Your computer is infected

malou -  
Bonjour,
j'ai un virus ds mon pc ( your computer is infected)
j'ai fait la procedure smitfraudfix
mais le pb persiste
voici le rapport
SmitFraudFix v2.347

Rapport fait à 17:17:11.75, 09-09-2008
Executé à partir de C:\Documents and Settings\user\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\windows\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\WinCtrl32.dll détecté, utilisez un scanner de Rootkit

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\user\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="c:\\windows\\system32\\userinit.exe"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

salutations
Configuration: Windows XP
Internet Explorer 6.0

10 réponses

  1.  ludsfa
    salut malou,

    Sélectionne l'intégralité du texte en gras ci-dessous.


    file::
    C:\FOUND.000
    C:\FOUND.001
    C:\FOUND.002
    C:\WINDOWS\gmer.ini
    C:\WINDOWS\system32\BlockedCookies
    C:\WINDOWS\system32\10004.sks
    C:\WINDOWS\system32\10001.sks
    C:\WINDOWS\system32\10002.sks

    folder::
    C:\Documents and Settings\user\S87ekhV.exe
    C:\Documents and Settings\All Users\Application Data\kfulyrgv
    C:\Program Files\SpyRemover Pro C:\WINDOWS\system32\10003.sks
    C:\Documents and Settings\user\Application Data\Simply Super Software
    C:\Program Files\Trojan Remover

    registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
    "LTXA09sMbw"=-
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winag27.sys]
    @=-
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj38.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj84.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windl84.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk16.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl16.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl40.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingm05.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winio30.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq27.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq84.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms05.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms38.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms40.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winnt62.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winov05.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvc62.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwd30.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxe63.sys]
    @=-

    * Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
    * Enregistre le sous sur ton bureau sous le nom de CFScript.txt
    * Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :

    http://i266.photobucket.com/albums/ii277/sUBs_/CFScript.gif

    * Cela va relancer Combofix.

    Un rapport va être créer envois le moi.
    1
    1. malou
      une precision
      j'obtiens ce rapport en cochant toutes les cases
      mais on laissant les cases (services et files) j'obtient rien par le scan
      0
      1. malou
        j'ai pas compris comment fonnctionne combofix
        0
        1. malou
          ComboFix 08-09-12.09 - user 2008-09-13 16:23:10.1 - [color=red][b]FAT32[/b][/color]x86
          Microsoft Windows XP Professionnel 5.1.2600.2.1256.213.1036.18.75 [GMT 2:00]
          Lancé depuis: C:\Documents and Settings\user\Bureau\ComboFix.exe
          * Un nouveau point de restauration a été créé

          [color=red][b]AVERTISSEMENT - LA CONSOLE DE RةCUPةRATION N'EST PAS INSTALLةE SUR CETTE MACHINE !![/b][/color]
          .

          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
          .

          C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
          C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
          C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
          C:\WINDOWS\system32\~.exe
          C:\WINDOWS\system32\braviax.exe
          C:\WINDOWS\system32\DelSelf.bat
          C:\WINDOWS\system32\drivers\atmapi.sys
          C:\WINDOWS\system32\drivers\npf.sys
          C:\WINDOWS\system32\packet.dll
          C:\WINDOWS\system32\pla.ax
          C:\WINDOWS\system32\pthreadVC.dll
          C:\WINDOWS\system32\shell31.dll
          C:\WINDOWS\system32\wanpacket.dll
          C:\WINDOWS\system32\WinCtrl32.dl_
          C:\WINDOWS\system32\WinCtrl32.dll
          C:\WINDOWS\system32\winivstr.exe
          C:\WINDOWS\system32\wpcap.dll
          C:\WINDOWS\system32\wpx63.cpx
          C:\WINDOWS\wiaservb.log
          F:\CNAS TARIF.pif

          ----- BITS: Il y a peut-ˆtre des sites infect‚s -----

          http://ygsondheks.info
          .
          ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
          .

          -------\Legacy_NPF
          -------\Service_NPF
          -------\Service_poof

          ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-13 au 2008-09-13 ))))))))))))))))))))))))))))))))))))
          .

