Infecte par autorun.inf

combo fix a voulu redemander l'ordi mais au bout 1/2 heure avec marqué windows va redemarer j'ai coupé et combo fix a préparer son fichier text normallement mais je sais pas si il a pu faire son job ?! voici le rapport

ComboFix 11-05-19.01 - nico 20/05/2011 19:21:41.2.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3326.2693 [GMT 2:00]
Lancé depuis: d:\documents and settings\nico\Bureau\nico.exe
Commutateurs utilisés :: d:\documents and settings\nico\Bureau\CFScript.txt
AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\windows\95FC26FB19FD4A96BBB1B1062E8648F5.TMP
d:\windows\95FC26FB19FD4A96BBB1B1062E8648F5.TMP\WiseCustomCalla.dll
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_IS-P3PFUDRV
-------\Service_is-P3PFUdrv
-------\Service_ute0ndaw
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-04-20 au 2011-05-20 ))))))))))))))))))))))))))))))))))))
.
.
2011-05-19 18:48 . 2011-05-19 18:56 -------- d-----w- D:\nico
2011-05-19 09:38 . 2011-05-19 09:38 -------- d-----w- D:\Kill'em
2011-05-19 06:20 . 2011-05-19 06:20 -------- d-----w- d:\program files\Ad-Remover
2011-05-18 13:59 . 2011-05-18 14:20 -------- d-----w- D:\UsbFix
2011-05-07 07:46 . 2011-05-07 07:46 89048 ----a-w- d:\program files\Mozilla Firefox\libEGL.dll
2011-05-07 07:46 . 2011-05-07 07:46 781272 ----a-w- d:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-07 07:46 . 2011-05-07 07:46 465880 ----a-w- d:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-07 07:46 . 2011-05-07 07:46 1874904 ----a-w- d:\program files\Mozilla Firefox\mozjs.dll
2011-05-07 07:46 . 2011-05-07 07:46 15832 ----a-w- d:\program files\Mozilla Firefox\mozalloc.dll
2011-05-07 07:46 . 2011-05-07 07:46 1974616 ----a-w- d:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-07 07:46 . 2011-05-07 07:46 1892184 ----a-w- d:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-07 07:46 . 2011-05-07 07:46 142296 ----a-w- d:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-03 07:53 . 2011-05-03 07:53 413696 ----a-w- d:\windows\system32\wrap_oal.dll
2011-05-03 07:53 . 2011-05-03 07:53 110592 ----a-w- d:\windows\system32\OpenAL32.dll
2011-04-29 12:59 . 2011-04-29 12:59 -------- d-----w- d:\documents and settings\nico\Local Settings\Application Data\AliensVsPredator
2011-04-29 12:14 . 2011-05-15 12:40 -------- d-----w- d:\program files\Aliens Vs Predator
2011-04-29 10:59 . 2008-07-11 00:28 50200 ----a-w- d:\windows\system32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.0.1600.22.dll
2011-04-29 10:59 . 2008-07-11 00:28 79896 ----a-w- d:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll
2011-04-29 10:58 . 2011-04-29 10:58 -------- d-----w- d:\windows\system32\RsFx
2011-04-29 10:29 . 2011-04-29 10:58 -------- d-----w- d:\program files\Microsoft SQL Server
2011-04-29 10:29 . 2011-04-29 10:29 113280 ----a-w- d:\documents and settings\All Users\Application Data\Microsoft\VCExpress\9.0\1036\ResourceCache.dll
2011-04-29 10:28 . 2011-04-29 10:28 416 ----a-w- d:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1036\ResourceCache.dll
2011-04-29 10:26 . 2011-04-29 10:28 -------- d-----w- d:\program files\Microsoft Visual Studio 9.0
2011-04-29 10:26 . 2011-04-29 10:27 -------- d-----w- d:\program files\Fichiers communs\Merge Modules
2011-04-29 10:25 . 2011-04-29 10:25 -------- d-----w- d:\program files\Microsoft SDKs
2011-04-28 10:15 . 2010-06-02 02:55 74072 ----a-w- d:\windows\system32\XAPOFX1_5.dll
2011-04-28 10:15 . 2010-06-02 02:55 527192 ----a-w- d:\windows\system32\XAudio2_7.dll
2011-04-28 10:15 . 2010-06-02 02:55 239960 ----a-w- d:\windows\system32\xactengine3_7.dll
2011-04-28 10:15 . 2010-05-26 09:41 2106216 ----a-w- d:\windows\system32\D3DCompiler_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 1868128 ----a-w- d:\windows\system32\d3dcsx_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 470880 ----a-w- d:\windows\system32\d3dx10_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 248672 ----a-w- d:\windows\system32\d3dx11_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 1998168 ----a-w- d:\windows\system32\D3DX9_43.dll
2011-04-28 10:15 . 2010-02-04 08:01 74072 ----a-w- d:\windows\system32\XAPOFX1_4.dll
2011-04-28 10:15 . 2010-02-04 08:01 528216 ----a-w- d:\windows\system32\XAudio2_6.dll
2011-04-28 10:15 . 2010-02-04 08:01 238936 ----a-w- d:\windows\system32\xactengine3_6.dll
2011-04-28 10:15 . 2010-02-04 08:01 22360 ----a-w- d:\windows\system32\X3DAudio1_7.dll
2011-04-21 11:04 . 2011-04-21 11:04 -------- d-----w- d:\program files\Codemasters
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-20 17:39 . 2008-11-10 08:45 16608 ----a-w- d:\windows\gdrv.sys
2011-04-20 13:55 . 2011-04-20 13:55 218688 ----a-w- d:\windows\system32\drivers\dtsoftbus01.sys
2011-04-01 18:57 . 2010-07-19 18:47 137656 ----a-w- d:\windows\system32\drivers\avipbb.sys
2008-11-10 19:20 . 2008-11-10 19:20 278528 ----a-w- d:\program files\Fichiers communs\FDEUnInstaller.exe
2011-05-07 07:46 . 2011-05-07 07:46 142296 ----a-w- d:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 --sha-r- d:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 --sha-r- d:\windows\system32\msfDX.dll
2008-03-16 12:30 216064 --sha-r- d:\windows\system32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2010-07-19 16:32 165184 ----a-w- d:\program files\SFR\Kit\SFRNavErrorHelper.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-06-10 11:29 97064 ----a-w- d:\program files\Nero\Nero8\InCD\NBHShx.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Connexion SFR 9props.exe"="d:\program files\SFR\Kit\9props.exe" [2010-07-19 976192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2011-01-07 111208]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="d:\windows\system32\tscupgrd.exe" [2004-08-05 44544]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GEST]
m'|\ü [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ----a-w- d:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ----a-r- d:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2008-10-23 18:34 1336560 ----a-w- d:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneVI]
2007-07-26 13:05 20480 ----a-w- d:\program files\GIGABYTE\ET6\ETcall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- d:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recordpad]
2010-03-27 09:36 913412 ----a-w- d:\program files\NCH Swift Sound\Recordpad\recordpad.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-05-07 07:39 16862208 ----a-r- d:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-09 20:22 149280 ----a-w- d:\program files\Java\jre6\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys2]
2008-07-17 02:10 208896 ----a-r- d:\windows\system32\WinSys2.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"d:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\GIGABYTE\\EnergySaver\\run.exe"=
"d:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\batman arkham asylum - demo\\Binaries\\ShippingPC-BmGame.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead 2 demo\\left4dead2.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\Fox\\Aliens vs. Predator 2\\lithtech.exe"=
"d:\\Program Files\\CAPCOM\\RESIDENT EVIL 5\\RE5DX9.EXE"=
"d:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\nation red demo\\NationRed.exe"=
"d:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Codemasters\\Damnation\\Binaries\\DamnGame.exe"=
"d:\\Program Files\\Steam\\SteamApps\\mamadi31\\counter-strike source\\hl2.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:WARCRAFTTCP
"6112:UDP"= 6112:UDP:WARCRAFTUDP
.
R0 xmasscsi;xmasscsi;d:\windows\system32\drivers\xmasscsi.sys [06/12/2008 16:46 5248]
R1 prodrv04;Star Force copy protection driver v4;d:\windows\system32\drivers\prodrv04.sys [03/01/2010 19:10 114496]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [19/07/2010 20:47 136360]
R2 GEST Service;GEST Service for program management.;d:\program files\GIGABYTE\EnergySaver\GSvr.exe [10/11/2008 10:45 80392]
R2 NeroRegInCDSrv;Nero Registry InCD Service;d:\program files\Nero\Nero8\InCD\NBHRegInCDSrv.exe [10/06/2008 13:29 53032]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;d:\windows\system32\drivers\dtsoftbus01.sys [20/04/2011 15:55 218688]
R3 nvoclock;NVIDIA Enthusiasts Platform KDM;d:\windows\system32\drivers\nvoclock.sys [09/03/2009 12:25 38304]
S0 sptd;sptd;d:\windows\system32\drivers\sptd.sys [24/11/2008 10:59 717296]
S1 anf0100.sys;anf0100.sys;\??\d:\windows\system32\drivers\anf0100.sys --> d:\windows\system32\drivers\anf0100.sys [?]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\Drivers\avgldx86.sys --> d:\windows\system32\Drivers\avgldx86.sys [?]
S1 AvgTdiX;AVG Free Network Redirector;d:\windows\system32\Drivers\avgtdix.sys --> d:\windows\system32\Drivers\avgtdix.sys [?]
S2 gupdate1ca046a6f826e06;Service Google Update (gupdate1ca046a6f826e06);d:\program files\Google\Update\GoogleUpdate.exe [14/07/2009 12:04 133104]
S3 gupdatem;Service Google Update (gupdatem);d:\program files\Google\Update\GoogleUpdate.exe [14/07/2009 12:04 133104]
S3 ProtoWall;ProtoWall Network Service;d:\windows\system32\DRIVERS\ProtoWall.sys --> d:\windows\system32\DRIVERS\ProtoWall.sys [?]
S4 MSSQLServerADHelper100;Service SQL Active Directory Helper;d:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [11/07/2008 02:28 47128]
S4 RsFx0102;RsFx0102 Driver;d:\windows\system32\drivers\RsFx0102.sys [10/07/2008 02:49 242712]
S4 SQLAgent$SQLEXPRESS;Agent SQL Server (SQLEXPRESS);d:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11/07/2008 02:28 369688]
S4 xmasbus;xmasbus;d:\windows\system32\drivers\xmasbus.sys [06/12/2008 16:46 140800]
.
Contenu du dossier 'Tâches planifiées'
.
2011-05-20 d:\windows\Tasks\GoogleUpdateTaskMachineCore1cb6d4799c7eab4.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-07-14 10:04]
.
2011-05-20 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-07-14 10:04]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
IE: E&xporter vers Microsoft Excel - d:\progra~1\Microsoft Office\Office12\EXCEL.EXE/3000
FF - ProfilePath - d:\documents and settings\nico\Application Data\Mozilla\Firefox\Profiles\9y6o6g76.default\
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=08f8b730000000000000001fd026b688&tlver=1.4.19.19&instlRef=sst&ss=1&affID=18026&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-20 19:39
Windows 5.1.2600 Service Pack 2 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: HDT722516DLA380 rev.V43OA96A -> Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T1L0-19
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
sectors 321670845 (+255): user != kernel
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1801674531-329068152-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:57,a1,36,87,7a,18,af,b3,5b,7e,6e,8d,ce,b4,b5,9a,1f,38,0e,e2,17,40,4f,
60,b1,9b,d2,05,56,a8,c5,c3,cc,0b,dd,f0,ab,87,cd,9e,2a,61,a4,5c,e3,7d,f7,f7,\
"??"=hex:4a,59,7a,da,60,12,a0,b9,16,36,9b,cb,13,e3,e9,29
.
[HKEY_USERS\S-1-5-21-1801674531-329068152-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:a3,85,b0,2b,04,66,fb,4c,47,27,4e,b8,a3,a4,20,7a,5f,c7,b5,4b,d7,
82,ca,3f,6a,d5,1e,63,36,8c,4c,29,c3,79,9d,22,ec,58,4f,88,c6,95,76,00,77,ae,\
"rkeysecu"=hex:0e,70,b8,86,5b,91,7e,00,cd,de,f2,cf,1c,fb,bc,4d
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(2356)
d:\program files\Nero\Nero8\InCD\NBHShx.dll
d:\program files\Nero\Nero8\InCD\NBHStr.dll
d:\program files\Fichiers communs\Nero\Shared\NL3\AdvrCntr3.dll
d:\windows\system32\msi.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\nvsvc32.exe
d:\program files\Avira\AntiVir Desktop\avguard.exe
d:\program files\Avira\AntiVir Desktop\avshadow.exe
d:\program files\Nero\Nero8\InCD\InCDsrv.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
d:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
d:\program files\NVIDIA Corporation\System Update\UpdateCenterService.exe
d:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2011-05-20 19:43:15 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-05-20 17:43
ComboFix2.txt 2011-05-19 18:56
.
Avant-CF: 42 245 550 080 octets libres
Après-CF: 42 070 913 024 octets libres
.
Current=9 Default=9 Failed=0 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,10,11
- - End Of File - - DC810861443051E3AE902262CA36DC70

