Navigateur Opéra / Pubs, Virus, spyware

Salut,

Désactive les logiciels de protection (Antivirus, Antispywares) puis :

Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix, accepte la licence d'utilisation et laisse toi guider.

Eventuellement, installe la console de récupération comme cela est conseillé

Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Tu as le tutorial sur ce lien pour t'aider : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

PS : si Combofix ne se lance pas, renomme le fichier Combofix et retente.

Si pas mieux, tente en mode sans échec sans prise en charge du réseau : Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.

Et voila !

ComboFix 10-05-29.05 - Melissa 2010-05-30 17:45:17.1.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.447.117 [GMT -4:00]
Lancé depuis: c:\documents and settings\Melissa\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100527-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

Une copie infectée de c:\windows\system32\drivers\ipsec.sys a été trouvée et désinfectée
Copie restaurée à partir de - Kitty had a snack :p
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-28 au 2010-05-30 ))))))))))))))))))))))))))))))))))))
.

2010-05-30 21:23 . 2004-05-11 13:56 423784 ----a-w- c:\windows\system32\XceedBkp.dll
2010-05-30 21:23 . 2003-11-19 17:59 512688 ----a-w- c:\windows\system32\XceedCry.dll
2010-05-30 21:23 . 2000-07-15 09:00 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2010-05-30 21:23 . 2010-05-30 21:23 -------- d-----w- c:\program files\SpywareZapper.com
2010-05-30 20:50 . 2010-05-30 20:53 -------- d---a-w- C:\Navilog1
2010-05-29 14:16 . 2010-05-29 14:17 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-05-27 22:31 . 2010-05-27 22:31 -------- d-----w- c:\windows\system32\wbem\Repository
2010-05-27 15:35 . 2010-05-29 05:30 -------- d-s---w- c:\documents and settings\NetworkService\UserData
2010-05-26 21:12 . 2010-05-26 21:12 -------- d-----w- c:\program files\Games
2010-05-26 19:43 . 2010-05-26 19:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Cateia Games
2010-05-26 19:41 . 2010-05-26 19:41 -------- d-----w- C:\games
2010-05-17 22:48 . 2010-05-17 22:48 -------- d-----w- c:\program files\Big Fish Games
2010-05-17 22:09 . 2010-05-17 22:20 -------- d-----w- c:\documents and settings\Melissa\Local Settings\Application Data\Deadtime Stories
2010-05-17 22:07 . 2010-05-17 22:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Deadtime Stories
2010-05-17 21:02 . 2010-05-17 21:02 -------- d-----w- c:\documents and settings\Melissa\Application Data\Big Fish Games
2010-05-17 20:44 . 2010-05-17 20:45 3085800 ----a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\Unpack\bfgsetup_s1_l1.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-30 12:13 . 2009-12-11 01:16 -------- d-----w- c:\documents and settings\Melissa\Application Data\vlc
2010-05-30 11:43 . 2010-02-16 17:43 -------- d-----w- c:\documents and settings\Melissa\Application Data\dvdcss
2010-05-27 22:30 . 2009-04-22 12:54 -------- d-----w- c:\documents and settings\Melissa\Application Data\uTorrent
2010-05-27 00:40 . 2010-04-02 21:17 256 ----a-w- c:\windows\system32\pool.bin
2010-05-26 19:02 . 2009-11-15 23:09 -------- d-----w- c:\documents and settings\Melissa\Application Data\FrostWire
2010-05-20 18:24 . 2010-04-02 21:17 -------- d-----w- c:\documents and settings\Melissa\Application Data\Research In Motion
2010-05-17 22:03 . 2009-04-22 12:42 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-17 20:45 . 2009-04-22 12:30 -------- d-----w- c:\program files\bfgclient
2010-05-13 04:20 . 2009-10-09 15:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-05-11 20:28 . 2010-01-10 00:24 -------- d-----w- c:\program files\Linksys
2010-05-11 20:18 . 2010-05-11 20:18 3 ----a-w- c:\program files\option.txt