          2008-09-13 13:24 . 2008-09-13 13:24 <REP> d--hs---- C:\FOUND.002
          2008-09-13 13:05 . 2008-09-13 13:05 <REP> d--hs---- C:\FOUND.001
          2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\user\Application Data\Grisoft
          2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
          2008-09-11 17:35 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
          2008-09-11 16:41 . 2008-09-11 16:41 <REP> d-------- C:\Program Files\Trend Micro
          2008-09-10 18:06 . 2008-09-11 16:50 250 --a------ C:\WINDOWS\gmer.ini
          2008-09-09 17:16 . 2008-09-09 17:16 73,728 --a------ C:\WINDOWS\system32\drivers\796.exe
          2008-09-09 16:46 . 2008-09-09 16:46 73,728 --a------ C:\WINDOWS\system32\drivers\203.exe
          2008-09-09 15:59 . 2008-09-09 17:17 2,640 --a------ C:\WINDOWS\system32\tmp.reg
          2008-09-09 14:48 . 2008-09-09 14:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\xqzaryhe
          2008-09-09 13:57 . 2008-09-09 13:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
          2008-09-09 13:57 . 2008-09-09 14:00 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
          2008-09-09 13:56 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
          2008-09-09 13:56 . 2008-07-09 09:05 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
          2008-09-09 13:56 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
          2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
          2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\Program Files\Zone Labs
          2008-09-09 13:54 . 2008-09-09 13:54 <REP> d-------- C:\WINDOWS\Internet Logs
          2008-09-09 12:21 . 2008-09-09 12:21 73,728 --a------ C:\WINDOWS\system32\drivers\968.exe
          2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Program Files\Trojan Remover
          2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Documents and Settings\user\Application Data\Simply Super Software
          2008-09-08 14:42 . 2008-09-08 14:42 <REP> d-------- C:\Program Files\a-squared Free
          2008-09-08 14:08 . 2008-09-08 14:08 130 --a------ C:\Documents and Settings\user\delself.bat
          2008-09-08 13:53 . 2008-09-08 13:53 249,856 --a------ C:\WINDOWS\system32\nvrsol32.dll.vir
          2008-09-08 13:15 . 2008-09-08 13:15 2,840,059 --a------ C:\WINDOWS\system32\SRPSig.zip
          2008-09-08 13:15 . 2008-09-08 13:15 870,601 --a------ C:\WINDOWS\system32\SRPExe.zip
          2008-09-08 13:12 . 2008-09-08 13:12 421 --a------ C:\WINDOWS\system32\10002.sks
          2008-09-08 13:12 . 2008-09-08 13:12 97 --a------ C:\WINDOWS\system32\10001.sks
          2008-09-08 13:12 . 2008-09-08 13:15 72 --a------ C:\WINDOWS\system32\SRPVer.ini
          2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10004.sks
          2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10003.sks
          2008-09-08 13:11 . 2008-09-08 13:17 2,380 --a------ C:\WINDOWS\system32\BlockedCookies
          2008-09-08 13:10 . 2008-09-08 13:10 <REP> d-------- C:\Program Files\SpyRemover Pro
          2008-09-08 12:26 . 2008-09-08 12:27 313,474 --a------ C:\WINDOWS\system32\winivstr.exe.vir
          2008-09-08 12:25 . 2008-09-08 12:25 <REP> d--hs---- C:\FOUND.000
          2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\srv
          2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\{e0e899ab-f487-11d5-8d29-0050ba6940e3}
          2008-09-07 16:26 . 2008-09-07 16:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\kfulyrgv
          2008-09-07 16:26 . 2008-09-07 16:26 98,816 --a------ C:\WINDOWS\system32\r4h.e33
          2008-09-07 16:26 . 2008-09-07 16:26 64,000 --a------ C:\WINDOWS\system32\fds.i386
          2008-09-07 16:26 . 2008-09-07 16:26 42,496 --a------ C:\WINDOWS\system32\drivers\656.exe
          2008-09-07 16:26 . 2008-09-07 16:26 29,184 --a------ C:\WINDOWS\iexplorer.exe.vir
          2008-09-07 16:26 . 2008-09-07 16:26 21,504 --a------ C:\WINDOWS\system32\sof.586
          2008-09-07 16:26 . 2008-09-07 16:28 32 --a-s---- C:\WINDOWS\system32\2633133696.dat
          2008-09-07 16:25 . 2008-09-07 16:25 55,063 --a------ C:\Documents and Settings\user\S87ekhV.exe
          2008-08-31 13:54 . 2008-08-31 13:54 <REP> d-------- C:\Program Files\Fichiers communs\Adobe

