SOS Virus ou Trojan "Virtumonde"

salut,

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4
* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

et repost un log hijackthis ,

@+

ok atta

Alors voila le rapport vundo

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.5
Old versions of java are exploitable and should be removed.

Scan started at 21:07:48 23/11/2007

Listing files found while scanning....

No infected files were found.

Beginning removal...

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.5
Old versions of java are exploitable and should be removed.

Scan started at 23:58:42 23/11/2007

Listing files found while scanning....

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.5
Old versions of java are exploitable and should be removed.

Scan started at 16:28:08 01/12/2007

Listing files found while scanning....

C:\windows\system32\zrkwbnfv.dllbox

Beginning removal...

Attempting to delete C:\windows\system32\zrkwbnfv.dllbox
C:\windows\system32\zrkwbnfv.dllbox Has been deleted!

Performing Repairs to the registry.
Done!

re,

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Et voici le rapport Hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 16:37:36, on 01/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\ACER\PSM.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\program files\steam\steam.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\NOX\Bureau\hijackthis\ccm.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer.com/worldwide/selection.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E794189-7575-4306-8F49-CCDD291A59CD} - C:\WINDOWS\system32\ddcbbcc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (disabled by BHODemon)
O2 - BHO: (no name) - {D9F9B109-5295-4F9F-A93B-195FA8704549} - C:\WINDOWS\system32\jkkjh.dll
O2 - BHO: {0eaab1ef-c251-8619-27f4-44ec7c9c3e7e} - {e7e3c9c7-ce44-4f72-9168-152cfe1baae0} - C:\WINDOWS\system32\cndoyimj.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [MPS] C:\ACER\PSM.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Alaunch] C:\Windows\alaunch.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\ogirupfa.dll",b
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.acer.com/worldwide/selection.html
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: ddcbbcc - C:\WINDOWS\SYSTEM32\ddcbbcc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\uecgwpic.exe (file missing)
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

ok

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Voila

ComboFix 07-11-19.4C - NOX 2007-12-01 16:43:05.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1655 [GMT 1:00]
Running from: C:\Documents and Settings\NOX\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\NOX\Favoris\Online Security Guide.lnk
C:\WINDOWS\system32\hjkkj.ini
C:\WINDOWS\system32\hjkkj.ini2
C:\WINDOWS\system32\jkkjh.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-01 to 2007-12-01 ))))))))))))))))))))))))))))))))))))
.

2007-12-01 01:14 78,912 --a------ C:\WINDOWS\system32\cndoyimj.dll
2007-11-30 00:29 <REP> d-------- C:\Documents and Settings\All Users\SonicStage
2007-11-29 21:16 789,719 ---hs---- C:\WINDOWS\system32\afpurigo.ini
2007-11-28 19:51 <REP> d-------- C:\Program Files\a-squared Free
2007-11-28 19:39 <REP> d-------- C:\Program Files\Panda Security
2007-11-28 18:08 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-11-28 13:22 <REP> d-------- C:\Program Files\CCleaner
2007-11-28 13:04 <REP> d-------- C:\WINDOWS\ERUNT
2007-11-27 18:59 <REP> d-------- C:\Program Files\Sony Corporation
2007-11-27 18:59 27,255 --------- C:\WINDOWS\system32\drivers\NWWMUSB.sys
2007-11-27 18:59 11,510 --------- C:\WINDOWS\system32\drivers\VMCUSB.sys
2007-11-27 18:58 90,112 --------- C:\WINDOWS\snymsico.dll
2007-11-27 18:58 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
2007-11-27 18:58 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
2007-11-27 18:58 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
2007-11-27 18:58 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
2007-11-27 18:58 20,640 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-11-27 18:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2007-11-27 18:52 <REP> d-------- C:\Program Files\Sony
2007-11-27 18:50 <REP> d-------- C:\Program Files\Fichiers communs\Sony Shared
2007-11-27 18:50 <REP> d-------- C:\Documents and Settings\NOX\Application Data\Sony Corporation
2007-11-27 09:43 <REP> d-------- C:\Documents and Settings\NOX\Application Data\Grisoft
2007-11-27 09:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-27 09:43 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-27 09:36 <REP> d-------- C:\hijackthis
2007-11-25 13:33 143 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-11-25 02:32 <REP> d-------- C:\Program Files\Alwil Software
2007-11-25 02:32 815,480 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-25 02:32 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-11-25 02:32 95,608 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-11-25 02:32 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-25 02:32 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-25 02:32 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-25 02:32 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-25 02:32 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-24 01:56 340,064 --a------ C:\WINDOWS\system32\ddabb.VIR000
2007-11-23 21:07 <REP> d-------- C:\VundoFix Backups
2007-11-23 15:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Motive
2007-11-13 17:54 <REP> d-------- C:\WINDOWS\Motive
2007-11-13 17:54 <REP> d-------- C:\Program Files\Club-Internet
2007-11-13 17:53 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-11-13 17:53 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2007-11-13 17:53 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-11-13 12:43 <REP> d-------- C:\Program Files\MediaCoder
2007-11-13 12:32 <REP> d-------- C:\Program Files\AVOne
2007-11-13 12:32 <REP> d-------- C:\AVOneExport
2007-11-13 12:32 316,640 --a------ C:\WINDOWS\system32\WMSysPr9.prx
2007-11-13 12:32 156,910 --a------ C:\WINDOWS\system32\WMSysPr8.prx
2007-11-13 12:32 83 --a------ C:\WINDOWS\system32\buyurl0501.dat
2007-11-12 13:10 <REP> d-------- C:\Program Files\WinASPI
2007-11-12 13:10 <REP> d-------- C:\Program Files\AviSynth 2.5
2007-11-12 13:09 <REP> d-------- C:\Documents and Settings\NOX\NeoDivX Suite
2007-11-12 13:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-11-12 12:55 <REP> d-------- C:\Documents and Settings\NOX\Application Data\dvdcss
2007-11-12 11:45 <REP> d-------- C:\Documents and Settings\NOX\Application Data\vlc
2007-11-11 11:50 <REP> d-------- C:\Program Files\MKVtoolnix
2007-11-10 19:35 <REP> d-------- C:\Documents and Settings\NOX\Application Data\Ahead
2007-11-10 19:34 <REP> d-------- C:\Program Files\Nero
2007-11-10 19:34 <REP> d-------- C:\Program Files\Fichiers communs\Ahead