salut avira oui et à jour dernière version

voici le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:50:37, on 18/05/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir Desktop\sched.exe
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\SFR\Kit\9props.exe
D:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
D:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe
D:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
D:\Program Files\Avira\AntiVir Desktop\avshadow.exe
D:\Program Files\Spyware Terminator\sp_rsser.exe
D:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
D:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe
D:\WINDOWS\system32\dllhost.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Mozilla Firefox\plugin-container.exe
D:\Documents and Settings\nico\Bureau\clic\Maintenance\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60446
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:55030
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: Aide à la navigation SFR - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - D:\Program Files\SFR\Kit\SFRNavErrorHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min /nosplash
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Connexion SFR 9props.exe] "D:\Program Files\SFR\Kit\9props.exe" /trayicon
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - (no file)
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - D:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - D:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - D:\WINDOWS\system32\services.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - D:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: Service Google Update (gupdate1ca046a6f826e06) (gupdate1ca046a6f826e06) - Unknown owner - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Service Google Update (gupdatem) (gupdatem) - Unknown owner - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - D:\WINDOWS\system32\imapi.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - D:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - D:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - D:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - D:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - D:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - D:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Telnet (TlntSvr) - Unknown owner - D:\WINDOWS\system32\tlntsvr.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - D:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - D:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - D:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - D:\WINDOWS\system32\wbem\wmiapsrv.exe
O24 - Desktop Component 0: (no name) - file:///D:/DOCUME~1/nico/LOCALS~1/Temp/msoclip1/04/clip_image002.gif

si ça peut-être utile

############################## | UsbFix 7.045 | [Suppression]

Utilisateur: nico (Administrateur) # NICO-B9BF2AACED [ ]
Mis à jour le 15/05/2011 par TeamXscript
Lancé à 16:01:04 | 18/05/2011
Site Web: http://www.teamxscript.org
Submit your sample: http://www.teamxscript.org/Upload.php
Contact: TeamXscript.ElDesaparecido@gmail.com

CPU: Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz
CPU 2: Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 2
Internet Explorer 6.0.2900.2180

Pare-feu Windows: Activé
Antivirus: AntiVir Desktop 10.0.1.58 [(!) Disabled | Updated]
RAM -> 3326 Mo
C:\ -> Disque fixe # 153 Go (45 Go libre(s) - 29%) [] # NTFS
D:\ (%systemdrive%) -> Disque fixe # 153 Go (39 Go libre(s) - 25%) [] # NTFS
E:\ -> CD-ROM
F:\ -> Disque fixe # 298 Go (11 Go libre(s) - 4%) [MY BOOK] # FAT32
H:\ -> Disque fixe # 279 Go (279 Go libre(s) - 100%) [Bambou] # NTFS
J:\ -> Disque fixe # 932 Go (18 Go libre(s) - 2%) [STOCKAGE] # NTFS
L:\ -> Disque fixe # 149 Go (87 Go libre(s) - 58%) [My Passport] # FAT32

################## | Éléments infectieux |


Supprimé! C:\$RECYCLE.BIN\S-1-5-21-1246273417-798218164-15116281-1001
Supprimé! C:\$RECYCLE.BIN\S-1-5-21-181401537-3937851508-4181800401-1000
Supprimé! C:\Recycler\S-1-5-21-1801674531-329068152-839522115-1003
Supprimé! D:\Recycler\S-1-5-21-1801674531-329068152-839522115-1003
Supprimé! H:\Recycler\S-1-5-21-1801674531-329068152-839522115-1003
Supprimé! C:\1.bat

################## | Registre |

Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives
Supprimé! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives
Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoResolveSearch

################## | Mountpoints2 |


################## | Listing |

[18/05/2011 - 16:02:26 | D ] C:\$RECYCLE.BIN
[15/03/2011 - 23:49:25 | D ] C:\937ea07aa981e79b80aa6e71
[22/08/2009 - 03:09:13 | D ] C:\a512d99b2b488366b0af1d3f507d
[07/03/2009 - 22:08:15 | N | 0] C:\AUTOEXEC.BAT
[07/05/2011 - 12:06:46 | AD ] C:\Autorun.inf
[23/12/2010 - 23:39:22 | D ] C:\Boot
[03/11/2010 - 13:30:11 | N | 384] C:\Boot.bak
[18/05/2011 - 11:02:39 | SH | 444] C:\boot.ini
[01/12/2010 - 12:16:07 | N | 499] C:\Boot.ini.saved
[05/08/2004 - 14:00:00 | N | 4952] C:\Bootfont.bin
[14/07/2009 - 03:38:58 | RASH | 383562] C:\bootmgr
[23/12/2010 - 23:39:23 | RASH | 8192] C:\BOOTSECT.BAK
[01/12/2010 - 12:16:07 | D ] C:\cmdcons
[04/08/2004 - 00:00:08 | N | 263488] C:\cmldr
[14/04/2011 - 17:12:11 | N | 4321060] C:\ComboFix.exe
[07/03/2009 - 22:08:15 | N | 0] C:\CONFIG.SYS
[22/04/2009 - 00:08:53 | D ] C:\Documents and Settings
[03/01/2011 - 21:03:13 | N | 204528] C:\grldr
[09/05/2011 - 17:25:30 | D ] C:\incoming
[07/03/2009 - 22:08:15 | N | 0] C:\IO.SYS
[07/03/2009 - 22:08:15 | N | 0] C:\MSDOS.SYS
[05/08/2004 - 14:00:00 | RASH | 47564] C:\NTDETECT.COM
[05/08/2004 - 14:00:00 | N | 251712] C:\ntldr
[20/09/2009 - 19:42:10 | D ] C:\NVIDIA
[11/02/2011 - 00:08:44 | D ] C:\Partage
[24/07/2010 - 16:01:19 | D ] C:\Program Files
[18/05/2011 - 16:02:26 | SHD ] C:\RECYCLER
[18/05/2011 - 11:05:17 | N | 125] C:\service.log
[29/03/2011 - 22:56:42 | SHD ] C:\System Volume Information
[14/07/2010 - 23:54:21 | D ] C:\WINDOWS
[07/05/2011 - 12:06:49 | AD ] D:\Autorun.inf
[17/05/2011 - 22:23:23 | D ] D:\ComboFix
[12/09/2010 - 12:43:28 | D ] D:\Ctr
[20/02/2011 - 03:43:35 | D ] D:\Documents and Settings
[10/11/2008 - 10:46:03 | D ] D:\Intel
[27/11/2008 - 13:40:46 | RD ] D:\MSOCache
[29/03/2011 - 23:23:01 | D ] D:\NVIDIA
[18/05/2011 - 11:04:06 | ASH | 2145386496] D:\pagefile.sys
[17/05/2011 - 13:47:09 | D ] D:\Program Files
[04/04/2009 - 09:58:52 | D ] D:\ProgramData
[17/05/2011 - 22:15:18 | D ] D:\Qoobox
[18/05/2011 - 16:02:26 | SHD ] D:\RECYCLER
[24/07/2010 - 16:01:24 | D ] D:\Sit
[29/03/2011 - 22:56:50 | SHD ] D:\System Volume Information
[18/05/2011 - 16:02:26 | D ] D:\UsbFix
[18/05/2011 - 16:02:28 | A | 1546] D:\UsbFix.txt
[18/05/2011 - 15:27:35 | D ] D:\WINDOWS
[07/05/2011 - 12:06:49 | AD ] H:\Autorun.inf
[17/05/2011 - 20:56:06 | N | 4350228] H:\ComboFix.exe
[09/05/2011 - 12:34:41 | D ] H:\Partage
[18/05/2011 - 16:02:26 | SHD ] H:\RECYCLER
[18/05/2011 - 13:56:48 | SHD ] H:\System Volume Information

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)
H:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)

################## | Upload |

Veuillez envoyer le fichier: D:\UsbFix_Upload_Me_NICO-B9BF2AACED.zip
http://www.teamxscript.org/Upload.php
Merci de votre contribution.

################## | E.O.F |

voici le rapport

merci de ton aide

le lien otl ne fonctionne pas

voici le rapport de delfix

# DelFix v7.8 - Rapport créé le 18/05/2011 à 16:19
# Mis à jour le 02/05/11 à 18h par Xplode
# Système d'exploitation : Microsoft Windows XP (32 bits) [version 5.1.2600] Service Pack 2
# Nom d'utilisateur : nico - NICO-B9BF2AACED (Administrateur)
# Exécuté depuis : D:\Documents and Settings\nico\Bureau\delfix.exe
# Option [Suppression]


~~~~~~ Dossier(s) ~~~~~~

-> D:\Qoobox\BackEnv ... ACL modifié avec succès.
Supprimé : D:\Combofix
-> D:\Qoobox\BackEnv ... ACL modifié avec succès.
Supprimé : D:\Qoobox
Supprimé : D:\USBFix
Supprimé : D:\Program Files\Ad-Remover