          .
          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\user32.DLL
          2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
          2008-08-25 17:13 26 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
          2008-06-21 12:10 8,813,777 ----a-w C:\WINDOWS\system32\SRPRSig.dll
          2008-06-21 12:09 6,538,067 ----a-w C:\WINDOWS\system32\SRPFSig.dll
          2008-06-21 12:08 623,157 ----a-w C:\WINDOWS\system32\SRPESig.dll
          2004-09-03 08:32 3,488 ----a-w C:\WINDOWS\inf\OTHER\CMIAINFO.SYS
          2007-01-01 13:28 220 --sha-w C:\WINDOWS\dwin.sys
          .
          [color=red] C:\WINDOWS\system32\user32.dll ... is infected !! (additional data below) [/color]
          578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\user32.DLL
          578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\dllcache\user32.dll

          ------- Sigcheck -------

          2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\user32.DLL
          2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\dllcache\user32.dll

          2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\drivers\tcpip.sys
          2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\dllcache\tcpip.sys
          .
          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
          REGEDIT4

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
          "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-07-16 4670704]
          "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
          "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
          "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-02-24 185896]
          "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
          "vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2007-09-13 77824]
          "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
          "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
          "LTXA09sMbw"="C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe" [2008-09-09 73728]

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winag27.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj38.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj84.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windl84.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk16.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl16.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl40.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingm05.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winio30.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq27.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq84.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms05.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms38.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms40.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winnt62.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winov05.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvc62.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwd30.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxe63.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\software\microsoft\security center]
          "UpdatesDisableNotify"=dword:00000001
          "AntiVirusDisableNotify"=dword:00000001

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
          "EnableFirewall"= 0 (0x0)

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
          "%windir%\\system32\\sessmgr.exe"=
          "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
          "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
          "F:\\eMule\\emule.exe"=
          "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
          "C:\\Program Files\\MSN Messenger\\livecall.exe"=
          "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

          R3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-12-01 117785]
          S0 Winag27;Winag27;C:\WINDOWS\system32\Drivers\Winag27.sys [ ]
          S0 Windj38;Windj38;C:\WINDOWS\system32\Drivers\Windj38.sys [ ]
          S0 Windj84;Windj84;C:\WINDOWS\system32\Drivers\Windj84.sys [ ]
          S0 Windl84;Windl84;C:\WINDOWS\system32\Drivers\Windl84.sys [ ]
          S0 Winfk16;Winfk16;C:\WINDOWS\system32\Drivers\Winfk16.sys [ ]
          S0 Winfl16;Winfl16;C:\WINDOWS\system32\Drivers\Winfl16.sys [ ]
          S0 Winfl40;Winfl40;C:\WINDOWS\system32\Drivers\Winfl40.sys [ ]
          S0 Wingm05;Wingm05;C:\WINDOWS\system32\Drivers\Wingm05.sys [ ]
          S0 Winio30;Winio30;C:\WINDOWS\system32\Drivers\Winio30.sys [ ]
          S0 Winkq27;Winkq27;C:\WINDOWS\system32\Drivers\Winkq27.sys [ ]
          S0 Winkq84;Winkq84;C:\WINDOWS\system32\Drivers\Winkq84.sys [ ]
          S0 Winms05;Winms05;C:\WINDOWS\system32\Drivers\Winms05.sys [ ]
          S0 Winms38;Winms38;C:\WINDOWS\system32\Drivers\Winms38.sys [ ]
          S0 Winms40;Winms40;C:\WINDOWS\system32\Drivers\Winms40.sys [ ]
          S0 Winnt62;Winnt62;C:\WINDOWS\system32\Drivers\Winnt62.sys [ ]
          S0 Winov05;Winov05;C:\WINDOWS\system32\Drivers\Winov05.sys [ ]
          S0 Winvc62;Winvc62;C:\WINDOWS\system32\Drivers\Winvc62.sys [ ]
          S0 Winwd30;Winwd30;C:\WINDOWS\system32\Drivers\Winwd30.sys [ ]
          S0 Winxe63;Winxe63;C:\WINDOWS\system32\Drivers\Winxe63.sys [ ]
          S2 E2ECAP;e2eCap - WDM Video Capture;C:\WINDOWS\system32\DRIVERS\e2ecap.sys [2006-07-10 124416]