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 11:37 35,840 ------w C:\WINDOWS\system32\ddcbbcc.dll
2007-10-26 17:33 --------- d-----w C:\Program Files\PC Inspector File Recovery
2007-10-26 12:54 --------- d-----w C:\Program Files\TimeAdjuster
2007-10-26 09:15 --------- d-----w C:\Program Files\eMule
2007-10-26 09:06 --------- d-----w C:\Documents and Settings\NOX\Application Data\Azureus
2007-10-25 17:45 --------- d-----w C:\Program Files\Azureus
2007-10-25 16:56 8,510,976 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-10 17:13 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-10-10 08:35 --------- d-----w C:\Program Files\DivX
2007-10-06 21:51 --------- d-----w C:\Documents and Settings\NOX\Application Data\AdobeUM
2007-10-06 21:50 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-10-06 11:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\NVIDIA
2007-10-06 11:37 --------- d-----w C:\Documents and Settings\NOX\Application Data\SystemRequirementsLab
2007-10-06 11:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-10-06 11:30 --------- d-----w C:\Program Files\HP
2007-10-06 11:30 --------- d-----w C:\Program Files\Hewlett-Packard
2007-10-06 11:13 --------- d-----w C:\Program Files\MSN Messenger
2007-10-06 10:42 73,728 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-10-06 10:41 --------- d-----w C:\Documents and Settings\NOX\Application Data\Talkback
2007-10-06 10:38 129,078 ----a-w C:\WINDOWS\Logow.sys
2007-10-06 10:38 129,078 ----a-w C:\WINDOWS\Logos.sys
2007-10-06 10:28 --------- d-----w C:\Program Files\Plus!
2007-10-06 10:26 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-10-06 10:26 --------- d-----w C:\Documents and Settings\NOX\Application Data\Media Player Classic
2007-10-06 10:25 --------- d-----w C:\Program Files\VideoLAN
2007-10-06 10:24 --------- d-----w C:\Program Files\Steam
2007-10-06 10:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-06 10:21 --------- d-----w C:\Documents and Settings\NOX\Application Data\Lavasoft
2007-10-06 10:20 --------- d-----w C:\Program Files\Lavasoft
2007-10-06 09:52 6,912 ----a-w C:\WINDOWS\system32\drivers\NTIDrvr.sys
2007-10-06 09:46 --------- d-----w C:\Documents and Settings\NOX\Application Data\Symantec
2007-10-06 09:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-06 09:45 --------- d-----w C:\Program Files\Java
2007-10-06 09:45 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-10-06 09:44 --------- d-----w C:\Program Files\Realtek
2007-10-06 09:44 --------- d-----w C:\Program Files\Intel
2007-10-06 09:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-06 09:43 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-10-06 09:39 --------- d-----w C:\Program Files\microsoft frontpage
2007-10-06 09:37 --------- d-----w C:\Program Files\Services en ligne
2007-10-06 09:37 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-10-06 09:32 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-09-17 01:10 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-09-17 01:10 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe
2007-09-17 00:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-09-17 00:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-09-17 00:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-09-17 00:07 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-09-17 00:07 6,853,088 ----a-w C:\WINDOWS\system32\dllcache\nv4_mini.sys
2007-09-17 00:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-09-17 00:07 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-09-17 00:07 5,783,040 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-09-17 00:07 5,509,120 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-09-17 00:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-09-17 00:07 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-09-17 00:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-09-17 00:07 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-09-17 00:07 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-09-17 00:07 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-09-17 00:07 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-09-17 00:07 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-09-17 00:07 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-09-17 00:07 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-09-17 00:07 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-09-17 00:07 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-09-17 00:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-09-17 00:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-09-17 00:07 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-09-17 00:07 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-09-17 00:07 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-09-17 00:07 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-09-17 00:07 3,629,056 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-09-17 00:07 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-09-17 00:07 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-09-17 00:07 3,166,208 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-09-17 00:07 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-09-17 00:07 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-09-17 00:07 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E794189-7575-4306-8F49-CCDD291A59CD}]
2007-11-13 12:37 35840 --------- C:\WINDOWS\system32\ddcbbcc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e7e3c9c7-ce44-4f72-9168-152cfe1baae0}]
2007-12-01 01:14 78912 --a------ C:\WINDOWS\system32\cndoyimj.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2007-11-30 15:03]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 11:28]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 15:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"MPS"="C:\ACER\PSM.EXE" [2004-03-04 10:53]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 09:06 C:\WINDOWS\AGRSMMSG.exe]
"Alaunch"="C:\Windows\alaunch.exe" [2002-05-24 16:08]
"SoundMan"="SOUNDMAN.EXE" [2004-08-24 11:14 C:\WINDOWS\SoundMan.exe]
"AlcWzrd"="ALCWZRD.EXE" [2004-08-24 11:01 C:\WINDOWS\ALCWZRD.EXE]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-05 05:00 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 17:46]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 19:55]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-05 05:00 C:\WINDOWS\system32\rundll32.exe]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 17:20]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"320d18a1"="C:\WINDOWS\system32\ogirupfa.dll" []
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 02:36]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{1E794189-7575-4306-8F49-CCDD291A59CD}"= C:\WINDOWS\system32\ddcbbcc.dll [2007-11-13 12:37 35840]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcbbcc]
ddcbbcc.dll 2007-11-13 12:37 35840 C:\WINDOWS\system32\ddcbbcc.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkkjh.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setupss.exe

