Virus Win32 - Page 2

Je ne sais meme pas par où commencer ^^ c'est long ! ^^

redémarrer le pc en mode sans échec avec prise en charge réseau

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php

Télécharge rkill

Enregistre-le sur ton Bureau
Double-clique sur l'icone rkill ( pour Vista/Seven clic-droit Exécuter en tant qu'Administrateur)
Un bref écran noir t'indiquera que le tool s'est correctement exécuter, s'il ne lance pas
change de lien de téléchargement en utilisant le suivant à partir d'ici:
https://download.bleepingcomputer.com/grinler/rkill.exe
https://download.bleepingcomputer.com/grinler/rkill.exe

Rkill COM: Rkill COM:
https://download.bleepingcomputer.com/grinler/rkill.com
https://download.bleepingcomputer.com/grinler/rkill.com

Rkill SCR: Rkill RCS:
https://download.bleepingcomputer.com/grinler/rkill.scr
https://download.bleepingcomputer.com/grinler/rkill.scr

une fois qu'il aura terminé, retente combofix

Merci. Voilà le rapport de Combofix :
ComboFix 10-10-03.03 - Propriétaire 04/10/2010 19:03:28.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.959.699 [GMT 2:00]
Lancé depuis: c:\documents and settings\Propriétaire\Bureau\KENZA.exe
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
c:\documents and settings\All Users\Application Data\QueryExplorer
c:\documents and settings\All Users\Application Data\QueryExplorer\queryexplorer117.exe
c:\documents and settings\Propriétaire\Application Data\download2
c:\documents and settings\Propriétaire\Application Data\download2\svcnost .exe
c:\documents and settings\Propriétaire\Application Data\download2\svcnost.exe
c:\documents and settings\Propriétaire\Application Data\facemoods.com
c:\program files\facemoods.com
c:\program files\facemoods.com\facemoods\1.3.62.1\facemoods.crx
c:\program files\facemoods.com\facemoods\1.3.62.1\facemoods.dll
c:\program files\facemoods.com\facemoods\1.3.62.1\facemoods.png
c:\program files\facemoods.com\facemoods\1.3.62.1\facemoodsApp.dll
c:\program files\facemoods.com\facemoods\1.3.62.1\facemoodsEng.dll
c:\program files\facemoods.com\facemoods\1.3.62.1\facemoodssafe.dll
c:\program files\facemoods.com\facemoods\1.3.62.1\facemoodsTlbr.dll
c:\program files\facemoods.com\facemoods\1.3.62.1\uninstall.exe
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\chrome.manifest
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\components\FFHst.dll
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\components\FFHst.xpt
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\facemoods.css
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\facemoods.png
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\facemoods.xul
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\fcmdDef.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\facemoods.png
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\fb.gif
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\help_16.gif
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\home.gif
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\logo.png
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\moodsIcon.png
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\pref.jpg
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\privecy_16_hot.gif
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\stripicons.png
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\tellafriend.gif
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\Thumbs.db
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\images\vssver.scc
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\instlgc.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\Loader.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\mtrprt.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\newTabLgc.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\preferences\preferences.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\preferences\preferences.xul
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\preferences\vssver.scc
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\prefman.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\script-compiler.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\Thumbs.db
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\utils.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\vssver.scc
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\xmlhttprequester.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\content\xpiInstallLgc.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\defaults\preferences\instlPref.js
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\defaults\preferences\vssver.scc
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\install.rdf
c:\program files\Mozilla Firefox\extensions\ffxtlbr@Facemoods.com\vssver.scc
c:\program files\QueryExplorer
c:\program files\QueryExplorer\queryexplorer.dll
c:\program files\QueryExplorer\queryexplorer.exe
c:\program files\QueryExplorer\uninstall.exe
c:\windows\svchost.com
c:\windows\system32\krambst.dll

c:\windows\system32\DRIVERS\WudfPf.sys . . . est infecté!! . . . Impossible de trouver un substitut valide.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_QUERYEXPLORER_SERVICE
-------\Service_QueryExplorer Service

((((((((((((((((((((((((((((( Fichiers créés du 2010-09-04 au 2010-10-04 ))))))))))))))))))))))))))))))))))))
.