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57e52f3c-f9b1-11dc-ac10-007304430c3e}]
          \Shell\AutoRun\command - H:\juok3st.bat
          \Shell\explore\Command - H:\juok3st.bat
          \Shell\open\Command - H:\juok3st.bat

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8eb66220-8fa7-11dc-ab6f-007304430c3e}]
          \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af67f332-2259-11dc-aa72-007304430c3e}]
          \Shell\AutoRun\command - H:\RavMon.exe
          \Shell\explore\Command - H:\RavMon.exe -e
          \Shell\open\Command - H:\RavMon.exe

          *Newly Created Service* - RPCSSVSS
          .
          - - - - ORPHELINS SUPPRIMES - - - -

          HKLM-Run-SpyRemoverPro - C:\PROGRA~1\SPYREM~1\SpyRemoverPro.exe
          HKLM-Run-Cmaudio - cmicnfg.cpl

          .
          ------- Examen suppl‚mentaire -------
          .
          R0 -: HKCU-Main,Start Page = about:blank
          R0 -: HKLM-Main,Start Page = hxxp://www.google.com
          R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
          O8 -: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
          O8 -: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
          O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
          .
          .
          ------- File Associations (Beta) -------
          .
          .

          **************************************************************************

          catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-09-13 16:37:25
          Windows 5.1.2600 Service Pack 2 FAT NTAPI

          Recherche de processus cach‚s ...

          Recherche d'‚l‚ments en d‚marrage automatique cach‚s ...

          Recherche de fichiers cach‚s ...

          Scan termin‚ avec succٹs
          Fichiers cach‚s: 0

          **************************************************************************

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BITSUMWdf]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BrowserLmHosts]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CiSvcAudioSrv]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MDMSchedule]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MessengerProtectedStorage]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDEdsdmwuauserv]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netlogonmnmsrvc]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NlaMcAfeeFramework]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetection]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetectionCOMSysApp]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrdmserver]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsusnjsvc]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsVSS]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonBrowserLmHosts]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonThemes]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TrkWksNetDDE]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\upnphostMessengerProtectedStorage]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UPSTermService]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmdmPmSNWmiApSrvImapiService]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApSrvImapiService]
          "ImagePath"=" srv"

          [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wuauservRemoteAccess]
          "ImagePath"=" srv"
          .
          --------------------- DLLs charg‚es dans les processus actifs ---------------------

          PROCESSUS: C:\WINDOWS\system32\winlogon.exe
          -> C:\WINDOWS\system32\NavLogon.dll
          .
          ------------------------ Autres processus actifs ------------------------
          .
          C:\PROGRAM FILES\A-SQUARED FREE\A2SERVICE.EXE
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
          C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
          C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
          C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
          C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
          C:\WINDOWS\system32\wscntfy.exe
          .
          **************************************************************************
          .
          Heure de fin: 2008-09-13 16:42:06 - La machine a red‚marr‚ [user]
          ComboFix-quarantined-files.txt 2008-09-13 14:41:54

          Avant-CF: 5,793,849,344 octets libres
          Après-CF: 5,754,134,528 octets libres

          302
          0
          2. malou
            ComboFix 08-09-12.09 - user 2008-09-13 16:23:10.1 - [color=red][b]FAT32[/b][/color]x86
            Microsoft Windows XP Professionnel 5.1.2600.2.1256.213.1036.18.75 [GMT 2:00]
            Lancé depuis: C:\Documents and Settings\user\Bureau\ComboFix.exe
            * Un nouveau point de restauration a été créé

            [color=red][b]AVERTISSEMENT - LA CONSOLE DE RةCUPةRATION N'EST PAS INSTALLةE SUR CETTE MACHINE !![/b][/color]
            .