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-30 06:00:02 C:\WINDOWS\Tasks\Death Proof - 16 - Chick Habit.job"
- C:\Documents and Settings\NOX\Bureau\Death Proof - 16 - Chick Habit.mp3
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-01 16:50:13
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-01 16:52:03 - machine was rebooted
.
--- E O F ---

Merci au fait G!rly, c gentil de m'aider.
En fait j'ai oublié de te dire, j'ai un disque dur amovible que j'avais pas allumé, et des scans me disaient que des merdes y étaient! Que fais je je le connecte et je refais vundo et combofix?
Aussi au demarrage j'ai un message d'erreur de chargement de c:\windows\system32\ogirupfa.dll
Voila c tout! ^^

Copie le texte se situant ci-dessous :

File::
C:\WINDOWS\system32\ddcbbcc.dll
C:\WINDOWS\system32\cndoyimj.dll
C:\WINDOWS\system32\ogirupfa.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\afpurigo.ini

Folder::
C:\VundoFix Backups

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E794189-7575-4306-8F49-CCDD291A59CD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"320d18a1"=-
[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{1E794189-7575-4306-8F49-CCDD291A59CD}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcbbcc]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix,

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt (combofix.txt2) accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

ComboFix 07-11-19.4C - NOX 2007-12-01 17:19:53.2 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1541 [GMT 1:00]
Running from: C:\Documents and Settings\NOX\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\NOX\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\afpurigo.ini
C:\WINDOWS\system32\cndoyimj.dll
C:\WINDOWS\system32\ddcbbcc.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\ogirupfa.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\zrkwbnfv.dllbox.bad
C:\WINDOWS\system32\afpurigo.ini
C:\WINDOWS\system32\awtqo.dll
C:\WINDOWS\system32\cndoyimj.dll
C:\WINDOWS\system32\ddcbbcc.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\oqtwa.ini
C:\WINDOWS\system32\oqtwa.ini2

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-01 to 2007-12-01 ))))))))))))))))))))))))))))))))))))
.