2010-05-06 15:26 . 2009-11-04 19:56 -------- d-----w- c:\documents and settings\Melissa\Application Data\U3
2010-05-05 02:35 . 2010-04-16 23:00 -------- d-----w- c:\program files\Opera
2010-04-18 21:18 . 2009-05-24 13:44 -------- d-----w- c:\program files\Google
2010-04-18 21:09 . 2009-12-05 04:16 -------- d-----w- c:\program files\TuneUp Utilities 2009
2010-04-18 21:04 . 2009-04-16 22:53 -------- d-----w- c:\program files\Fichiers communs\Adobe
2010-04-12 00:48 . 2009-04-14 12:00 71704 ----a-w- c:\documents and settings\Melissa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-08 04:19 . 2010-04-07 22:46 884 ----a-w- c:\windows\shlfolder.sys
2010-04-07 23:51 . 2010-04-07 23:30 -------- d-----w- c:\documents and settings\Melissa\Application Data\PhotoFiltre
2010-04-05 19:41 . 2010-04-02 18:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Research In Motion
2010-04-02 21:17 . 2010-04-02 21:17 26694 ----a-r- c:\documents and settings\Melissa\Application Data\Microsoft\Installer\{8D55AC33-2CB4-4A4D-93A9-F5C76124BBC3}\BlackBerry.exe
2010-04-02 21:11 . 2010-04-02 18:52 -------- d-----w- c:\program files\Fichiers communs\Research In Motion
2010-04-02 18:55 . 2010-04-02 18:52 -------- d-----w- c:\program files\Research In Motion
2010-04-02 18:53 . 2010-04-02 18:53 -------- d-----w- c:\program files\Fichiers communs\Roxio Shared
2010-03-14 11:24 . 2004-08-05 12:00 81352 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-14 11:24 . 2004-08-05 12:00 503386 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-09 11:10 . 2004-08-05 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-01-06 19:25 . 2010-01-06 18:37 30897 ----a-w- c:\program files\NANSTD0.SAV
2010-01-06 19:06 . 2010-01-06 18:37 30897 ----a-w- c:\program files\CONSTD.SAV
2010-01-06 18:37 . 2010-01-06 18:37 30897 ----a-w- c:\program files\NANSTD6.SAV
2010-01-06 18:37 . 2010-01-06 18:37 30897 ----a-w- c:\program files\NANSTD5.SAV
2010-01-06 18:37 . 2010-01-06 18:37 30897 ----a-w- c:\program files\NANSTD4.SAV
2010-01-06 18:37 . 2010-01-06 18:37 30897 ----a-w- c:\program files\NANSTD3.SAV
2010-01-06 18:37 . 2010-01-06 18:37 30897 ----a-w- c:\program files\NANSTD2.SAV
2010-01-06 18:37 . 2010-01-06 18:37 30897 ----a-w- c:\program files\NANSTD1.SAV
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"System Mechanic Popup Stopper"="c:\program files\iolo\System Mechanic 4 Professional\PopupStopper.exe" [2003-09-26 428032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 15:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 20:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-08-25 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-08-25 20560]
R3 ENETNT5;Efficient Networks, tango Access PPPoE WAN Miniport;c:\windows\system32\drivers\enetnt.sys [2009-04-14 40832]
S3 ENDETECT;ENDETECT;c:\progra~1\Bell\GESTIO~1\app\ENDETECT.SYS [2009-04-14 7752]
S3 NTSTPL1;NTSTPL1;c:\progra~1\Bell\GESTIO~1\app\NTSTPL1.SYS [2009-04-14 16160]
S3 RAWESR;RAWESR;c:\progra~1\Bell\GESTIO~1\app\RAWESR.SYS [2009-04-14 16256]
S3 TAPBIND;TAPBIND;c:\progra~1\Bell\GESTIO~1\app\TAPBIND1.SYS [2009-04-14 44736]
.
Contenu du dossier 'Tâches planifiées'

2010-05-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-24 13:44]
.
.
------- Examen supplémentaire -------
.
Name-Space Handler: ftp\DLA.IEClickMon - {A5A08E80-B472-11D2-89D1-0080C8C12A3A} - c:\progra~1\iolo\SYSTEM~1\URLSTO~1.DLL
Name-Space Handler: http\DLA.IEClickMon - {A5A08E80-B472-11D2-89D1-0080C8C12A3A} - c:\progra~1\iolo\SYSTEM~1\URLSTO~1.DLL
.
- - - - ORPHELINS SUPPRIMES - - - -

MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-30 17:51
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2010-05-30 17:55:19
ComboFix-quarantined-files.txt 2010-05-30 21:55

Avant-CF: 57 048 498 176 octets libres
Après-CF: 57 061 085 184 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - AD2D14759B2BFA752887B5F2F8B3BF65