            (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
            .

            C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
            C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
            C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
            C:\WINDOWS\system32\~.exe
            C:\WINDOWS\system32\braviax.exe
            C:\WINDOWS\system32\DelSelf.bat
            C:\WINDOWS\system32\drivers\atmapi.sys
            C:\WINDOWS\system32\drivers\npf.sys
            C:\WINDOWS\system32\packet.dll
            C:\WINDOWS\system32\pla.ax
            C:\WINDOWS\system32\pthreadVC.dll
            C:\WINDOWS\system32\shell31.dll
            C:\WINDOWS\system32\wanpacket.dll
            C:\WINDOWS\system32\WinCtrl32.dl_
            C:\WINDOWS\system32\WinCtrl32.dll
            C:\WINDOWS\system32\winivstr.exe
            C:\WINDOWS\system32\wpcap.dll
            C:\WINDOWS\system32\wpx63.cpx
            C:\WINDOWS\wiaservb.log
            F:\CNAS TARIF.pif

            ----- BITS: Il y a peut-ˆtre des sites infect‚s -----

            http://ygsondheks.info
            .
            ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
            .

            -------\Legacy_NPF
            -------\Service_NPF
            -------\Service_poof

            ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-13 au 2008-09-13 ))))))))))))))))))))))))))))))))))))
            .

            2008-09-13 13:24 . 2008-09-13 13:24 <REP> d--hs---- C:\FOUND.002
            2008-09-13 13:05 . 2008-09-13 13:05 <REP> d--hs---- C:\FOUND.001
            2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\user\Application Data\Grisoft
            2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
            2008-09-11 17:35 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
            2008-09-11 16:41 . 2008-09-11 16:41 <REP> d-------- C:\Program Files\Trend Micro
            2008-09-10 18:06 . 2008-09-11 16:50 250 --a------ C:\WINDOWS\gmer.ini
            2008-09-09 17:16 . 2008-09-09 17:16 73,728 --a------ C:\WINDOWS\system32\drivers\796.exe
            2008-09-09 16:46 . 2008-09-09 16:46 73,728 --a------ C:\WINDOWS\system32\drivers\203.exe
            2008-09-09 15:59 . 2008-09-09 17:17 2,640 --a------ C:\WINDOWS\system32\tmp.reg
            2008-09-09 14:48 . 2008-09-09 14:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\xqzaryhe
            2008-09-09 13:57 . 2008-09-09 13:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
            2008-09-09 13:57 . 2008-09-09 14:00 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
            2008-09-09 13:56 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
            2008-09-09 13:56 . 2008-07-09 09:05 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
            2008-09-09 13:56 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
            2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
            2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\Program Files\Zone Labs
            2008-09-09 13:54 . 2008-09-09 13:54 <REP> d-------- C:\WINDOWS\Internet Logs
            2008-09-09 12:21 . 2008-09-09 12:21 73,728 --a------ C:\WINDOWS\system32\drivers\968.exe
            2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Program Files\Trojan Remover
            2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Documents and Settings\user\Application Data\Simply Super Software
            2008-09-08 14:42 . 2008-09-08 14:42 <REP> d-------- C:\Program Files\a-squared Free
            2008-09-08 14:08 . 2008-09-08 14:08 130 --a------ C:\Documents and Settings\user\delself.bat
            2008-09-08 13:53 . 2008-09-08 13:53 249,856 --a------ C:\WINDOWS\system32\nvrsol32.dll.vir
            2008-09-08 13:15 . 2008-09-08 13:15 2,840,059 --a------ C:\WINDOWS\system32\SRPSig.zip
            2008-09-08 13:15 . 2008-09-08 13:15 870,601 --a------ C:\WINDOWS\system32\SRPExe.zip
            2008-09-08 13:12 . 2008-09-08 13:12 421 --a------ C:\WINDOWS\system32\10002.sks
            2008-09-08 13:12 . 2008-09-08 13:12 97 --a------ C:\WINDOWS\system32\10001.sks
            2008-09-08 13:12 . 2008-09-08 13:15 72 --a------ C:\WINDOWS\system32\SRPVer.ini
            2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10004.sks
            2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10003.sks
            2008-09-08 13:11 . 2008-09-08 13:17 2,380 --a------ C:\WINDOWS\system32\BlockedCookies
            2008-09-08 13:10 . 2008-09-08 13:10 <REP> d-------- C:\Program Files\SpyRemover Pro
            2008-09-08 12:26 . 2008-09-08 12:27 313,474 --a------ C:\WINDOWS\system32\winivstr.exe.vir
            2008-09-08 12:25 . 2008-09-08 12:25 <REP> d--hs---- C:\FOUND.000
            2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\srv
            2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\{e0e899ab-f487-11d5-8d29-0050ba6940e3}
            2008-09-07 16:26 . 2008-09-07 16:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\kfulyrgv
            2008-09-07 16:26 . 2008-09-07 16:26 98,816 --a------ C:\WINDOWS\system32\r4h.e33
            2008-09-07 16:26 . 2008-09-07 16:26 64,000 --a------ C:\WINDOWS\system32\fds.i386
            2008-09-07 16:26 . 2008-09-07 16:26 42,496 --a------ C:\WINDOWS\system32\drivers\656.exe
            2008-09-07 16:26 . 2008-09-07 16:26 29,184 --a------ C:\WINDOWS\iexplorer.exe.vir
            2008-09-07 16:26 . 2008-09-07 16:26 21,504 --a------ C:\WINDOWS\system32\sof.586
            2008-09-07 16:26 . 2008-09-07 16:28 32 --a-s---- C:\WINDOWS\system32\2633133696.dat
            2008-09-07 16:25 . 2008-09-07 16:25 55,063 --a------ C:\Documents and Settings\user\S87ekhV.exe
            2008-08-31 13:54 . 2008-08-31 13:54 <REP> d-------- C:\Program Files\Fichiers communs\Adobe