2007-11-30 00:29 <REP> d-------- C:\Documents and Settings\All Users\SonicStage
2007-11-28 19:51 <REP> d-------- C:\Program Files\a-squared Free
2007-11-28 19:39 <REP> d-------- C:\Program Files\Panda Security
2007-11-28 18:08 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-11-28 13:22 <REP> d-------- C:\Program Files\CCleaner
2007-11-28 13:04 <REP> d-------- C:\WINDOWS\ERUNT
2007-11-27 18:59 <REP> d-------- C:\Program Files\Sony Corporation
2007-11-27 18:59 27,255 --------- C:\WINDOWS\system32\drivers\NWWMUSB.sys
2007-11-27 18:59 11,510 --------- C:\WINDOWS\system32\drivers\VMCUSB.sys
2007-11-27 18:58 90,112 --------- C:\WINDOWS\snymsico.dll
2007-11-27 18:58 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
2007-11-27 18:58 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
2007-11-27 18:58 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
2007-11-27 18:58 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
2007-11-27 18:58 20,640 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-11-27 18:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2007-11-27 18:52 <REP> d-------- C:\Program Files\Sony
2007-11-27 18:50 <REP> d-------- C:\Program Files\Fichiers communs\Sony Shared
2007-11-27 18:50 <REP> d-------- C:\Documents and Settings\NOX\Application Data\Sony Corporation
2007-11-27 09:43 <REP> d-------- C:\Documents and Settings\NOX\Application Data\Grisoft
2007-11-27 09:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-27 09:43 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-27 09:36 <REP> d-------- C:\hijackthis
2007-11-25 02:32 <REP> d-------- C:\Program Files\Alwil Software
2007-11-25 02:32 815,480 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-25 02:32 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-11-25 02:32 95,608 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-11-25 02:32 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-25 02:32 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-25 02:32 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-25 02:32 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-25 02:32 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-24 01:56 340,064 --a------ C:\WINDOWS\system32\ddabb.VIR000
2007-11-23 15:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Motive
2007-11-13 17:54 <REP> d-------- C:\WINDOWS\Motive
2007-11-13 17:54 <REP> d-------- C:\Program Files\Club-Internet
2007-11-13 17:53 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-11-13 17:53 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2007-11-13 17:53 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-11-13 12:43 <REP> d-------- C:\Program Files\MediaCoder
2007-11-13 12:32 <REP> d-------- C:\Program Files\AVOne
2007-11-13 12:32 <REP> d-------- C:\AVOneExport
2007-11-13 12:32 316,640 --a------ C:\WINDOWS\system32\WMSysPr9.prx
2007-11-13 12:32 156,910 --a------ C:\WINDOWS\system32\WMSysPr8.prx
2007-11-13 12:32 83 --a------ C:\WINDOWS\system32\buyurl0501.dat
2007-11-12 13:10 <REP> d-------- C:\Program Files\WinASPI
2007-11-12 13:10 <REP> d-------- C:\Program Files\AviSynth 2.5
2007-11-12 13:09 <REP> d-------- C:\Documents and Settings\NOX\NeoDivX Suite
2007-11-12 13:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-11-12 12:55 <REP> d-------- C:\Documents and Settings\NOX\Application Data\dvdcss
2007-11-12 11:45 <REP> d-------- C:\Documents and Settings\NOX\Application Data\vlc
2007-11-11 11:50 <REP> d-------- C:\Program Files\MKVtoolnix
2007-11-10 19:35 <REP> d-------- C:\Documents and Settings\NOX\Application Data\Ahead
2007-11-10 19:34 <REP> d-------- C:\Program Files\Nero
2007-11-10 19:34 <REP> d-------- C:\Program Files\Fichiers communs\Ahead

