4]
SHA256 :: [737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd]

C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys :
MD5 :: [4f4fcb8b6ea06784fb6d475b7ec7300f]
SHA256 :: [6202d85c9a75e3f01f5f94f069c4cd8a2b9295a182301eae5940ec3bc2c1d896]

C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys :
MD5 :: [2d9c903dc76a66813d350a562de40ed9]
SHA256 :: [82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3]

C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys :
MD5 :: [2d9c903dc76a66813d350a562de40ed9]
SHA256 :: [82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3]

C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys :
MD5 :: [1f05b78ab91c9075565a9d8a4b880bc4]
SHA256 :: [737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd]

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

=======
Drive :
=======

D'fragmenteur de disque Windows
Copyright (c) 2006 Microsoft Corp.

Rapport d'analyse pour le volume C: OS_Install

Taille du volume = 43.95 Go
Espace libre = 1.96 Go
tendue d'espace libre la plus grande = 270 Mo
Pourcentage de fragmentation des fichiers = 2 %

Remarqueÿ: sur les volumes NTFS, les fragments de fichiers de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.

Il n'est pas n'cessaire de d'fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\ProgramData\LuUninstall.LiveUpdate
Present !! : C:\ProgramData\LuUninstall.LiveUpdate
Present !! : C:\ProgramData\LuUninstall.LiveUpdate
Present !! : C:\ProgramData\LuUninstall.LiveUpdate
Present !! : C:\ProgramData\Trymedia
Present !! : C:\Program Files\Windows Live\Messenger\Riched20.dll
Present !! : C:\Windows\silentOnce.tmp
Present !! : C:\Windows\System32\log.txt
Present !! : C:\Windows\System32\MSWINSCK.OCX
Present !! : C:\Windows\System32\psqlpwd.dll
Present !! : C:\Windows\System32\samsvc.exe
Present !! : C:\Windows\Temp\90AB.tmp
Present !! : C:\Windows\Temp\A84F.tmp
Present !! : C:\Windows\Temp\D432.tmp
Present !! : C:\Windows\Temp\DCC8.tmp
Present !! : C:\Windows\Temp\ddjs9g8gjisghi8gdijgd.tmp
Present !! : C:\Windows\Temp\DMI1209.tmp
Present !! : C:\Windows\Temp\DMI1D6E.tmp
Present !! : C:\Windows\Temp\DMI1E87.tmp
Present !! : C:\Windows\Temp\DMI3FA1.tmp
Present !! : C:\Windows\Temp\DMI7B37.tmp
Present !! : C:\Windows\Temp\DMI8748.tmp
Present !! : C:\Windows\Temp\DMI8861.tmp
Present !! : C:\Windows\Temp\DMI8979.tmp
Present !! : C:\Windows\Temp\DMICE94.tmp
Present !! : C:\Windows\Temp\flaC950.tmp
Present !! : C:\Windows\Temp\flaD7C3.tmp
Present !! : C:\Windows\Temp\GUR22BC.tmp
Present !! : C:\Windows\Temp\GUR62E6.tmp
Present !! : C:\Windows\Temp\GUR82A.tmp
Present !! : C:\Windows\Temp\GUR8999.tmp
Present !! : C:\Windows\Temp\GUR9CEA.tmp
Present !! : C:\Windows\Temp\GURB2F9.tmp
Present !! : C:\Windows\Temp\hs9fajsfgy389joidjfs9eg.tmp
Present !! : C:\Windows\Temp\hu_C1F6.tmp
Present !! : C:\Windows\Temp\is271A.tmp
Present !! : C:\Windows\Temp\is355C.tmp
Present !! : C:\Windows\Temp\is4C32.tmp
Present !! : C:\Windows\Temp\is8686.tmp
Present !! : C:\Windows\Temp\is8EE0.tmp
Present !! : C:\Windows\Temp\isC9DB.tmp
Present !! : C:\Windows\Temp\JET4430.tmp
Present !! : C:\Windows\Temp\JET7898.tmp
Present !! : C:\Windows\Temp\JET8130.tmp
Present !! : C:\Windows\Temp\JET8786.tmp
Present !! : C:\Windows\Temp\JET8C18.tmp
Present !! : C:\Windows\Temp\JET8E69.tmp
Present !! : C:\Windows\Temp\JET950D.tmp
Present !! : C:\Windows\Temp\JET9617.tmp
Present !! : C:\Windows\Temp\JET96F1.tmp
Present !! : C:\Windows\Temp\JET979D.tmp
Present !! : C:\Windows\Temp\JET98C5.tmp
Present !! : C:\Windows\Temp\JET9A1C.tmp
Present !! : C:\Windows\Temp\JET9D47.tmp
Present !! : C:\Windows\Temp\JET9F5A.tmp
Present !! : C:\Windows\Temp\JET9F98.tmp
Present !! : C:\Windows\Temp\JETA3CD.tmp
Present !! : C:\Windows\Temp\JETB54A.tmp
Present !! : C:\Windows\Temp\JETD171.tmp
Present !! : C:\Windows\Temp\JETE983.tmp
Present !! : C:\Windows\Temp\jisfije9fjoiee.tmp
Present !! : C:\Windows\Temp\Set1C79.tmp
Present !! : C:\Windows\Temp\Set4144.tmp
Present !! : C:\Windows\Temp\Set63E2.tmp
Present !! : C:\Windows\Temp\set6426.tmp
Present !! : C:\Windows\Temp\Set8CB7.tmp
Present !! : C:\Windows\Temp\SetB251.tmp
Present !! : C:\Windows\Temp\setF65A.tmp
Present !! : C:\Windows\Temp\TMP5322.tmp
Present !! : C:\Windows\Temp\~DF419.tmp
Present !! : C:\Windows\Temp\~DF5BE6.tmp
Present !! : C:\Windows\Temp\winamp.exe
Present !! : C:\Users\Sylvie\AppData\Local\d3d8caps.dat
Present !! : C:\Users\Sylvie\AppData\Local\d3d9caps.dat
Present !! : C:\Users\Sylvie\AppData\Local\GDIPFONTCACHEV1.DAT
Present !! : C:\Users\Sylvie\Local Settings\Temp\0.zip
Present !! : C:\Users\Sylvie\Local Settings\Temp\1.zip
Present !! : C:\Users\Sylvie\Local Settings\Temp\2.zip
Present !! : C:\Users\Sylvie\Local Settings\Temp\3.zip
Present !! : C:\Users\Sylvie\Local Settings\Temp\a.dat
Present !! : C:\Users\Sylvie\Local Settings\Temp\BB3.tmp
Present !! : C:\Users\Sylvie\Local Settings\Temp\mp0
Present !! : C:\Users\Sylvie\Local Settings\Temp\tdm.log
Present !! : C:\Users\Sylvie\Local Settings\Temp\url.txt
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\bfguni.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\contentDATs.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\FP_PL_MSI_INSTALLER.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\IE8-Setup-Full-Vista.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\ijjiOptimizer.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\jCym.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\PurpleBean.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\SecurityScan_Release.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\Uninstall.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\uttF424.tmp.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\wlsetup-cvr.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\xGle.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\_is1CA6.exe
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\a.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\DefInstAction.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\FW_Register_Plugin_Action.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\isconfig.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\QBackupInst.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\srtspse.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\srtspso.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\srtspsp.dat
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\drm_dialogs.dll
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\GLF2947.tmp.tbAstr.dll
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\tmp5BA.tmp
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\tmp9D95.tmp
Present !! : C:\Users\Sylvie\LOCAL Settings\Temp\tmpD0B6.tmp