~~~~~~ Fichier(s) ~~~~~~

Supprimé : D:\UsbFix.txt
Supprimé : D:\UsbFix_Upload_Me_NICO-B9BF2AACED.zip
Supprimé : D:\WINDOWS\grep.exe
Supprimé : D:\WINDOWS\MBR.exe
Supprimé : D:\WINDOWS\NIRCMD.exe
Supprimé : D:\WINDOWS\PEV.exe
Supprimé : D:\WINDOWS\sed.exe
Supprimé : D:\WINDOWS\SWREG.exe
Supprimé : D:\WINDOWS\SWSC.exe
Supprimé : D:\WINDOWS\SWXCACLS.exe
Supprimé : D:\WINDOWS\zip.exe
Supprimé : D:\Documents and Settings\nico\mbr.log
Supprimé : D:\Documents and Settings\nico\Bureau\hijackthis.log
Supprimé : D:\Documents and Settings\nico\Bureau\UsbFix.exe

~~~~~~ Registre ~~~~~~

Clé Supprimée : HKCU\SOFTWARE\Ad-Remover
Clé Supprimée : HKCU\SOFTWARE\USBFix
Clé Supprimée : HKCU\SOFTWARE\IDAVLab
Clé Supprimée : HKLM\Software\pca
Clé Supprimée : HKLM\Software\IDAVLab
Clé Supprimée : HKLM\Software\Classes\.cfxxe
Clé Supprimée : HKLM\Software\Classes\cfxxefile
Clé Supprimée : HKLM\Software\TrendMicro\Hijackthis
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Remover
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Hijackthis
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\USBFix
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe
Clé Supprimée : HKCU\console_combofixbackup
ACL [0] -> [7] & Clé Supprimée : HKLM\SOFTWARE\Swearware
ACL [0] -> [7] & Clé Supprimée : HKLM\System\CurrentControlSet\Enum\Root\LEGACY_DWPROT

~~~~~~ Autre ~~~~~~

-> Prefetch vidé

########## EOF - "D:\DelFixSuppr.txt" - [2652 octets] ##########

c ok en fait pour otl

ok à lire tes liens

otl bug

http://www.cijoint.fr/cjlink.php?file=cj201105/cijIABzy8a.txt

http://www.cijoint.fr/cjlink.php?file=cj201105/cijsMqmW5N.txt

bonne nuit demain je travaille je repasse après sur le forum

merci à toi

merci pour ton travail

voici le rapport

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

D:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 08:20:30 le 19/05/2011, Mode normal

Microsoft Windows XP Professionnel Service Pack 2 (X86)
nico@NICO-B9BF2AACED ( )

============== ACTION(S) ==============


Fichier supprimé: D:\Program Files\Mozilla FireFox\searchplugins\crawlersrch.xml
Dossier supprimé: D:\Documents and Settings\nico\Application Data\Mozilla\FireFox\Profiles\9y6o6g76.default\extensions\engine@conduit.com
Fichier supprimé: D:\Documents and Settings\nico\Application Data\Mozilla\FireFox\Profiles\9y6o6g76.default\searchplugins\conduit.xml

(!) -- Fichiers temporaires supprimés.


Clé supprimée: HKLM\Software\CToolbar
Clé supprimée: HKCU\Software\CToolbar
Clé supprimée: HKLM\Software\Classes\Installer\Products\D82C50F59AED6DA47AA360145789E8BA
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\96DC878CBD58B624183A7E1157AABE19
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\D82C50F59AED6DA47AA360145789E8BA
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}
Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{37F4A335-D085-423e-A425-0370799166FB}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5F05C28D-DEA9-4AD6-A73A-064175988EAB}
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\MenuExt\Crawler Search
Clé supprimée: HKLM\Software\Classes\PROTOCOLS\Handler\tbr
Clé supprimée: HKLM\Software\Google\Chrome\Extensions\bjeikeheijdjdfjbmknpefojickbkmom
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\Crawler

Valeur supprimée: HKLM\Software\Mozilla\Firefox\Extensions|{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
Valeur supprimée: HKLM\Software\Mozilla\Firefox\Extensions|offerboxffx@offerbox.com
Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}


============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [4.0.1 (fr)] ****

Searchplugins\babylon.xml (hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=08f8b730000000000000001fd026b688&tlver=1.4.19.19&ss=1&affID=18026/)
Searchplugins\bing.xml ( hxxp://www.bing.com/search)
Components\browsercomps.dll (Mozilla Foundation)

-- D:\Documents and Settings\nico\Application Data\Mozilla\FireFox\Profiles\9y6o6g76.default --
Extensions\{c2db4fe6-8409-45ce-8010-189a7b5cce86} (NCH Community Toolbar)
Searchplugins\tvuorgru-quick-search.xml (?)
Prefs.js - browser.search.selectedEngine, Search the web (Babylon)
Prefs.js - browser.startup.homepage, about:home
Prefs.js - browser.startup.homepage_override.buildID, 20110413222027
Prefs.js - browser.startup.homepage_override.mstone, rv:2.0.1
Prefs.js - keyword.URL, hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=08f8b730000000000000001fd026b688&tlver=1.4.19.19&instlRef=ss...

========================================

**** Google Chrome Version [4.1.249.1064] ****


-- D:\Documents and Settings\nico\Local Settings\Application Data\Google\Chrome\User Data\Default --
Preferences - default_search_provider: "Google" (Activé: ) (?)
Preferences - urls_to_restore_on_startup:

========================================

**** Internet Explorer Version [6.0.2900.2180] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_SearchScopes\{9D89EE43-B471-40EC-9550-6BD77C7BE3F4} - "?" (?)
HKCU_ElevationPolicy\{FF4E22ED-17D0-4D43-AD6F-E53D11FA3C61} - D:\Documents and Settings\nico\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (x)
HKLM_ElevationPolicy\f136aa0a-be3c-4465-9ceb-c83aea68e662 - D:\Program Files\NCH\NCHToolbarHelper.exe (x)
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - D:\Program Files\SFR\Kit\9launch.exe (SFR)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - "Objet d'aide à la navigation SFR" (D:\Program Files\SFR\Kit\SFRNavErrorHelper.dll)

========================================

D:\Program Files\Ad-Remover\Quarantine: 33 Fichier(s)
D:\Program Files\Ad-Remover\Backup: 13 Fichier(s)

D:\Ad-Report-CLEAN[1].txt - 19/05/2011 08:21:31 (4738 Octet(s))

Fin à: 08:23:36, 19/05/2011

============== E.O.F ==============

je reviens ce soir ( vers 19 h)

merci encore

File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:
MD5: 27949ccd505a6be082d15547b1dff90d
Date first seen: 2008-04-27 07:02:25 (UTC)
Date last seen: 2011-05-21 19:53:01 (UTC)
Detection ratio: 1/42

What do you wish to do?