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-26 17:33 --------- d-----w C:\Program Files\PC Inspector File Recovery
2007-10-26 12:54 --------- d-----w C:\Program Files\TimeAdjuster
2007-10-26 09:15 --------- d-----w C:\Program Files\eMule
2007-10-26 09:06 --------- d-----w C:\Documents and Settings\NOX\Application Data\Azureus
2007-10-25 17:45 --------- d-----w C:\Program Files\Azureus
2007-10-25 16:56 8,510,976 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-10 17:13 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-10-10 08:35 --------- d-----w C:\Program Files\DivX
2007-10-06 21:51 --------- d-----w C:\Documents and Settings\NOX\Application Data\AdobeUM
2007-10-06 21:50 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-10-06 11:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\NVIDIA
2007-10-06 11:37 --------- d-----w C:\Documents and Settings\NOX\Application Data\SystemRequirementsLab
2007-10-06 11:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-10-06 11:30 --------- d-----w C:\Program Files\HP
2007-10-06 11:30 --------- d-----w C:\Program Files\Hewlett-Packard
2007-10-06 11:13 --------- d-----w C:\Program Files\MSN Messenger
2007-10-06 10:42 73,728 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-10-06 10:41 --------- d-----w C:\Documents and Settings\NOX\Application Data\Talkback
2007-10-06 10:38 129,078 ----a-w C:\WINDOWS\Logow.sys
2007-10-06 10:38 129,078 ----a-w C:\WINDOWS\Logos.sys
2007-10-06 10:28 --------- d-----w C:\Program Files\Plus!
2007-10-06 10:26 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-10-06 10:26 --------- d-----w C:\Documents and Settings\NOX\Application Data\Media Player Classic
2007-10-06 10:25 --------- d-----w C:\Program Files\VideoLAN
2007-10-06 10:24 --------- d-----w C:\Program Files\Steam
2007-10-06 10:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-06 10:21 --------- d-----w C:\Documents and Settings\NOX\Application Data\Lavasoft
2007-10-06 10:20 --------- d-----w C:\Program Files\Lavasoft
2007-10-06 09:52 6,912 ----a-w C:\WINDOWS\system32\drivers\NTIDrvr.sys
2007-10-06 09:46 --------- d-----w C:\Documents and Settings\NOX\Application Data\Symantec
2007-10-06 09:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-06 09:45 --------- d-----w C:\Program Files\Java
2007-10-06 09:45 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-10-06 09:44 --------- d-----w C:\Program Files\Realtek
2007-10-06 09:44 --------- d-----w C:\Program Files\Intel
2007-10-06 09:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-06 09:43 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-10-06 09:39 --------- d-----w C:\Program Files\microsoft frontpage
2007-10-06 09:37 --------- d-----w C:\Program Files\Services en ligne
2007-10-06 09:37 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-10-06 09:32 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-09-17 01:10 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-09-17 01:10 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe
2007-09-17 00:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-09-17 00:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-09-17 00:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-09-17 00:07 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-09-17 00:07 6,853,088 ----a-w C:\WINDOWS\system32\dllcache\nv4_mini.sys
2007-09-17 00:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-09-17 00:07 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-09-17 00:07 5,783,040 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-09-17 00:07 5,509,120 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-09-17 00:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-09-17 00:07 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-09-17 00:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-09-17 00:07 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-09-17 00:07 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-09-17 00:07 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-09-17 00:07 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-09-17 00:07 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-09-17 00:07 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-09-17 00:07 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-09-17 00:07 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-09-17 00:07 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-09-17 00:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-09-17 00:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-09-17 00:07 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-09-17 00:07 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-09-17 00:07 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-09-17 00:07 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-09-17 00:07 3,629,056 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-09-17 00:07 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-09-17 00:07 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-09-17 00:07 3,166,208 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-09-17 00:07 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-09-17 00:07 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-09-17 00:07 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-01_16.50.51.87 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
+ 2007-12-01 16:25:30 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_4b8.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2007-11-30 15:03]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 11:28]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 15:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"MPS"="C:\ACER\PSM.EXE" [2004-03-04 10:53]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 09:06 C:\WINDOWS\AGRSMMSG.exe]
"Alaunch"="C:\Windows\alaunch.exe" [2002-05-24 16:08]
"SoundMan"="SOUNDMAN.EXE" [2004-08-24 11:14 C:\WINDOWS\SoundMan.exe]
"AlcWzrd"="ALCWZRD.EXE" [2004-08-24 11:01 C:\WINDOWS\ALCWZRD.EXE]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-05 05:00 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 17:46]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 19:55]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-05 05:00 C:\WINDOWS\system32\rundll32.exe]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 17:20]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 02:36]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setupss.exe

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-30 06:00:02 C:\WINDOWS\Tasks\Death Proof - 16 - Chick Habit.job"
- C:\Documents and Settings\NOX\Bureau\Death Proof - 16 - Chick Habit.mp3
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-01 17:26:01
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-01 17:26:35 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-01 16:52
.
--- E O F ---

Et Hijack

Logfile of HijackThis v1.99.1
Scan saved at 17:28:23, on 01/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\ACER\PSM.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\program files\steam\steam.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\NOX\Bureau\hijackthis\ccm.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer.com/worldwide/selection.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (disabled by BHODemon)
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [MPS] C:\ACER\PSM.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Alaunch] C:\Windows\alaunch.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.acer.com/worldwide/selection.html
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

En fait que se passe t il peux tu m'expliquer car je ne sais goutte de ce qu'il s'est passé ^^
Et pour le disque amovible??

re,

en faite pour le moment on a supprimé les infections vundo/virtumundo

j´ai bien vu dans combofix que quelque chose n´estais pas claire avec ton disque amovible il affiche ceci :

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setupss.exe

on va passer ceci pour voir

- Avec E branché

ouvre le bloc note et copie colle les commandes en gras :

@echo on
taskkill /im explorer.exe /f
taskkill /im wscript.exe
start reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\EXplorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 1 /f
start reg import kill.reg
del c:\autorun.* /f /q /as
del %SYSTEMROOT%\system32\autorun.* /f /q /as
del d:\autorun.* /f /q /as
del e:\autorun.* /f /q /as
del f:\autorun.* /f /q /as
del g:\autorun.* /f /q /as
del h:\autorun.* /f /q /as
del i:\autorun.* /f /q /as
del j:\autorun.* /f /q /as
del k:\autorun.* /f /q /as
del l:\autorun.* /f /q /as
start explorer.exe

ferme le bloc et enregistre le sur le bureau sous le nom de kill_autorun_vbs.bat

va sur le bureau et double clik sur kill_autorun_vbs.bat et laisse le faire son boulot

puis :

Débranche ensuite le disque externe e , et télécharge l'outil Flash_Disinfector de sUBs:
http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe

Utilisation :
Téléchargez et enregistrez Flash_Disinfector.exe sur votre bureau.
Double cliquez sur Flash_Disinfector.exe pour le lancer.
Quand le message : "Plug in yours flash drive & clic Ok to begin disinfection" apparaitra :
Connectez votre clé USB et périphériques USB externes susceptibles d'avoir été infectés. (E)
Puis cliquez sur Ok
Les icônes sur le bureau vont disparaitre jusqu'à l'apparition du message: "Done!!"
Appuyez sur "Ok", pour faire réapparaitre le bureau.

repost un combofix apres la manip

ComboFix 07-11-19.4C - NOX 2007-12-01 18:30:18.3 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1540 [GMT 1:00]
Running from: C:\Documents and Settings\NOX\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-01 to 2007-12-01 ))))))))))))))))))))))))))))))))))))
.

2007-11-30 00:29 <REP> d-------- C:\Documents and Settings\All Users\SonicStage
2007-11-28 19:51 <REP> d-------- C:\Program Files\a-squared Free
2007-11-28 19:39 <REP> d-------- C:\Program Files\Panda Security
2007-11-28 18:08 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-11-28 13:22 <REP> d-------- C:\Program Files\CCleaner
2007-11-28 13:04 <REP> d-------- C:\WINDOWS\ERUNT
2007-11-27 18:59 <REP> d-------- C:\Program Files\Sony Corporation
2007-11-27 18:59 27,255 --------- C:\WINDOWS\system32\drivers\NWWMUSB.sys
2007-11-27 18:59 11,510 --------- C:\WINDOWS\system32\drivers\VMCUSB.sys
2007-11-27 18:58 90,112 --------- C:\WINDOWS\snymsico.dll
2007-11-27 18:58 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
2007-11-27 18:58 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
2007-11-27 18:58 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
2007-11-27 18:58 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
2007-11-27 18:58 20,640 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-11-27 18:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2007-11-27 18:52 <REP> d-------- C:\Program Files\Sony
2007-11-27 18:50 <REP> d-------- C:\Program Files\Fichiers communs\Sony Shared
2007-11-27 18:50 <REP> d-------- C:\Documents and Settings\NOX\Application Data\Sony Corporation
2007-11-27 09:43 <REP> d-------- C:\Documents and Settings\NOX\Application Data\Grisoft
2007-11-27 09:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-27 09:43 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-27 09:36 <REP> d-------- C:\hijackthis
2007-11-25 02:32 <REP> d-------- C:\Program Files\Alwil Software
2007-11-25 02:32 815,480 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-25 02:32 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-11-25 02:32 95,608 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-11-25 02:32 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-25 02:32 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-25 02:32 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-25 02:32 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-25 02:32 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-24 01:56 340,064 --a------ C:\WINDOWS\system32\ddabb.VIR000
2007-11-23 15:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Motive
2007-11-13 17:54 <REP> d-------- C:\WINDOWS\Motive
2007-11-13 17:54 <REP> d-------- C:\Program Files\Club-Internet
2007-11-13 17:53 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-11-13 17:53 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2007-11-13 17:53 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-11-13 12:43 <REP> d-------- C:\Program Files\MediaCoder
2007-11-13 12:32 <REP> d-------- C:\Program Files\AVOne
2007-11-13 12:32 <REP> d-------- C:\AVOneExport
2007-11-13 12:32 316,640 --a------ C:\WINDOWS\system32\WMSysPr9.prx
2007-11-13 12:32 156,910 --a------ C:\WINDOWS\system32\WMSysPr8.prx
2007-11-13 12:32 83 --a------ C:\WINDOWS\system32\buyurl0501.dat
2007-11-12 13:10 <REP> d-------- C:\Program Files\WinASPI
2007-11-12 13:10 <REP> d-------- C:\Program Files\AviSynth 2.5
2007-11-12 13:09 <REP> d-------- C:\Documents and Settings\NOX\NeoDivX Suite
2007-11-12 13:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-11-12 12:55 <REP> d-------- C:\Documents and Settings\NOX\Application Data\dvdcss
2007-11-12 11:45 <REP> d-------- C:\Documents and Settings\NOX\Application Data\vlc
2007-11-11 11:50 <REP> d-------- C:\Program Files\MKVtoolnix
2007-11-10 19:35 <REP> d-------- C:\Documents and Settings\NOX\Application Data\Ahead
2007-11-10 19:34 <REP> d-------- C:\Program Files\Nero
2007-11-10 19:34 <REP> d-------- C:\Program Files\Fichiers communs\Ahead