2010-10-02 18:53 . 2010-10-02 20:25 -------- d-----w- C:\FyK
2010-09-29 00:28 . 2010-09-29 00:28 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities
2010-09-28 10:43 . 2010-09-28 10:43 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-09-28 08:33 . 2010-09-28 08:33 -------- d-----r- c:\documents and settings\NetworkService\Favoris
2010-09-27 23:50 . 2010-09-27 23:50 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-09-20 21:53 . 2010-09-20 21:53 -------- d-----w- c:\program files\Xvid
2010-09-20 21:53 . 2010-09-29 00:58 -------- d-----w- c:\documents and settings\All Users\Application Data\ClickPotatoLiteSA
2010-09-20 21:53 . 2010-09-20 21:53 -------- d-----w- c:\program files\ClickPotatoLite
2010-09-20 21:52 . 2010-09-20 21:52 -------- d-----w- c:\program files\ShopperReports3
2010-09-08 21:46 . 2010-09-28 22:23 103176 ----a-w- c:\documents and settings\All Users\Application Data\QuestDns\questdns117.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-04 16:57 . 2010-06-07 19:24 -------- d-----w- c:\program files\QuickTime
2010-10-04 16:56 . 2010-06-07 19:24 -------- d-----w- c:\program files\iTunes
2010-10-02 18:06 . 2010-10-01 14:51 112 ----a-w- c:\documents and settings\All Users\Application Data\S7U4RY.dat
2010-09-28 22:23 . 2010-06-24 17:18 298729 ----a-w- c:\documents and settings\Propriétaire\Application Data\OpenCandy\1A0F515BC11E43F49C838EE262121171\Dlmgr3WrapperBuyObaB.exe
2010-09-28 22:23 . 2010-03-15 17:01 747182 ----a-w- c:\documents and settings\Propriétaire\Application Data\OpenCandy\1A0F515BC11E43F49C838EE262121171\Buyobab-116.exe
2010-09-28 22:23 . 2010-06-07 21:04 1998280 ----a-w- c:\documents and settings\Propriétaire\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-09-28 22:23 . 2009-02-04 11:56 116584 ----a-w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\DifXInstall32.exe
2010-09-28 22:23 . 2010-06-09 08:06 372648 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\8802\ReaderUpdater.exe
2010-09-28 22:23 . 2010-06-09 08:06 372648 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\8802\AcrobatUpdater.exe
2010-09-28 22:23 . 2010-06-09 08:06 1018304 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\8802\AdobeARM.exe
2010-09-28 22:23 . 2010-04-24 16:33 114472 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.1.11\SetupAdmin.exe
2010-09-28 22:23 . 2010-03-24 08:04 994240 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\25681\AdobeARM.exe
2010-09-28 22:23 . 2010-03-24 08:04 367528 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\25681\ReaderUpdater.exe
2010-09-28 22:23 . 2010-03-24 08:04 367528 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\25681\AcrobatUpdater.exe
2010-09-15 14:41 . 2010-06-08 13:11 16280 ---ha-w- c:\windows\system32\mlfcache.dat
2010-09-10 06:56 . 2010-06-09 22:06 -------- d-----w- c:\program files\BitTorrent
2010-09-09 09:45 . 2010-06-07 10:36 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-08 22:56 . 2010-08-16 01:21 -------- d-----w- c:\program files\QuestDns
2010-09-08 22:56 . 2010-08-16 01:21 -------- d-----w- c:\documents and settings\All Users\Application Data\QuestDns
2010-09-07 15:12 . 2010-07-09 06:59 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-06-03 11:33 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-06-03 11:33 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-06-03 11:33 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-06-03 11:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-06-03 11:33 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2010-06-03 11:33 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2010-06-03 11:33 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2010-06-03 11:33 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-08-27 00:07 . 2010-06-24 17:19 -------- d-----w- c:\program files\ReducBarre
2010-08-17 13:17 . 2006-03-02 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 17:53 . 2010-08-16 00:07 -------- d-----w- c:\program files\CrazyLoader
2010-08-16 00:07 . 2010-08-16 00:07 -------- d-----w- c:\program files\OfferBox
2010-08-16 00:06 . 2010-08-16 00:06 3 ----a-w- C:\t.tmp
2010-08-13 00:32 . 2006-03-02 12:00 80508 ----a-w- c:\windows\system32\perfc00C.dat
2010-08-13 00:32 . 2006-03-02 12:00 500482 ----a-w- c:\windows\system32\perfh00C.dat
2010-07-22 15:48 . 2006-03-02 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-09 12:26 . 2010-07-09 12:26 697328 ----a-w- c:\windows\system32\drivers\sptd.sys
.
[code]<pre>
c:\program files\ClickPotatoLite\bin\10.0.529.0\ClickPotatoLiteSA .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\QuickTime\qttask .exe
</pre>/code