ComboFix 11-05-21.03 - nico 22/05/2011 18:36:50.3.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3326.2699 [GMT 2:00]
Lancé depuis: d:\documents and settings\nico\Bureau\nico.exe
Commutateurs utilisés :: d:\documents and settings\nico\Bureau\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-04-22 au 2011-05-22 ))))))))))))))))))))))))))))))))))))
.
.
2011-05-19 18:48 . 2011-05-19 18:56 -------- d-----w- D:\nico
2011-05-19 09:38 . 2011-05-19 09:38 -------- d-----w- D:\Kill'em
2011-05-19 06:20 . 2011-05-19 06:20 -------- d-----w- d:\program files\Ad-Remover
2011-05-18 13:59 . 2011-05-18 14:20 -------- d-----w- D:\UsbFix
2011-05-07 07:46 . 2011-05-07 07:46 89048 ----a-w- d:\program files\Mozilla Firefox\libEGL.dll
2011-05-07 07:46 . 2011-05-07 07:46 781272 ----a-w- d:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-07 07:46 . 2011-05-07 07:46 465880 ----a-w- d:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-07 07:46 . 2011-05-07 07:46 1874904 ----a-w- d:\program files\Mozilla Firefox\mozjs.dll
2011-05-07 07:46 . 2011-05-07 07:46 15832 ----a-w- d:\program files\Mozilla Firefox\mozalloc.dll
2011-05-07 07:46 . 2011-05-07 07:46 1974616 ----a-w- d:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-07 07:46 . 2011-05-07 07:46 1892184 ----a-w- d:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-07 07:46 . 2011-05-07 07:46 142296 ----a-w- d:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-03 07:53 . 2011-05-03 07:53 413696 ----a-w- d:\windows\system32\wrap_oal.dll
2011-05-03 07:53 . 2011-05-03 07:53 110592 ----a-w- d:\windows\system32\OpenAL32.dll
2011-04-29 12:59 . 2011-04-29 12:59 -------- d-----w- d:\documents and settings\nico\Local Settings\Application Data\AliensVsPredator
2011-04-29 12:14 . 2011-05-15 12:40 -------- d-----w- d:\program files\Aliens Vs Predator
2011-04-29 10:59 . 2008-07-11 00:28 50200 ----a-w- d:\windows\system32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.0.1600.22.dll
2011-04-29 10:59 . 2008-07-11 00:28 79896 ----a-w- d:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll
2011-04-29 10:58 . 2011-04-29 10:58 -------- d-----w- d:\windows\system32\RsFx
2011-04-29 10:29 . 2011-04-29 10:58 -------- d-----w- d:\program files\Microsoft SQL Server
2011-04-29 10:29 . 2011-04-29 10:29 113280 ----a-w- d:\documents and settings\All Users\Application Data\Microsoft\VCExpress\9.0\1036\ResourceCache.dll
2011-04-29 10:28 . 2011-04-29 10:28 416 ----a-w- d:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1036\ResourceCache.dll
2011-04-29 10:26 . 2011-04-29 10:28 -------- d-----w- d:\program files\Microsoft Visual Studio 9.0
2011-04-29 10:26 . 2011-04-29 10:27 -------- d-----w- d:\program files\Fichiers communs\Merge Modules
2011-04-29 10:25 . 2011-04-29 10:25 -------- d-----w- d:\program files\Microsoft SDKs
2011-04-28 10:15 . 2010-06-02 02:55 74072 ----a-w- d:\windows\system32\XAPOFX1_5.dll
2011-04-28 10:15 . 2010-06-02 02:55 527192 ----a-w- d:\windows\system32\XAudio2_7.dll
2011-04-28 10:15 . 2010-06-02 02:55 239960 ----a-w- d:\windows\system32\xactengine3_7.dll
2011-04-28 10:15 . 2010-05-26 09:41 2106216 ----a-w- d:\windows\system32\D3DCompiler_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 1868128 ----a-w- d:\windows\system32\d3dcsx_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 470880 ----a-w- d:\windows\system32\d3dx10_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 248672 ----a-w- d:\windows\system32\d3dx11_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 1998168 ----a-w- d:\windows\system32\D3DX9_43.dll
2011-04-28 10:15 . 2010-02-04 08:01 74072 ----a-w- d:\windows\system32\XAPOFX1_4.dll
2011-04-28 10:15 . 2010-02-04 08:01 528216 ----a-w- d:\windows\system32\XAudio2_6.dll
2011-04-28 10:15 . 2010-02-04 08:01 238936 ----a-w- d:\windows\system32\xactengine3_6.dll
2011-04-28 10:15 . 2010-02-04 08:01 22360 ----a-w- d:\windows\system32\X3DAudio1_7.dll
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-22 17:01 . 2008-11-10 08:45 16608 ----a-w- d:\windows\gdrv.sys
2011-04-20 13:55 . 2011-04-20 13:55 218688 ----a-w- d:\windows\system32\drivers\dtsoftbus01.sys
2011-04-01 18:57 . 2010-07-19 18:47 137656 ----a-w- d:\windows\system32\drivers\avipbb.sys
2008-11-10 19:20 . 2008-11-10 19:20 278528 ----a-w- d:\program files\Fichiers communs\FDEUnInstaller.exe
2011-05-07 07:46 . 2011-05-07 07:46 142296 ----a-w- d:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 --sha-r- d:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 --sha-r- d:\windows\system32\msfDX.dll
2008-03-16 12:30 216064 --sha-r- d:\windows\system32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2010-07-19 16:32 165184 ----a-w- d:\program files\SFR\Kit\SFRNavErrorHelper.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-06-10 11:29 97064 ----a-w- d:\program files\Nero\Nero8\InCD\NBHShx.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Connexion SFR 9props.exe"="d:\program files\SFR\Kit\9props.exe" [2010-07-19 976192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2011-01-07 111208]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="d:\windows\system32\tscupgrd.exe" [2004-08-05 44544]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ----a-w- d:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ----a-r- d:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2008-10-23 18:34 1336560 ----a-w- d:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneVI]
2007-07-26 13:05 20480 ----a-w- d:\program files\GIGABYTE\ET6\ETcall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- d:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recordpad]
2010-03-27 09:36 913412 ----a-w- d:\program files\NCH Swift Sound\Recordpad\recordpad.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-05-07 07:39 16862208 ----a-r- d:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-09 20:22 149280 ----a-w- d:\program files\Java\jre6\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys2]
2008-07-17 02:10 208896 ----a-r- d:\windows\system32\WinSys2.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"d:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\GIGABYTE\\EnergySaver\\run.exe"=
"d:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\batman arkham asylum - demo\\Binaries\\ShippingPC-BmGame.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead 2 demo\\left4dead2.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\Fox\\Aliens vs. Predator 2\\lithtech.exe"=
"d:\\Program Files\\CAPCOM\\RESIDENT EVIL 5\\RE5DX9.EXE"=
"d:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\nation red demo\\NationRed.exe"=
"d:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Codemasters\\Damnation\\Binaries\\DamnGame.exe"=
"d:\\Program Files\\Steam\\SteamApps\\mamadi31\\counter-strike source\\hl2.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:WARCRAFTTCP
"6112:UDP"= 6112:UDP:WARCRAFTUDP
.
R0 xmasscsi;xmasscsi;d:\windows\system32\drivers\xmasscsi.sys [06/12/2008 16:46 5248]
R1 prodrv04;Star Force copy protection driver v4;d:\windows\system32\drivers\prodrv04.sys [03/01/2010 19:10 114496]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [19/07/2010 20:47 136360]
R2 GEST Service;GEST Service for program management.;d:\program files\GIGABYTE\EnergySaver\GSvr.exe [10/11/2008 10:45 80392]
R2 NeroRegInCDSrv;Nero Registry InCD Service;d:\program files\Nero\Nero8\InCD\NBHRegInCDSrv.exe [10/06/2008 13:29 53032]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;d:\windows\system32\drivers\dtsoftbus01.sys [20/04/2011 15:55 218688]
R3 nvoclock;NVIDIA Enthusiasts Platform KDM;d:\windows\system32\drivers\nvoclock.sys [09/03/2009 12:25 38304]
S0 sptd;sptd;d:\windows\system32\drivers\sptd.sys [24/11/2008 10:59 717296]
S1 anf0100.sys;anf0100.sys;\??\d:\windows\system32\drivers\anf0100.sys --> d:\windows\system32\drivers\anf0100.sys [?]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\Drivers\avgldx86.sys --> d:\windows\system32\Drivers\avgldx86.sys [?]
S1 AvgTdiX;AVG Free Network Redirector;d:\windows\system32\Drivers\avgtdix.sys --> d:\windows\system32\Drivers\avgtdix.sys [?]
S2 gupdate1ca046a6f826e06;Service Google Update (gupdate1ca046a6f826e06);d:\program files\Google\Update\GoogleUpdate.exe [14/07/2009 12:04 133104]
S3 gupdatem;Service Google Update (gupdatem);d:\program files\Google\Update\GoogleUpdate.exe [14/07/2009 12:04 133104]
S3 ProtoWall;ProtoWall Network Service;d:\windows\system32\DRIVERS\ProtoWall.sys --> d:\windows\system32\DRIVERS\ProtoWall.sys [?]
S4 MSSQLServerADHelper100;Service SQL Active Directory Helper;d:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [11/07/2008 02:28 47128]
S4 RsFx0102;RsFx0102 Driver;d:\windows\system32\drivers\RsFx0102.sys [10/07/2008 02:49 242712]
S4 SQLAgent$SQLEXPRESS;Agent SQL Server (SQLEXPRESS);d:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11/07/2008 02:28 369688]
S4 xmasbus;xmasbus;d:\windows\system32\drivers\xmasbus.sys [06/12/2008 16:46 140800]
.
Contenu du dossier 'Tâches planifiées'
.
2011-05-22 d:\windows\Tasks\GoogleUpdateTaskMachineCore1cb6d4799c7eab4.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-07-14 10:04]
.
2011-05-22 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-07-14 10:04]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
IE: E&xporter vers Microsoft Excel - d:\progra~1\Microsoft Office\Office12\EXCEL.EXE/3000
FF - ProfilePath - d:\documents and settings\nico\Application Data\Mozilla\Firefox\Profiles\9y6o6g76.default\
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=08f8b730000000000000001fd026b688&tlver=1.4.19.19&instlRef=sst&ss=1&affID=18026&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-22 19:01
Windows 5.1.2600 Service Pack 2 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: HDT722516DLA380 rev.V43OA96A -> Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T1L0-19
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
sectors 321670845 (+255): user != kernel
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1801674531-329068152-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:57,a1,36,87,7a,18,af,b3,5b,7e,6e,8d,ce,b4,b5,9a,1f,38,0e,e2,17,40,4f,
60,b1,9b,d2,05,56,a8,c5,c3,cc,0b,dd,f0,ab,87,cd,9e,2a,61,a4,5c,e3,7d,f7,f7,\
"??"=hex:4a,59,7a,da,60,12,a0,b9,16,36,9b,cb,13,e3,e9,29
.
[HKEY_USERS\S-1-5-21-1801674531-329068152-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:a3,85,b0,2b,04,66,fb,4c,47,27,4e,b8,a3,a4,20,7a,5f,c7,b5,4b,d7,
82,ca,3f,6a,d5,1e,63,36,8c,4c,29,c3,79,9d,22,ec,58,4f,88,c6,95,76,00,77,ae,\
"rkeysecu"=hex:0e,70,b8,86,5b,91,7e,00,cd,de,f2,cf,1c,fb,bc,4d
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(4036)
d:\program files\Nero\Nero8\InCD\NBHShx.dll
d:\program files\Nero\Nero8\InCD\NBHStr.dll
d:\program files\Fichiers communs\Nero\Shared\NL3\AdvrCntr3.dll
d:\windows\system32\msi.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\nvsvc32.exe
d:\windows\system32\RUNDLL32.EXE
d:\program files\Avira\AntiVir Desktop\avguard.exe
d:\program files\Avira\AntiVir Desktop\avshadow.exe
d:\program files\Nero\Nero8\InCD\InCDsrv.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
d:\program files\NVIDIA Corporation\nTune\nTuneService.exe
d:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
d:\program files\NVIDIA Corporation\System Update\UpdateCenterService.exe
d:\windows\system32\wscntfy.exe
d:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe
.
**************************************************************************
.
Heure de fin: 2011-05-22 19:04:23 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-05-22 17:04
ComboFix2.txt 2011-05-20 17:43
ComboFix3.txt 2011-05-19 18:56
.
Avant-CF: 41 816 666 112 octets libres
Après-CF: 41 798 041 600 octets libres
.
Current=9 Default=9 Failed=0 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,10,11
- - End Of File - - 29515CF3B15FA424E4058C7CDEB52676

VT Community Sign in ? Languages ?
Virus Total
Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...
3 VT Community user(s) with a total of 3 reputation credit(s) say(s) this sample is goodware. 2 VT Community user(s) with a total of 2 reputation credit(s) say(s) this sample is malware.
File name:
WinSys2.exe
Submission date:
2011-05-22 17:00:43 (UTC)
Current status:
finished
Result:
1/ 42 (2.4%)

VT Community

controversial
Safety score: 60.0%
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.05.23.00 2011.05.22 -
AntiVir 7.11.8.89 2011.05.21 -
Antiy-AVL 2.0.3.7 2011.05.22 -
Avast 4.8.1351.0 2011.05.22 -
Avast5 5.0.677.0 2011.05.22 -
AVG 10.0.0.1190 2011.05.22 -
BitDefender 7.2 2011.05.22 -
CAT-QuickHeal 11.00 2011.05.22 -
ClamAV 0.97.0.0 2011.05.22 -
Comodo 8794 2011.05.22 -
DrWeb 5.0.2.03300 2011.05.22 -
Emsisoft 5.1.0.5 2011.05.22 -
eSafe 7.0.17.0 2011.05.19 Win32.TrojanHorse
eTrust-Vet 36.1.8339 2011.05.20 -
F-Prot 4.6.2.117 2011.05.22 -
F-Secure 9.0.16440.0 2011.05.22 -
Fortinet 4.2.257.0 2011.05.22 -
GData 22 2011.05.22 -
Ikarus T3.1.1.104.0 2011.05.22 -
Jiangmin 13.0.900 2011.05.22 -
K7AntiVirus 9.103.4693 2011.05.20 -
Kaspersky 9.0.0.837 2011.05.22 -
McAfee 5.400.0.1158 2011.05.22 -
McAfee-GW-Edition 2010.1D 2011.05.22 -
Microsoft 1.6903 2011.05.22 -
NOD32 6142 2011.05.22 -
Norman 6.07.07 2011.05.22 -
nProtect 2011-05-22.01 2011.05.22 -
Panda 10.0.3.5 2011.05.22 -
PCTools 7.0.3.5 2011.05.19 -
Prevx 3.0 2011.05.22 -
Rising 23.58.06.03 2011.05.22 -
Sophos 4.65.0 2011.05.22 -
SUPERAntiSpyware 4.40.0.1006 2011.05.22 -
Symantec 20111.1.0.186 2011.05.22 -
TheHacker 6.7.0.1.202 2011.05.20 -
TrendMicro 9.200.0.1012 2011.05.22 -
TrendMicro-HouseCall 9.200.0.1012 2011.05.22 -
VBA32 3.12.16.0 2011.05.20 -
VIPRE 9356 2011.05.22 -
ViRobot 2011.5.21.4472 2011.05.22 -
VirusBuster 13.6.367.0 2011.05.22 -
Additional information
MD5 : 27949ccd505a6be082d15547b1dff90d
SHA1 : 569f27f34d53ec7f3eb0151108f3d4f0b4e54140
SHA256: 7c47e876766ecd62aad68812a40f30bad56a32d994cc16a116b8d3c4ea30ee82

VT Community

User:
Anonymous
Reputation:
1 credits
Comment date:
2010-09-06 20:00:14 (UTC)
ITS A TROJAN!!!!
Tags: Malware, NetworkWorm,

Was this comment helpful? Yes (1) | No (2) | Report abuse

User:
Anonymous
Reputation:
1 credits
Comment date:
2010-10-26 17:26:33 (UTC)
1/42

I doubt it.