            .
            (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
            .
            2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\user32.DLL
            2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
            2008-08-25 17:13 26 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
            2008-06-21 12:10 8,813,777 ----a-w C:\WINDOWS\system32\SRPRSig.dll
            2008-06-21 12:09 6,538,067 ----a-w C:\WINDOWS\system32\SRPFSig.dll
            2008-06-21 12:08 623,157 ----a-w C:\WINDOWS\system32\SRPESig.dll
            2004-09-03 08:32 3,488 ----a-w C:\WINDOWS\inf\OTHER\CMIAINFO.SYS
            2007-01-01 13:28 220 --sha-w C:\WINDOWS\dwin.sys
            .
            [color=red] C:\WINDOWS\system32\user32.dll ... is infected !! (additional data below) [/color]
            578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\user32.DLL
            578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\dllcache\user32.dll

            ------- Sigcheck -------

            2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\user32.DLL
            2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\dllcache\user32.dll

            2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\drivers\tcpip.sys
            2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\dllcache\tcpip.sys
            .
            ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
            .
            .
            *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
            REGEDIT4

            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
            "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-07-16 4670704]
            "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
            "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
            "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-02-24 185896]
            "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
            "vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2007-09-13 77824]
            "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
            "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]

            [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
            "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

            [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
            "LTXA09sMbw"="C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe" [2008-09-09 73728]

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winag27.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj38.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj84.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windl84.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk16.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl16.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl40.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingm05.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winio30.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq27.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq84.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms05.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms38.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms40.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winnt62.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winov05.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvc62.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwd30.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxe63.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\software\microsoft\security center]
            "UpdatesDisableNotify"=dword:00000001
            "AntiVirusDisableNotify"=dword:00000001

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
            "EnableFirewall"= 0 (0x0)

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
            "%windir%\\system32\\sessmgr.exe"=
            "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
            "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
            "F:\\eMule\\emule.exe"=
            "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
            "C:\\Program Files\\MSN Messenger\\livecall.exe"=
            "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