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-26 17:33 --------- d-----w C:\Program Files\PC Inspector File Recovery
2007-10-26 12:54 --------- d-----w C:\Program Files\TimeAdjuster
2007-10-26 09:15 --------- d-----w C:\Program Files\eMule
2007-10-26 09:06 --------- d-----w C:\Documents and Settings\NOX\Application Data\Azureus
2007-10-25 17:45 --------- d-----w C:\Program Files\Azureus
2007-10-25 16:56 8,510,976 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-10 17:13 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-10-10 08:35 --------- d-----w C:\Program Files\DivX
2007-10-06 21:51 --------- d-----w C:\Documents and Settings\NOX\Application Data\AdobeUM
2007-10-06 21:50 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-10-06 11:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\NVIDIA
2007-10-06 11:37 --------- d-----w C:\Documents and Settings\NOX\Application Data\SystemRequirementsLab
2007-10-06 11:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-10-06 11:30 --------- d-----w C:\Program Files\HP
2007-10-06 11:30 --------- d-----w C:\Program Files\Hewlett-Packard
2007-10-06 11:13 --------- d-----w C:\Program Files\MSN Messenger
2007-10-06 10:42 73,728 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-10-06 10:41 --------- d-----w C:\Documents and Settings\NOX\Application Data\Talkback
2007-10-06 10:38 129,078 ----a-w C:\WINDOWS\Logow.sys
2007-10-06 10:38 129,078 ----a-w C:\WINDOWS\Logos.sys
2007-10-06 10:28 --------- d-----w C:\Program Files\Plus!
2007-10-06 10:26 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-10-06 10:26 --------- d-----w C:\Documents and Settings\NOX\Application Data\Media Player Classic
2007-10-06 10:25 --------- d-----w C:\Program Files\VideoLAN
2007-10-06 10:24 --------- d-----w C:\Program Files\Steam
2007-10-06 10:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-06 10:21 --------- d-----w C:\Documents and Settings\NOX\Application Data\Lavasoft
2007-10-06 10:20 --------- d-----w C:\Program Files\Lavasoft
2007-10-06 09:52 6,912 ----a-w C:\WINDOWS\system32\drivers\NTIDrvr.sys
2007-10-06 09:46 --------- d-----w C:\Documents and Settings\NOX\Application Data\Symantec
2007-10-06 09:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-06 09:45 --------- d-----w C:\Program Files\Java
2007-10-06 09:45 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-10-06 09:44 --------- d-----w C:\Program Files\Realtek
2007-10-06 09:44 --------- d-----w C:\Program Files\Intel
2007-10-06 09:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-06 09:43 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-10-06 09:39 --------- d-----w C:\Program Files\microsoft frontpage
2007-10-06 09:37 --------- d-----w C:\Program Files\Services en ligne
2007-10-06 09:37 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-10-06 09:32 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-09-17 01:10 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-09-17 01:10 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe
2007-09-17 00:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-09-17 00:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-09-17 00:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-09-17 00:07 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-09-17 00:07 6,853,088 ----a-w C:\WINDOWS\system32\dllcache\nv4_mini.sys
2007-09-17 00:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-09-17 00:07 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-09-17 00:07 5,783,040 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-09-17 00:07 5,509,120 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-09-17 00:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-09-17 00:07 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-09-17 00:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-09-17 00:07 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-09-17 00:07 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-09-17 00:07 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-09-17 00:07 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-09-17 00:07 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-09-17 00:07 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-09-17 00:07 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-09-17 00:07 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-09-17 00:07 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-09-17 00:07 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-09-17 00:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-09-17 00:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-09-17 00:07 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-09-17 00:07 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-09-17 00:07 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-09-17 00:07 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-09-17 00:07 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-09-17 00:07 3,629,056 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-09-17 00:07 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-09-17 00:07 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-09-17 00:07 3,166,208 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-09-17 00:07 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-09-17 00:07 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-09-17 00:07 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-09-17 00:07 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-09-17 00:07 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-09-17 00:07 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-09-17 00:07 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-01_16.50.51.87 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
+ 2007-12-01 16:25:30 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_4b8.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2007-11-30 15:03]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 11:28]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 15:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"MPS"="C:\ACER\PSM.EXE" [2004-03-04 10:53]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 09:06 C:\WINDOWS\AGRSMMSG.exe]
"Alaunch"="C:\Windows\alaunch.exe" [2002-05-24 16:08]
"SoundMan"="SOUNDMAN.EXE" [2004-08-24 11:14 C:\WINDOWS\SoundMan.exe]
"AlcWzrd"="ALCWZRD.EXE" [2004-08-24 11:01 C:\WINDOWS\ALCWZRD.EXE]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-05 05:00 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 17:46]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 19:55]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-05 05:00 C:\WINDOWS\system32\rundll32.exe]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 17:20]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 02:36]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setupss.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-30 06:00:02 C:\WINDOWS\Tasks\Death Proof - 16 - Chick Habit.job"
- C:\Documents and Settings\NOX\Bureau\Death Proof - 16 - Chick Habit.mp3
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-01 18:31:19
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-01 18:31:45
C:\ComboFix3.txt ... 2007-12-01 16:52
C:\ComboFix2.txt ... 2007-12-01 17:26
.
--- E O F ---