Ive had this for close to 3 monthes, no issues, but annoying pop-up messages.
Tags: Goodware

Was this comment helpful? Yes (0) | No (0) | Report abuse

User:
Anonymous
Reputation:
1 credits
Comment date:
2010-11-06 15:18:11 (UTC)
on 43 of them, one found it was a trojan. If you have just installed MSI material please run the program it is contained in every MSI packages.
Tags: Goodware

Was this comment helpful? Yes (1) | No (0) | Report abuse

User:
Anonymous
Reputation:
1 credits
Comment date:
2010-11-21 21:55:01 (UTC)
Tags: Malware

Was this comment helpful? Yes (0) | No (0) | Report abuse

User:
Anonymous
Reputation:
1 credits
Comment date:
2011-02-08 06:13:26 (UTC)
This program is installed by MSI mainboard as part of it's utilities package. It monitors the clock speed of your video card and adjusts settings accordingly. Hence the name DOT "Dynamic Overclocking Technology" - Removing it simply disables this feature of your MSI mainboard / graphic card.
Tags: Goodware,

Was this comment helpful? Yes (0) | No (0) | Report abuse
Prev1Next



Add your comment... Remember that when you write comments as an anonymous user they receive the lowest possible reputation. So if you have not signed in yet don't forget to do so. How to markup your comments?
Goodware
Malware
Spam attachment/link

P2P download
Propagating via IM
Network worm

Drive-by-download






ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
VirusTotal © Hispasec Sistemas - Blog - Twitter - Contact: info@virustotal.com - TOS & Privacy Policy

combofix a voulu redémarrer windows mais j'ai du utiliser le bouton d"arret ça voulait pas

?

j'ai réanalysé après la manip combofix dsl

merci pour ton aide

nicolas

je peux avoir le lien de la page comme demandé ?

j'étais de mariage hier je me remet pas super bien
;)

http://www.virustotal.com/file-scan/report.html?id=7c47e876766ecd62aad68812a40f30bad56a32d994cc16a116b8d3c4ea30ee82-1306086358

ComboFix 11-05-22.01 - nico 23/05/2011 9:49.4.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3326.2787 [GMT 2:00]
Lancé depuis: d:\documents and settings\nico\Bureau\nico.exe
Commutateurs utilisés :: d:\documents and settings\nico\Bureau\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
FILE ::
"d:\windows\system32\WinSys2.exe"
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\windows\system32\WinSys2.exe
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-04-23 au 2011-05-23 ))))))))))))))))))))))))))))))))))))
.
.
2011-05-19 18:48 . 2011-05-19 18:56 -------- d-----w- D:\nico
2011-05-19 09:38 . 2011-05-19 09:38 -------- d-----w- D:\Kill'em
2011-05-19 06:20 . 2011-05-19 06:20 -------- d-----w- d:\program files\Ad-Remover
2011-05-18 13:59 . 2011-05-18 14:20 -------- d-----w- D:\UsbFix
2011-05-07 07:46 . 2011-05-07 07:46 89048 ----a-w- d:\program files\Mozilla Firefox\libEGL.dll
2011-05-07 07:46 . 2011-05-07 07:46 781272 ----a-w- d:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-07 07:46 . 2011-05-07 07:46 465880 ----a-w- d:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-07 07:46 . 2011-05-07 07:46 1874904 ----a-w- d:\program files\Mozilla Firefox\mozjs.dll
2011-05-07 07:46 . 2011-05-07 07:46 15832 ----a-w- d:\program files\Mozilla Firefox\mozalloc.dll
2011-05-07 07:46 . 2011-05-07 07:46 1974616 ----a-w- d:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-07 07:46 . 2011-05-07 07:46 1892184 ----a-w- d:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-07 07:46 . 2011-05-07 07:46 142296 ----a-w- d:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-03 07:53 . 2011-05-03 07:53 413696 ----a-w- d:\windows\system32\wrap_oal.dll
2011-05-03 07:53 . 2011-05-03 07:53 110592 ----a-w- d:\windows\system32\OpenAL32.dll
2011-04-29 12:59 . 2011-04-29 12:59 -------- d-----w- d:\documents and settings\nico\Local Settings\Application Data\AliensVsPredator
2011-04-29 12:14 . 2011-05-15 12:40 -------- d-----w- d:\program files\Aliens Vs Predator
2011-04-29 10:59 . 2008-07-11 00:28 50200 ----a-w- d:\windows\system32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.0.1600.22.dll
2011-04-29 10:59 . 2008-07-11 00:28 79896 ----a-w- d:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll
2011-04-29 10:58 . 2011-04-29 10:58 -------- d-----w- d:\windows\system32\RsFx
2011-04-29 10:29 . 2011-04-29 10:58 -------- d-----w- d:\program files\Microsoft SQL Server
2011-04-29 10:29 . 2011-04-29 10:29 113280 ----a-w- d:\documents and settings\All Users\Application Data\Microsoft\VCExpress\9.0\1036\ResourceCache.dll
2011-04-29 10:28 . 2011-04-29 10:28 416 ----a-w- d:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1036\ResourceCache.dll
2011-04-29 10:26 . 2011-04-29 10:28 -------- d-----w- d:\program files\Microsoft Visual Studio 9.0
2011-04-29 10:26 . 2011-04-29 10:27 -------- d-----w- d:\program files\Fichiers communs\Merge Modules
2011-04-29 10:25 . 2011-04-29 10:25 -------- d-----w- d:\program files\Microsoft SDKs
2011-04-28 10:15 . 2010-06-02 02:55 74072 ----a-w- d:\windows\system32\XAPOFX1_5.dll
2011-04-28 10:15 . 2010-06-02 02:55 527192 ----a-w- d:\windows\system32\XAudio2_7.dll
2011-04-28 10:15 . 2010-06-02 02:55 239960 ----a-w- d:\windows\system32\xactengine3_7.dll
2011-04-28 10:15 . 2010-05-26 09:41 2106216 ----a-w- d:\windows\system32\D3DCompiler_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 1868128 ----a-w- d:\windows\system32\d3dcsx_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 470880 ----a-w- d:\windows\system32\d3dx10_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 248672 ----a-w- d:\windows\system32\d3dx11_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 1998168 ----a-w- d:\windows\system32\D3DX9_43.dll
2011-04-28 10:15 . 2010-02-04 08:01 74072 ----a-w- d:\windows\system32\XAPOFX1_4.dll
2011-04-28 10:15 . 2010-02-04 08:01 528216 ----a-w- d:\windows\system32\XAudio2_6.dll
2011-04-28 10:15 . 2010-02-04 08:01 238936 ----a-w- d:\windows\system32\xactengine3_6.dll
2011-04-28 10:15 . 2010-02-04 08:01 22360 ----a-w- d:\windows\system32\X3DAudio1_7.dll
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-23 07:57 . 2008-11-10 08:45 16608 ----a-w- d:\windows\gdrv.sys
2011-04-20 13:55 . 2011-04-20 13:55 218688 ----a-w- d:\windows\system32\drivers\dtsoftbus01.sys
2011-04-01 18:57 . 2010-07-19 18:47 137656 ----a-w- d:\windows\system32\drivers\avipbb.sys
2008-11-10 19:20 . 2008-11-10 19:20 278528 ----a-w- d:\program files\Fichiers communs\FDEUnInstaller.exe
2011-05-07 07:46 . 2011-05-07 07:46 142296 ----a-w- d:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 --sha-r- d:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 --sha-r- d:\windows\system32\msfDX.dll
2008-03-16 12:30 216064 --sha-r- d:\windows\system32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2010-07-19 16:32 165184 ----a-w- d:\program files\SFR\Kit\SFRNavErrorHelper.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-06-10 11:29 97064 ----a-w- d:\program files\Nero\Nero8\InCD\NBHShx.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Connexion SFR 9props.exe"="d:\program files\SFR\Kit\9props.exe" [2010-07-19 976192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2011-01-07 111208]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="d:\windows\system32\tscupgrd.exe" [2004-08-05 44544]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ----a-w- d:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ----a-r- d:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2008-10-23 18:34 1336560 ----a-w- d:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneVI]
2007-07-26 13:05 20480 ----a-w- d:\program files\GIGABYTE\ET6\ETcall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- d:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recordpad]
2010-03-27 09:36 913412 ----a-w- d:\program files\NCH Swift Sound\Recordpad\recordpad.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-05-07 07:39 16862208 ----a-r- d:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-09 20:22 149280 ----a-w- d:\program files\Java\jre6\bin\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"d:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\GIGABYTE\\EnergySaver\\run.exe"=
"d:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\batman arkham asylum - demo\\Binaries\\ShippingPC-BmGame.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead 2 demo\\left4dead2.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\Fox\\Aliens vs. Predator 2\\lithtech.exe"=
"d:\\Program Files\\CAPCOM\\RESIDENT EVIL 5\\RE5DX9.EXE"=
"d:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\nation red demo\\NationRed.exe"=
"d:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Codemasters\\Damnation\\Binaries\\DamnGame.exe"=
"d:\\Program Files\\Steam\\SteamApps\\mamadi31\\counter-strike source\\hl2.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:WARCRAFTTCP
"6112:UDP"= 6112:UDP:WARCRAFTUDP
.
R0 xmasscsi;xmasscsi;d:\windows\system32\drivers\xmasscsi.sys [06/12/2008 16:46 5248]
R1 prodrv04;Star Force copy protection driver v4;d:\windows\system32\drivers\prodrv04.sys [03/01/2010 19:10 114496]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [19/07/2010 20:47 136360]
R2 GEST Service;GEST Service for program management.;d:\program files\GIGABYTE\EnergySaver\GSvr.exe [10/11/2008 10:45 80392]
R2 NeroRegInCDSrv;Nero Registry InCD Service;d:\program files\Nero\Nero8\InCD\NBHRegInCDSrv.exe [10/06/2008 13:29 53032]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;d:\windows\system32\drivers\dtsoftbus01.sys [20/04/2011 15:55 218688]
R3 nvoclock;NVIDIA Enthusiasts Platform KDM;d:\windows\system32\drivers\nvoclock.sys [09/03/2009 12:25 38304]
S0 sptd;sptd;d:\windows\system32\drivers\sptd.sys [24/11/2008 10:59 717296]
S1 anf0100.sys;anf0100.sys;\??\d:\windows\system32\drivers\anf0100.sys --> d:\windows\system32\drivers\anf0100.sys [?]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\Drivers\avgldx86.sys --> d:\windows\system32\Drivers\avgldx86.sys [?]
S1 AvgTdiX;AVG Free Network Redirector;d:\windows\system32\Drivers\avgtdix.sys --> d:\windows\system32\Drivers\avgtdix.sys [?]
S2 gupdate1ca046a6f826e06;Service Google Update (gupdate1ca046a6f826e06);d:\program files\Google\Update\GoogleUpdate.exe [14/07/2009 12:04 133104]
S3 gupdatem;Service Google Update (gupdatem);d:\program files\Google\Update\GoogleUpdate.exe [14/07/2009 12:04 133104]
S3 ProtoWall;ProtoWall Network Service;d:\windows\system32\DRIVERS\ProtoWall.sys --> d:\windows\system32\DRIVERS\ProtoWall.sys [?]
S4 MSSQLServerADHelper100;Service SQL Active Directory Helper;d:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [11/07/2008 02:28 47128]
S4 RsFx0102;RsFx0102 Driver;d:\windows\system32\drivers\RsFx0102.sys [10/07/2008 02:49 242712]
S4 SQLAgent$SQLEXPRESS;Agent SQL Server (SQLEXPRESS);d:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11/07/2008 02:28 369688]
S4 xmasbus;xmasbus;d:\windows\system32\drivers\xmasbus.sys [06/12/2008 16:46 140800]
.
Contenu du dossier 'Tâches planifiées'
.
2011-05-23 d:\windows\Tasks\GoogleUpdateTaskMachineCore1cb6d4799c7eab4.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-07-14 10:04]
.
2011-05-22 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-07-14 10:04]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
IE: E&xporter vers Microsoft Excel - d:\progra~1\Microsoft Office\Office12\EXCEL.EXE/3000
FF - ProfilePath - d:\documents and settings\nico\Application Data\Mozilla\Firefox\Profiles\9y6o6g76.default\
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=08f8b730000000000000001fd026b688&tlver=1.4.19.19&instlRef=sst&ss=1&affID=18026&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-23 09:57
Windows 5.1.2600 Service Pack 2 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: HDT722516DLA380 rev.V43OA96A -> Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T1L0-19
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
sectors 321670845 (+255): user != kernel
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1801674531-329068152-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:57,a1,36,87,7a,18,af,b3,5b,7e,6e,8d,ce,b4,b5,9a,1f,38,0e,e2,17,40,4f,
60,b1,9b,d2,05,56,a8,c5,c3,cc,0b,dd,f0,ab,87,cd,9e,2a,61,a4,5c,e3,7d,f7,f7,\
"??"=hex:4a,59,7a,da,60,12,a0,b9,16,36,9b,cb,13,e3,e9,29
.
[HKEY_USERS\S-1-5-21-1801674531-329068152-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:a3,85,b0,2b,04,66,fb,4c,47,27,4e,b8,a3,a4,20,7a,5f,c7,b5,4b,d7,
82,ca,3f,6a,d5,1e,63,36,8c,4c,29,c3,79,9d,22,ec,58,4f,88,c6,95,76,00,77,ae,\
"rkeysecu"=hex:0e,70,b8,86,5b,91,7e,00,cd,de,f2,cf,1c,fb,bc,4d
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(3548)
d:\program files\Nero\Nero8\InCD\NBHShx.dll
d:\program files\Nero\Nero8\InCD\NBHStr.dll
d:\program files\Fichiers communs\Nero\Shared\NL3\AdvrCntr3.dll
d:\windows\system32\msi.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\nvsvc32.exe
d:\windows\system32\RUNDLL32.EXE
d:\program files\Avira\AntiVir Desktop\avguard.exe
d:\program files\Avira\AntiVir Desktop\avshadow.exe
d:\program files\Nero\Nero8\InCD\InCDsrv.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
d:\program files\NVIDIA Corporation\nTune\nTuneService.exe
d:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
d:\program files\NVIDIA Corporation\System Update\UpdateCenterService.exe
d:\windows\system32\wscntfy.exe
d:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe
.
**************************************************************************
.
Heure de fin: 2011-05-23 10:01:20 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-05-23 08:01
ComboFix2.txt 2011-05-22 17:04
ComboFix3.txt 2011-05-20 17:43
ComboFix4.txt 2011-05-19 18:56
.
Avant-CF: 41 937 006 592 octets libres
Après-CF: 41 918 001 152 octets libres
.
Current=9 Default=9 Failed=0 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,10,11
- - End Of File - - 8733F676582A6D7BAFF8D7163AF43555