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\losalamos
Present !! : HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd
Present !! : HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87sdhfush87fsufhuie3fddf
Present !! : HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcexecwin
Present !! : HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd
Present !! : HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87sdhfush87fsufhuie3fddf
Present !! : HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcexecwin
Present !! : HKU\S-1-5-21-3117738710-352053017-3202849153-1000\Software\Microsoft\Windows\CurrentVersion\Run\losalamos
Present !! : HKU\S-1-5-21-3117738710-352053017-3202849153-1000\Software\Microsoft\Windows\CurrentVersion\Run\losalamos
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}
Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{A2BA40A0-74F1-52BD-F411-00B15A2C8953}
Present !! : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Present !! : "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}"
Present !! : "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}"
Present !! : "HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}"
Present !! : "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}"
Present !! : "HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A2BA40A0-74F1-52BD-F411-00B15A2C8953}"
Present !! : "HKLM\Software\Trymedia Systems"
Present !! : HKCR\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239}
Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc}
Present !! : HKCR\interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff}
Present !! : HKCR\interface\{cf54be1c-9359-4395-8533-1657cf209cfe}
Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
Present !! : HKCU\SOFTWARE\avsoft
Present !! : HKCU\Software\avsuite
Present !! : HKCU\SOFTWARE\J8RPLTROBQ
Present !! : HKCU\SOFTWARE\LEO0WTUNO7
Present !! : HKCU\SOFTWARE\Microsoft\Handle
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d}
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca}
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca}
Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb}
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a2ba40a0-74f1-52bd-f411-00b15a2c8953}
Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore
Present !! : "HKCU\SOFTWARE\Trymedia Systems"
Present !! : HKCU\SOFTWARE\XML
Present !! : HKLM\SOFTWARE\avsoft
Present !! : HKLM\SOFTWARE\avsuite
Present !! : HKLM\Software\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
Present !! : HKLM\Software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
Present !! : HKLM\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
Present !! : HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
Present !! : HKLM\SYSTEM\ControlSet001\Services\Irmon
Present !! : HKLM\SYSTEM\ControlSet002\Services\Irmon
Present !! : HKLM\SYSTEM\ControlSet003\Services\Irmon
Present !! : HKLM\SYSTEM\ControlSet004\Services\Irmon
Present !! : HKLM\SYSTEM\CurrentControlSet\Services\Irmon

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-04 13:44:43
Windows 6.0.6002 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x859EF1F8]<<
kernel: MBR read successfully
BIOS signateure not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
cval REG_DWORD 1 (0x1)
UacDisableNotify REG_DWORD 0 (0x0)
InternetSettingsDisableNotify REG_DWORD 0 (0x0)
AutoUpdateDisableNotify REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 13:44:45,48

as tu besoin autres choses
jattends la suite
Choucas

▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :

▶ choisis l'Option Clean

ton PC va redemarrer,

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

▶ colle le contenu dans ta reponse

je me demandais si tu avais eu 2 min a regarder les rapports....

car je sais pas quoi faire de ses virus ds lordi je peux pas me connecter encore sur une page web...

Jattends des nouvelles
au plaisir
Choucas

je t'ai repondu il y a trois jours ici :

https://forums.commentcamarche.net/forum/affich-17610087-a-laide-virus#17

desolé javais pas vu,, mais je lais fais le clean avec list Kill em et jai copier le rapport

Merci