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}]
2010-07-21 12:59 135000 ----a-w- c:\program files\OfferBox\OfferBoxBHO.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2009-11-15 33120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DriverCD"="J:\Run.exe" [N/A]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]
"nwiz"="nwiz.exe" [2006-10-31 1622016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"EPSON Stylus CX3600 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE" [2004-03-04 98304]
"download"="c:\documents and settings\Propriétaire\Application Data\download2\svcnost.exe" [N/A]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 3.2.lnk]
path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress]
NA [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-21 23:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 17:34 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2006-12-05 20:55 54832 ----a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-03-17 15:59 2289664 ----a-w- c:\program files\Fichiers communs\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2006-11-23 13:10 56928 ------w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 13:21 246504 ----a-w- c:\program files\Fichiers communs\Java\Java Update\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\CrazyLoader\\crazyloader.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaws.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\crazyloader.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [03/06/2010 13:33 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [03/06/2010 13:33 17744]
S2 QuestDns Service;QuestDns Service;c:\documents and settings\All Users\Application Data\QuestDns\questdns117.exe [08/09/2010 23:46 103176]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [09/07/2010 14:26 697328]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-03-17 15:56 451872 ----a-w- c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe
.
Contenu du dossier 'Tâches planifiées'

2010-10-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

2010-10-04 c:\windows\Tasks\User_Feed_Synchronization-{068DA097-F062-4BE2-9CD0-F7DC342D4251}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: {{B58926D6-CFB0-45d2-9C28-4B5A0F0368AE} - {7A3D6D17-9DD5-4C60-8076-D1784DABAF8C} - c:\program files\ClickPotatoLite\bin\10.0.529.0\ClickPotatoLiteSABHO.dll
DPF: {445F47D7-E043-4BD6-82EB-7A1BD0EBA773} - hxxp://www.psapoll.com/CopyGuardIE.cab
FF - ProfilePath - c:\documents and settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\cev3spae.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\program files\CrazyLoader\spointer\extensions\crazyloader@spointer.com\components\crazyloader_air_ff.dll
FF - component: c:\program files\OfferBox\offerboxffx@offerbox.com\components\OfferBoxXpCom.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{64182481-4F71-486b-A045-B233BD0DA8FC} - c:\program files\facemoods.com\facemoods\1.3.62.1\facemoods.dll
AddRemove-facemoods - c:\program files\facemoods.com\facemoods\1.3.62.1\uninstall.exe
AddRemove-QueryExplorer - c:\program files\QueryExplorer\uninstall.exe

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x85F23EC5]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74cbf28
\Driver\ACPI -> ACPI.sys @ 0xf735dcb8
\Driver\atapi -> atapi.sys @ 0xf7315852
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf71f4bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7201a21
SendHandler -> NDIS.sys @ 0xf71df87b
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(476)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
.
**************************************************************************
.
Heure de fin: 2010-10-04 19:18:37 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-10-04 17:18

Avant-CF: 199 398 510 592 octets libres
Après-CF: 199 667 310 592 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 01382358EA98D4DCC5770ABA50BE7A24

MERCII <33 Car mes logiciels ... foncitionne. <33 Je T'adore !=)

(sourire)

tant mieux mais c'est loin d'être fini

1)

j'aurais besoin que tu me transmette le rapport de combofix par ci joint

Rend toi sur Cjoint : http://www.cijoint.fr/

Clique sur "Parcourir " dans la partie " Joindre un fichier[...] "

Sélectionne le rapport C:\ComboFix.txt

Clique ensuite sur "Cliquez ici pour déposer le fichier " et copie/colle le lien dans ton prochain message

......................

2)

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier :

c:\windows\system32\DRIVERS\WudfPf.sys
c:\documents and settings\All Users\Application Data\QuestDns\questdns117.exe

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.


Copie le lien de Virus Total dans ta réponse.

Si tu ne trouves pas le fichier alors

Affiche tous les fichiers et dossiers :

Pour cela :
Clique sur démarrer/panneau de configuration/option des dossiers/affichage

Cocher afficher les dossiers cachés

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décocher masquer les extensions dont le type est connu

Puis fais «appliquer» pour valider les changements.

Et OK


tuto pour t'aider

http://www.bibou0007.com/scans-en-ligne-f75/tutorial-sur-virustotal-t190.htm

Bah je vient de t'envoyer le rapport ^^ et euh pourquoi ce n'est pas finit ^^ j'ai réeussit a remettre avast =D

il y a encore beaucoup d'infections sur ton pc et quelque manip à faire

je sais que tu m'as posté le rapport et je l'ai lu, mais pour pourvoir rédiger une consigne précise à te faire faire, j'ai besoin de ce rapport sous ci joint

Mais c'est normal que mon ordi n'arrête pas de buguer ? sur facebook ou meme a des jeux que je fait ... ^^ est-ce que c'est parce que j'ai arreter les manip que tu m'a dit de faire ???

le 04.10.10 je t'ai demandé quelque chose...