bonjour, ci dessus je te post le rapport

merci à toi pour ton aide

nicolas

c fait, au demarrage prog autocheck not found et ça démarre

le win du lecteur c n'est plus proposé c'est celui la que tu a du voir pas officiel que je n'ai jamais utilisé c'étais pour pouvoir toujours accéder à l'ordi même vérolé

mauvaise idée donc

et oui mais un windows non officiel est present , il n'a pas de mises à jour donc , n'est pas compatible avec notre epoque où tout va très vite donc :

c'est celui la que tu a du voir pas officiel que je n'ai jamais utilisé c'étais pour pouvoir toujours accéder à l'ordi même vérolé
mauvaise idée donc

oui mauvaise idée le coup du windows pourri

je peu le virer

avec ton aide ;)

l'autre est vrai mais c trop le bordel pour le valider par telephone lol

J'ai eu également un pop up d'un faux anti virus qui bloquait tous les programmes

j'ai refait un combo fix dont je te passerai les résultats après mon taf vers 14h30 et un malwarbyte qui a trouvé un virus gen j'ai bien cru réinstaller pour la milliéme fois windows erf

merci à toi

nicodetoulouse

j'ai du virer un virus sur un debrideur video bb

ok j'le referais plus

ok pour l'utilisation des softs je t'écoute pour la suite

merci de ton aide

il yen avait 6 dont trojan gen key après je sais plus sinon java agent 13073 sinon un dangeureux backdoor bds bifros.bdvu et un anti virus en pop up dont j ai oublié le nom mais après malwarbyte et combofix ya plus rien je crois je te poste les rapports

ComboFix 11-05-25.02 - Administrateur 26/05/2011 8:43.7.2 - x86 NETWORK
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3326.3015 [GMT 2:00]
Lancé depuis: d:\documents and settings\nico\Bureau\nico.exe
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\documents and settings\All Users\Application Data\defender.exe
d:\documents and settings\nico\Application Data\Adobe\plugs
d:\documents and settings\nico\Application Data\Adobe\plugs\mmc1569500.txt
d:\documents and settings\nico\Application Data\Adobe\plugs\mmc219.exe
d:\documents and settings\nico\Application Data\Adobe\shed
d:\documents and settings\nico\Application Data\Adobe\shed\thr1.chm
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-04-26 au 2011-05-26 ))))))))))))))))))))))))))))))))))))
.
.
2011-05-19 18:48 . 2011-05-19 18:56 -------- d-----w- D:\nico
2011-05-19 09:38 . 2011-05-19 09:38 -------- d-----w- D:\Kill'em
2011-05-19 06:20 . 2011-05-19 06:20 -------- d-----w- d:\program files\Ad-Remover
2011-05-18 13:59 . 2011-05-24 12:28 -------- d-----w- D:\UsbFix
2011-05-07 07:46 . 2011-05-07 07:46 89048 ----a-w- d:\program files\Mozilla Firefox\libEGL.dll
2011-05-07 07:46 . 2011-05-07 07:46 781272 ----a-w- d:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-07 07:46 . 2011-05-07 07:46 465880 ----a-w- d:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-07 07:46 . 2011-05-07 07:46 1874904 ----a-w- d:\program files\Mozilla Firefox\mozjs.dll
2011-05-07 07:46 . 2011-05-07 07:46 15832 ----a-w- d:\program files\Mozilla Firefox\mozalloc.dll
2011-05-07 07:46 . 2011-05-07 07:46 1974616 ----a-w- d:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-07 07:46 . 2011-05-07 07:46 1892184 ----a-w- d:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-07 07:46 . 2011-05-07 07:46 142296 ----a-w- d:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-03 07:53 . 2011-05-03 07:53 413696 ----a-w- d:\windows\system32\wrap_oal.dll
2011-05-03 07:53 . 2011-05-03 07:53 110592 ----a-w- d:\windows\system32\OpenAL32.dll
2011-04-29 12:59 . 2011-04-29 12:59 -------- d-----w- d:\documents and settings\nico\Local Settings\Application Data\AliensVsPredator
2011-04-29 12:14 . 2011-05-15 12:40 -------- d-----w- d:\program files\Aliens Vs Predator
2011-04-29 10:59 . 2008-07-11 00:28 50200 ----a-w- d:\windows\system32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.0.1600.22.dll
2011-04-29 10:59 . 2008-07-11 00:28 79896 ----a-w- d:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll
2011-04-29 10:58 . 2011-04-29 10:58 -------- d-----w- d:\windows\system32\RsFx
2011-04-29 10:29 . 2011-04-29 10:58 -------- d-----w- d:\program files\Microsoft SQL Server
2011-04-29 10:29 . 2011-04-29 10:29 113280 ----a-w- d:\documents and settings\All Users\Application Data\Microsoft\VCExpress\9.0\1036\ResourceCache.dll
2011-04-29 10:28 . 2011-04-29 10:28 416 ----a-w- d:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1036\ResourceCache.dll
2011-04-29 10:26 . 2011-04-29 10:28 -------- d-----w- d:\program files\Microsoft Visual Studio 9.0
2011-04-29 10:26 . 2011-04-29 10:27 -------- d-----w- d:\program files\Fichiers communs\Merge Modules
2011-04-29 10:25 . 2011-04-29 10:25 -------- d-----w- d:\program files\Microsoft SDKs
2011-04-28 10:15 . 2010-06-02 02:55 74072 ----a-w- d:\windows\system32\XAPOFX1_5.dll
2011-04-28 10:15 . 2010-06-02 02:55 527192 ----a-w- d:\windows\system32\XAudio2_7.dll
2011-04-28 10:15 . 2010-06-02 02:55 239960 ----a-w- d:\windows\system32\xactengine3_7.dll
2011-04-28 10:15 . 2010-05-26 09:41 2106216 ----a-w- d:\windows\system32\D3DCompiler_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 1868128 ----a-w- d:\windows\system32\d3dcsx_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 470880 ----a-w- d:\windows\system32\d3dx10_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 248672 ----a-w- d:\windows\system32\d3dx11_43.dll
2011-04-28 10:15 . 2010-05-26 09:41 1998168 ----a-w- d:\windows\system32\D3DX9_43.dll
2011-04-28 10:15 . 2010-02-04 08:01 74072 ----a-w- d:\windows\system32\XAPOFX1_4.dll
2011-04-28 10:15 . 2010-02-04 08:01 528216 ----a-w- d:\windows\system32\XAudio2_6.dll
2011-04-28 10:15 . 2010-02-04 08:01 238936 ----a-w- d:\windows\system32\xactengine3_6.dll
2011-04-28 10:15 . 2010-02-04 08:01 22360 ----a-w- d:\windows\system32\X3DAudio1_7.dll
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-26 06:09 . 2008-11-10 08:45 16608 ----a-w- d:\windows\gdrv.sys
2011-05-24 12:28 . 2011-05-24 12:28 191635 ----a-w- D:\UsbFix_Upload_Me_NICO-B9BF2AACED.zip
2011-04-20 13:55 . 2011-04-20 13:55 218688 ----a-w- d:\windows\system32\drivers\dtsoftbus01.sys
2011-04-01 18:57 . 2010-07-19 18:47 137656 ----a-w- d:\windows\system32\drivers\avipbb.sys
2008-11-10 19:20 . 2008-11-10 19:20 278528 ----a-w- d:\program files\Fichiers communs\FDEUnInstaller.exe
2011-05-07 07:46 . 2011-05-07 07:46 142296 ----a-w- d:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 --sha-r- d:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 --sha-r- d:\windows\system32\msfDX.dll
2008-03-16 12:30 216064 --sha-r- d:\windows\system32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2010-07-19 16:32 165184 ----a-w- d:\program files\SFR\Kit\SFRNavErrorHelper.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-06-10 11:29 97064 ----a-w- d:\program files\Nero\Nero8\InCD\NBHShx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2011-01-07 111208]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="d:\windows\system32\tscupgrd.exe" [2004-08-05 44544]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk*
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ----a-w- d:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ----a-r- d:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2008-10-23 18:34 1336560 ----a-w- d:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneVI]
2007-07-26 13:05 20480 ----a-w- d:\program files\GIGABYTE\ET6\ETcall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- d:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recordpad]
2010-03-27 09:36 913412 ----a-w- d:\program files\NCH Swift Sound\Recordpad\recordpad.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-05-07 07:39 16862208 ----a-r- d:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-09 20:22 149280 ----a-w- d:\program files\Java\jre6\bin\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"d:\\WINDOWS\\system32\\PnkBstrA.exe"=
"d:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"d:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\GIGABYTE\\EnergySaver\\run.exe"=
"d:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\batman arkham asylum - demo\\Binaries\\ShippingPC-BmGame.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead 2 demo\\left4dead2.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\Fox\\Aliens vs. Predator 2\\lithtech.exe"=
"d:\\Program Files\\CAPCOM\\RESIDENT EVIL 5\\RE5DX9.EXE"=
"d:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"d:\\Program Files\\Steam\\SteamApps\\common\\nation red demo\\NationRed.exe"=
"d:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Codemasters\\Damnation\\Binaries\\DamnGame.exe"=
"d:\\Program Files\\Steam\\SteamApps\\mamadi31\\counter-strike source\\hl2.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:WARCRAFTTCP
"6112:UDP"= 6112:UDP:WARCRAFTUDP
.
R0 xmasscsi;xmasscsi;d:\windows\system32\drivers\xmasscsi.sys [06/12/2008 16:46 5248]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;d:\windows\system32\drivers\dtsoftbus01.sys [20/04/2011 15:55 218688]
R3 nvoclock;NVIDIA Enthusiasts Platform KDM;d:\windows\system32\drivers\nvoclock.sys [09/03/2009 12:25 38304]
S0 sptd;sptd;d:\windows\system32\drivers\sptd.sys [24/11/2008 10:59 717296]
S1 anf0100.sys;anf0100.sys;\??\d:\windows\system32\drivers\anf0100.sys --> d:\windows\system32\drivers\anf0100.sys [?]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\Drivers\avgldx86.sys --> d:\windows\system32\Drivers\avgldx86.sys [?]
S1 AvgTdiX;AVG Free Network Redirector;d:\windows\system32\Drivers\avgtdix.sys --> d:\windows\system32\Drivers\avgtdix.sys [?]
S1 prodrv04;Star Force copy protection driver v4;d:\windows\system32\drivers\prodrv04.sys [03/01/2010 19:10 114496]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [19/07/2010 20:47 136360]
S2 GEST Service;GEST Service for program management.;d:\program files\GIGABYTE\EnergySaver\GSvr.exe [10/11/2008 10:45 80392]
S2 gupdate1ca046a6f826e06;Service Google Update (gupdate1ca046a6f826e06);d:\program files\Google\Update\GoogleUpdate.exe [14/07/2009 12:04 133104]
S2 NeroRegInCDSrv;Nero Registry InCD Service;d:\program files\Nero\Nero8\InCD\NBHRegInCDSrv.exe [10/06/2008 13:29 53032]
S3 gupdatem;Service Google Update (gupdatem);d:\program files\Google\Update\GoogleUpdate.exe [14/07/2009 12:04 133104]
S3 pbfilter;pbfilter;d:\program files\PeerBlock\pbfilter.sys [19/10/2010 22:48 19056]
S3 ProtoWall;ProtoWall Network Service;d:\windows\system32\DRIVERS\ProtoWall.sys --> d:\windows\system32\DRIVERS\ProtoWall.sys [?]
S4 MSSQLServerADHelper100;Service SQL Active Directory Helper;d:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [11/07/2008 02:28 47128]
S4 RsFx0102;RsFx0102 Driver;d:\windows\system32\drivers\RsFx0102.sys [10/07/2008 02:49 242712]
S4 SQLAgent$SQLEXPRESS;Agent SQL Server (SQLEXPRESS);d:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11/07/2008 02:28 369688]
S4 xmasbus;xmasbus;d:\windows\system32\drivers\xmasbus.sys [06/12/2008 16:46 140800]
.
Contenu du dossier 'Tâches planifiées'
.
2011-05-26 d:\windows\Tasks\GoogleUpdateTaskMachineCore1cb6d4799c7eab4.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-07-14 10:04]
.
2011-05-26 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-07-14 10:04]
.
.
------- Examen supplémentaire -------
.
FF - ProfilePath -
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-26 08:48
Windows 5.1.2600 Service Pack 2 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: HDT722516DLA380 rev.V43OA96A -> Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T1L0-19
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
sectors 321670845 (+255): user != kernel
.