Xcuse moi au fait j'étais parti!

tu as bien fais ce que je t´ai dis?

fais ceci :

ouvre un fichier texte et copie/colle le texte ci dessous dedans:

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
@ echo off

if exist \nicoamano.TXT del \nicoamano.TXT
FOR %%A in (C D E F G H I J K L M N O P Q R S T U V W X Y Z) DO IF EXIST %%A: (
IF EXIST %%A:\autorun.inf ECHO %%A:\autorun.inf Présent>>\nicoamano.TXT
IF NOT EXIST %%A:\autorun.inf ECHO %%A:\autorun.inf Non trouvé>>\nicoamano.TXT
IF EXIST %%A:\MS32DLL.dll.vbs ECHO %%A:\MS32DLL.dll.vbs Présent>>\nicoamano.TXT
IF NOT EXIST %%A:\MS32DLL.dll.vbs ECHO %%A:\MS32DLL.dll.vbs Non trouvé>>\nicoamano.TXT
)
IF EXIST %WINDIR%\MS32DLL.dll.vbs (
ECHO %WINDIR%\MS32DLL.dll.vbs Présent>>\nicoamano.TXT) else (
ECHO %WINDIR%\MS32DLL.dll.vbs non trouvé >>\nicoamano.TXT)
REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" >>\nicoamano.TXT
REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" >>\nicoamano.TXT
notepad \nicoamano.TXT
exit

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

enrregistre ce fichier sur le bureau en tant que nicoamano.bat

double click sur le fichier : nicoamano.bat

poste le resulat ici stp

En fait quan j'ai lancé le premier processus du blocnote y arien eu, un fenetre de mes doc s'est ouvert ou est une icone d'inscription dans le registre dont je sais pas sa provenance!!!
Nommée "cc_20071128_1727"
Avec l'autre processus "nicoamano" Bon deja quand je le lance ca me fait Exception Processing message c0000013 Parameters 75afbf9c 4 75afbf9c 75afbf9c
Je peux cliquer annuler recommencer et continuer
Je clique continuer
et la

C:\autorun.inf Présent
C:\MS32DLL.dll.vbs Non trouvé
F:\autorun.inf Présent
F:\MS32DLL.dll.vbs Non trouvé
J:\autorun.inf Présent
J:\MS32DLL.dll.vbs Non trouvé
C:\WINDOWS\MS32DLL.dll.vbs non trouvé

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Raccourci vers la page des propriétés de High Definition Audio REG_SZ HDAudPropShortcut.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
MPS REG_SZ C:\ACER\PSM.EXE
AGRSMMSG REG_SZ AGRSMMSG.exe
Alaunch REG_SZ C:\Windows\alaunch.exe
SoundMan REG_SZ SOUNDMAN.EXE
AlcWzrd REG_SZ ALCWZRD.EXE
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /install
HPDJ Taskbar Utility REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
HP Component Manager REG_SZ "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
HP Software Update REG_SZ "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
!AVG Anti-Spyware REG_SZ "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
SsAAD.exe REG_SZ C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Steam REG_SZ "c:\program files\steam\steam.exe" -silent
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe

Rend visible les fichiers cachés et systeme
panneau de configuration > options des dossiers > onglet affichage
Cocher la case devant " afficher les fichiers et dossiers cachés "
Décocher la case devant " masquer les extentions des fichiers dont le type est connu"
Décocher la case devant " masquer les fichiers protégés du système"
clic sur [Appliquer] puis sur [ok] pour valider

* Supprime

C:\autorun.inf
F:\autorun.inf
J:\autorun.inf

En cas de problèmes de suppression, vérifier que les fichiers ne soient pas en lecture seule:
Clic droit sur le fichier -> Propriétés et décocher la case "Lecture seule"
Et réessayer de supprimer le fichier.

Ensuite, connecte chaque périphériques externes susceptibles d'avoir été infectés puis ouvre le Poste de travail.
Fais un clic droit >> Explorer sur chaques icônes correspondant à :
Clé USB
Disque dur externe.
Partitions
Etc...
/!\ Ne double clique surtout pas sur les icônes pour les ouvrir, sous peine de relancer l'infection.

Puis supprime les fichiers autorun.inf s'ils sont présents.

* Vide la corbeille.
* Recache les fichiers cachés et système.
* Redémarre le pc.

Après redemarrage du pc, vérifie que tu peux acceder normalement à ton disque en double cliquant sur son icône

Bon courage.

beh j'arrive même pas a les supprimer, ça me marque
"Impossible de supprimer Ipt3. this folder was created by flash_inspector le fichier spéifié est introuvable...
Que faire donc, même en desactivant la lecture seule ou ca me marque pareil.
Meme le destructeur de Avg veux pas me le supprimer!

tu peux essayer en mode sans echec