mon ordi marche impec merci pour tout

Nicodetoulouse

http://www.cijoint.fr/cjlink.php?file=cj201105/cijy7rRVvH.txt
il y avait un proxy
je l'ai viré
je fais la suite merci

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 6615

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

19/05/2011 11:22:52
mbam-log-2011-05-19 (11-22-52).txt

Type d'examen: Examen complet (C:\|D:\|H:\|)
Elément(s) analysé(s): 308261
Temps écoulé: 45 minute(s), 32 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

pre scan demandé

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan 1.0.1.7 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ XP | Vista | Seven - 32/64 bits ¤¤¤¤¤

Mis à jour le 19/05/2011 | 10.10 par g3n-h@ckm@n
Utilisateur : nico (Administrateurs)
Ordinateur : NICO-B9BF2AACED

Système d'exploitation : Microsoft Windows XP (32 bits)
Internet Explorer : 6.0.2900.2180
Mozilla Firefox : 4.0.1 (fr)

Scan : 11:38:14 | 19/05/2011

¤¤¤¤¤¤¤¤¤¤¤ Processus en cours

660 | D:\WINDOWS\System32\smss.exe - SYSTEM - Normal - \SystemRoot\System32\smss.exe - 4
720 | D:\WINDOWS\system32\csrss.exe - SYSTEM - Normal - D:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 - 660
744 | D:\WINDOWS\system32\winlogon.exe - SYSTEM - High - winlogon.exe - 660
788 | D:\WINDOWS\system32\services.exe - SYSTEM - Normal - D:\WINDOWS\system32\services.exe - 744
800 | D:\WINDOWS\system32\lsass.exe - SYSTEM - Normal - D:\WINDOWS\system32\lsass.exe - 744
1000 | D:\WINDOWS\system32\nvsvc32.exe - SYSTEM - Normal - D:\WINDOWS\system32\nvsvc32.exe - 788
1032 | D:\WINDOWS\system32\svchost.exe - SYSTEM - Normal - D:\WINDOWS\system32\svchost.exe -k DcomLaunch - 788
1136 | D:\WINDOWS\system32\svchost.exe - - Normal - D:\WINDOWS\system32\svchost.exe -k rpcss - 788
1232 | D:\WINDOWS\System32\svchost.exe - SYSTEM - Normal - D:\WINDOWS\System32\svchost.exe -k netsvcs - 788
1304 | D:\WINDOWS\system32\svchost.exe - SERVICE RÉSEAU - Normal - D:\WINDOWS\system32\svchost.exe -k NetworkService - 788
1480 | D:\WINDOWS\system32\svchost.exe - SERVICE LOCAL - Normal - D:\WINDOWS\system32\svchost.exe -k LocalService - 788
1668 | D:\WINDOWS\system32\spoolsv.exe - SYSTEM - Normal - D:\WINDOWS\system32\spoolsv.exe - 788
1860 | D:\Program Files\Avira\AntiVir Desktop\sched.exe - SYSTEM - Normal - "D:\Program Files\Avira\AntiVir Desktop\sched.exe" - 788
2004 | D:\WINDOWS\system32\svchost.exe - - Normal - D:\WINDOWS\system32\svchost.exe -k LocalService - 788
2032 | D:\Program Files\Avira\AntiVir Desktop\avgnt.exe - nico - Normal - "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min /nosplash - 1808
152 | D:\Program Files\SFR\Kit\9props.exe - nico - Normal - "D:\Program Files\SFR\Kit\9props.exe" /trayicon - 1808
176 | D:\WINDOWS\system32\ctfmon.exe - nico - Normal - "D:\WINDOWS\system32\ctfmon.exe" - 1808
528 | D:\Program Files\Avira\AntiVir Desktop\avguard.exe - SYSTEM - Normal - "D:\Program Files\Avira\AntiVir Desktop\avguard.exe" - 788
556 | D:\WINDOWS\System32\svchost.exe - SYSTEM - Normal - D:\WINDOWS\System32\svchost.exe -k eapsvcs - 788
580 | D:\Program Files\GIGABYTE\EnergySaver\GSvr.exe - SYSTEM - Normal - "D:\Program Files\GIGABYTE\EnergySaver\GSvr.exe" - 788
696 | D:\Program Files\Avira\AntiVir Desktop\avshadow.exe - SYSTEM - Normal - "D:\Program Files\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_00000210 - 528
148 | D:\Program Files\Nero\Nero8\InCD\InCDsrv.exe - SYSTEM - Normal - "D:\Program Files\Nero\Nero8\InCD\InCDsrv.exe" - 788
1052 | D:\Program Files\Java\jre6\bin\jqs.exe - SYSTEM - Idle - "D:\Program Files\Java\jre6\bin\jqs.exe" -service -config "D:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" - 788
1172 | D:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe - SERVICE RÉSEAU - Normal - "D:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS - 788
1448 | D:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe - SYSTEM - Normal - "D:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe" - 788
1508 | D:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe - SYSTEM - Normal - "D:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe" /StartService - 788
1820 | D:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe - SYSTEM - Normal - "D:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" - 788
1980 | D:\WINDOWS\system32\svchost.exe - SYSTEM - Normal - D:\WINDOWS\system32\svchost.exe -k imgsvc - 788
2092 | D:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe - SYSTEM - Normal - "D:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe" /StartService - 788
2932 | D:\WINDOWS\system32\wscntfy.exe - nico - Normal - D:\WINDOWS\system32\wscntfy.exe - 1232
3072 | D:\WINDOWS\System32\alg.exe - SERVICE LOCAL - Normal - D:\WINDOWS\System32\alg.exe - 788
3532 | D:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe - nico - Normal - "D:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" gpureading - 1508
17020 | D:\Documents and Settings\nico\Bureau\Pre_scan.exe - nico - High - "D:\Documents and Settings\nico\Bureau\Pre_scan.exe" - 1808
17052 | D:\WINDOWS\system32\cmd.exe - nico - Normal - cmd /c ""D:\Kill'em\Pv.bat" " - 17020
17060 | D:\Kill'em\Pv.exe - nico - Normal - D:\Kill'em\pv.exe -o"%i | %f - %u - %p - %l - %r" - 17052

¤¤¤¤¤¤¤¤¤¤ Winlogon

[HKLM | Winlogon] | Shell : Explorer.exe
[HKLM | Winlogon] | AutoRestartShell : 1
[HKLM | Winlogon] | userinit : D:\WINDOWS\system32\Userinit.exe,
[HKLM | Winlogon] | PowerDownAfterShutdown : 1
[HKLM | Winlogon] | System :

¤¤¤¤¤¤¤¤¤¤ Associations

[.exe] : exefile
[exefile | command] : "%1" %*
[.com] : ComFile
[comfile | command] : "%1" %*
[.reg] : regfile
[regfile | command] : regedit.exe "%1"
[.scr] : scrfile
[scrfile | command] : "%1" /S
[.bat] : batfile
[batfile | command] : "%1" %*
[.cmd] : cmdfile
[cmdfile | command] : "%1" %*
[.pif] : piffile
[piffile | command] : "%1" %*
[.url] : InternetShortcut
[InternetShortcut | command] : "D:\WINDOWS\system32\rundll32.exe" "D:\WINDOWS\system32\ieframe.dll",OpenURL %l
[Application.Manifest | command] : rundll32.exe dfshim.dll,ShOpenVerbApplication %1
[Application.Reference | command] : rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2
[Folder | command] : D:\WINDOWS\explorer.exe

¤

[Firefox | Command] | @ : "D:\Program Files\Mozilla Firefox\Firefox.exe"
[Firefox - Safemode | Command] | @ : "D:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
[IE | Command] | @ : "D:\Program Files\Internet Explorer\iexplore.exe"
[Applications | IE | Command] | @ : "D:\Program Files\Internet Explorer\iexplore.exe" %1
[Chrome | Command] | @ : "D:\Program Files\Google\Chrome\Application\chrome.exe"
[Assoc | Applications] | @ : http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s

¤¤¤¤¤¤¤¤¤¤ Divers

[HKLM | HideDesktopIcons\NewStartPanel] | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {208D2C60-3AEA-1069-A2D7-08002B30309D} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {871C5380-42A0-1069-A2EA-08002B30309D} : 0
[HKCU | Desktop] | Wallpaper : D:\Documents and Settings\nico\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
[HKCU | policies\Explorer] | NoDriveTypeAutoRun : 145
[HKLM | policies\Explorer] | NoDriveTypeAutoRun : 145
[HKLM | policies\Explorer] | HonorAutoRunSetting : 1

¤¤¤¤¤¤¤¤¤¤ Services

[Ndisuio] | Start : 3
[lmhosts] | Start : 2 : Actif
[LanmanWorkstation] | Start : 2 : Actif
[LanmanServer] | Start : 2 : Actif
[Audiosrv] | Start : 2 : Actif
[ERSvc] | Start : 2 : Actif
[Bits] | Start : 3 -> 2 : Actif
[CryptSvc] | Start : 2 : Actif
[EapHost] | Start : 2 : Actif
[SharedAccess] | Start : 2 : Actif
[wuauserv] | Start : 2 : Actif
[wscsvc] | Start : 2 : Actif
[wzcsvc] | Start : 2 : Actif

¤¤¤¤¤¤¤¤¤¤ Internet Explorer

[HKCU | Main] | Start Page : https://www.google.com/?gws_rd=ssl
[HKCU | Main] | Local Page : D:\WINDOWS\system32\blank.htm
[HKCU | Main] | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

[HKLM | Main] | Start Page : https://www.msn.com/fr-fr/?ocid=iehp
[HKLM | Main] | Local Page : %SystemRoot%\system32\blank.htm -> D:\WINDOWS\system32\blank.htm
[HKLM | Main] | Default_Search_URL : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKLM | Main] | Default_Page_URL : https://www.msn.com/fr-fr/?ocid=iehp
[HKLM | Main] | Search Page : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤

127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
127.0.0.1 123simsen.com
127.0.0.1 www.123simsen.com
127.0.0.1 123topsearch.com
127.0.0.1 www.123topsearch.com
127.0.0.1 125sms.co.uk
127.0.0.1 www.125sms.co.uk
127.0.0.1 125sms.com
127.0.0.1 www.125sms.com
127.0.0.1 132.com
127.0.0.1 www.132.com
127.0.0.1 1337crew.info
127.0.0.1 www.1337crew.info
127.0.0.1 www.1337-crew.to

[.......]

¤¤¤¤¤¤¤¤¤¤ Processus


¤¤¤¤¤¤¤¤¤¤ Traitement Fichiers | Dossiers | Registre

Mise en quarantaine : D:\DOCUME~1\nico\LOCALS~1\Temp\~DF1CA0.tmp
Mise en quarantaine : D:\DOCUME~1\nico\LOCALS~1\Temp\~DFAA91.tmp

¤¤¤¤¤¤¤¤¤¤ IFEO


¤¤¤¤¤¤¤¤¤¤ Mountpoints2


¤¤¤¤¤¤¤¤¤¤ Listing %AppData%

[02/09/2009 | 19:19:17] | D:\Documents and Settings\nico\Application Data\11d40978cf0893f8e979466f87044aff-i686.cache-2
[26/04/2011 | 21:15:22] | D:\Documents and Settings\nico\Application Data\57BA.B01
[10/11/2008 | 21:00:20] | D:\Documents and Settings\nico\Application Data\Adobe
[21/12/2009 | 14:04:29] | D:\Documents and Settings\nico\Application Data\Apple Computer
[16/10/2010 | 12:33:43] | D:\Documents and Settings\nico\Application Data\Avira
[21/12/2009 | 14:29:50] | D:\Documents and Settings\nico\Application Data\AVS4YOU
[04/12/2008 | 00:06:25] | D:\Documents and Settings\nico\Application Data\Bioshock
[09/12/2008 | 14:40:53] | D:\Documents and Settings\nico\Application Data\Canon
[15/03/2010 | 11:50:39] | D:\Documents and Settings\nico\Application Data\CocoonSoftware
[24/11/2008 | 10:59:03] | D:\Documents and Settings\nico\Application Data\DAEMON Tools
[20/04/2011 | 15:54:37] | D:\Documents and Settings\nico\Application Data\DAEMON Tools Lite
[20/11/2008 | 20:40:05] | D:\Documents and Settings\nico\Application Data\default.pls
[10/11/2008 | 10:43:33] | D:\Documents and Settings\nico\Application Data\desktop.ini
[17/12/2010 | 18:42:11] | D:\Documents and Settings\nico\Application Data\DriverCure
[16/11/2008 | 20:20:29] | D:\Documents and Settings\nico\Application Data\dvdcss
[24/02/2009 | 20:26:49] | D:\Documents and Settings\nico\Application Data\EPSON
[25/03/2010 | 08:55:54] | D:\Documents and Settings\nico\Application Data\Facebook
[27/03/2010 | 11:33:11] | D:\Documents and Settings\nico\Application Data\FreeAudioPack
[23/01/2009 | 22:46:30] | D:\Documents and Settings\nico\Application Data\GlarySoft
[15/11/2008 | 12:03:44] | D:\Documents and Settings\nico\Application Data\Google
[06/12/2008 | 16:53:54] | D:\Documents and Settings\nico\Application Data\Help
[10/11/2008 | 10:43:40] | D:\Documents and Settings\nico\Application Data\Identities
[10/11/2008 | 10:52:50] | D:\Documents and Settings\nico\Application Data\InstallShield
[10/11/2008 | 21:00:20] | D:\Documents and Settings\nico\Application Data\Macromedia
[15/11/2008 | 11:50:00] | D:\Documents and Settings\nico\Application Data\Malwarebytes
[11/11/2008 | 03:23:35] | D:\Documents and Settings\nico\Application Data\Media Player Classic
[10/11/2008 | 10:43:33] | D:\Documents and Settings\nico\Application Data\Microsoft
[23/02/2009 | 11:17:27] | D:\Documents and Settings\nico\Application Data\Microsoft Web Folders
[22/01/2011 | 14:18:00] | D:\Documents and Settings\nico\Application Data\mkvtoolnix
[10/11/2008 | 11:09:26] | D:\Documents and Settings\nico\Application Data\Mozilla
[08/11/2009 | 14:38:37] | D:\Documents and Settings\nico\Application Data\NationRed
[27/03/2010 | 11:33:47] | D:\Documents and Settings\nico\Application Data\NCH Swift Sound
[16/11/2008 | 22:06:42] | D:\Documents and Settings\nico\Application Data\Nero
[05/12/2008 | 22:38:29] | D:\Documents and Settings\nico\Application Data\NeroDigital(TM)
[16/11/2008 | 20:06:15] | D:\Documents and Settings\nico\Application Data\OpenOffice.org
[11/11/2008 | 15:07:40] | D:\Documents and Settings\nico\Application Data\PnkBstrK.sys
[14/04/2011 | 23:59:02] | D:\Documents and Settings\nico\Application Data\QuickScan
[27/03/2010 | 22:41:49] | D:\Documents and Settings\nico\Application Data\Recordpad
[26/02/2011 | 15:46:41] | D:\Documents and Settings\nico\Application Data\Reviversoft
[11/11/2008 | 15:12:26] | D:\Documents and Settings\nico\Application Data\SecuROM
[04/04/2009 | 09:58:50] | D:\Documents and Settings\nico\Application Data\SPORE
[16/09/2009 | 14:06:40] | D:\Documents and Settings\nico\Application Data\Steganos
[15/11/2008 | 11:58:02] | D:\Documents and Settings\nico\Application Data\Sun
[16/11/2008 | 21:50:31] | D:\Documents and Settings\nico\Application Data\TamoSoft
[16/11/2008 | 21:10:18] | D:\Documents and Settings\nico\Application Data\TuneUp Software
[16/12/2010 | 17:39:20] | D:\Documents and Settings\nico\Application Data\Uniblue
[23/12/2008 | 23:18:08] | D:\Documents and Settings\nico\Application Data\UseNeXT
[11/07/2009 | 16:46:16] | D:\Documents and Settings\nico\Application Data\vlc
[28/03/2010 | 12:56:52] | D:\Documents and Settings\nico\Application Data\VSO
[11/11/2008 | 15:00:11] | D:\Documents and Settings\nico\Application Data\WinRAR
[10/12/2008 | 11:34:11] | D:\Documents and Settings\nico\Application Data\ZoomBrowser EX

¤¤¤¤¤¤¤¤¤¤ Listing %CommonAppData%

[31/12/2008 | 17:39:43] | D:\Documents and Settings\All Users\Application Data\Adobe
[07/04/2011 | 09:46:25] | D:\Documents and Settings\All Users\Application Data\aGa06511nAhCe06511
[21/12/2009 | 14:00:19] | D:\Documents and Settings\All Users\Application Data\Apple
[21/12/2009 | 14:00:43] | D:\Documents and Settings\All Users\Application Data\Apple Computer
[31/12/2008 | 17:50:38] | D:\Documents and Settings\All Users\Application Data\Avira
[02/03/2011 | 23:44:32] | D:\Documents and Settings\All Users\Application Data\AVS4YOU
[20/04/2011 | 15:54:37] | D:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[10/11/2008 | 11:27:41] | D:\Documents and Settings\All Users\Application Data\desktop.ini
[17/12/2010 | 18:42:03] | D:\Documents and Settings\All Users\Application Data\DriverCure
[09/12/2010 | 20:07:58] | D:\Documents and Settings\All Users\Application Data\DVD Shrink
[21/02/2009 | 14:00:13] | D:\Documents and Settings\All Users\Application Data\dyaniilw.kxq
[09/12/2008 | 13:42:26] | D:\Documents and Settings\All Users\Application Data\EPSON
[20/12/2008 | 19:14:01] | D:\Documents and Settings\All Users\Application Data\Firefly Studios
[21/06/2010 | 09:58:32] | D:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
[15/11/2008 | 11:49:55] | D:\Documents and Settings\All Users\Application Data\Malwarebytes
[10/11/2008 | 11:27:24] | D:\Documents and Settings\All Users\Application Data\Microsoft
[27/11/2008 | 13:41:06] | D:\Documents and Settings\All Users\Application Data\Microsoft Help
[16/11/2008 | 22:05:25] | D:\Documents and Settings\All Users\Application Data\Nero
[07/08/2010 | 20:54:43] | D:\Documents and Settings\All Users\Application Data\NOS
[20/09/2009 | 19:34:39] | D:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
[28/01/2009 | 12:42:18] | D:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[17/12/2010 | 18:29:11] | D:\Documents and Settings\All Users\Application Data\ProcessLasso
[06/12/2008 | 17:00:05] | D:\Documents and Settings\All Users\Application Data\QuickTime
[15/11/2008 | 11:49:07] | D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[16/11/2008 | 21:50:09] | D:\Documents and Settings\All Users\Application Data\TamoSoft
[16/11/2008 | 21:09:56] | D:\Documents and Settings\All Users\Application Data\TuneUp Software
[09/12/2008 | 13:47:16] | D:\Documents and Settings\All Users\Application Data\UDL
[06/05/2009 | 09:09:46] | D:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[24/12/2008 | 00:04:05] | D:\Documents and Settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}

dois-je relancer malwarbyte ?

il n'a rien trouvé comme le dit le rapport

merci toujours

nicodetoulouse

le virus se relance autorun bloqué par avira propose de le suprimer mais ça recommence tout de même

https://forums.commentcamarche.net/forum/affich-22132263-infecte-par-autorun-inf#42