            R3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-12-01 117785]
            S0 Winag27;Winag27;C:\WINDOWS\system32\Drivers\Winag27.sys [ ]
            S0 Windj38;Windj38;C:\WINDOWS\system32\Drivers\Windj38.sys [ ]
            S0 Windj84;Windj84;C:\WINDOWS\system32\Drivers\Windj84.sys [ ]
            S0 Windl84;Windl84;C:\WINDOWS\system32\Drivers\Windl84.sys [ ]
            S0 Winfk16;Winfk16;C:\WINDOWS\system32\Drivers\Winfk16.sys [ ]
            S0 Winfl16;Winfl16;C:\WINDOWS\system32\Drivers\Winfl16.sys [ ]
            S0 Winfl40;Winfl40;C:\WINDOWS\system32\Drivers\Winfl40.sys [ ]
            S0 Wingm05;Wingm05;C:\WINDOWS\system32\Drivers\Wingm05.sys [ ]
            S0 Winio30;Winio30;C:\WINDOWS\system32\Drivers\Winio30.sys [ ]
            S0 Winkq27;Winkq27;C:\WINDOWS\system32\Drivers\Winkq27.sys [ ]
            S0 Winkq84;Winkq84;C:\WINDOWS\system32\Drivers\Winkq84.sys [ ]
            S0 Winms05;Winms05;C:\WINDOWS\system32\Drivers\Winms05.sys [ ]
            S0 Winms38;Winms38;C:\WINDOWS\system32\Drivers\Winms38.sys [ ]
            S0 Winms40;Winms40;C:\WINDOWS\system32\Drivers\Winms40.sys [ ]
            S0 Winnt62;Winnt62;C:\WINDOWS\system32\Drivers\Winnt62.sys [ ]
            S0 Winov05;Winov05;C:\WINDOWS\system32\Drivers\Winov05.sys [ ]
            S0 Winvc62;Winvc62;C:\WINDOWS\system32\Drivers\Winvc62.sys [ ]
            S0 Winwd30;Winwd30;C:\WINDOWS\system32\Drivers\Winwd30.sys [ ]
            S0 Winxe63;Winxe63;C:\WINDOWS\system32\Drivers\Winxe63.sys [ ]
            S2 E2ECAP;e2eCap - WDM Video Capture;C:\WINDOWS\system32\DRIVERS\e2ecap.sys [2006-07-10 124416]

            [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57e52f3c-f9b1-11dc-ac10-007304430c3e}]
            \Shell\AutoRun\command - H:\juok3st.bat
            \Shell\explore\Command - H:\juok3st.bat
            \Shell\open\Command - H:\juok3st.bat

            [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8eb66220-8fa7-11dc-ab6f-007304430c3e}]
            \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

            [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af67f332-2259-11dc-aa72-007304430c3e}]
            \Shell\AutoRun\command - H:\RavMon.exe
            \Shell\explore\Command - H:\RavMon.exe -e
            \Shell\open\Command - H:\RavMon.exe

            *Newly Created Service* - RPCSSVSS
            .
            - - - - ORPHELINS SUPPRIMES - - - -

            HKLM-Run-SpyRemoverPro - C:\PROGRA~1\SPYREM~1\SpyRemoverPro.exe
            HKLM-Run-Cmaudio - cmicnfg.cpl

            .
            ------- Examen suppl‚mentaire -------
            .
            R0 -: HKCU-Main,Start Page = about:blank
            R0 -: HKLM-Main,Start Page = hxxp://www.google.com
            R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
            O8 -: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
            O8 -: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
            O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
            .
            .
            ------- File Associations (Beta) -------
            .
            .

            **************************************************************************

            catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2008-09-13 16:37:25
            Windows 5.1.2600 Service Pack 2 FAT NTAPI

            Recherche de processus cach‚s ...

            Recherche d'‚l‚ments en d‚marrage automatique cach‚s ...

            Recherche de fichiers cach‚s ...

            Scan termin‚ avec succٹs
            Fichiers cach‚s: 0

            **************************************************************************

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BITSUMWdf]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BrowserLmHosts]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CiSvcAudioSrv]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MDMSchedule]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MessengerProtectedStorage]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDEdsdmwuauserv]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netlogonmnmsrvc]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NlaMcAfeeFramework]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetection]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetectionCOMSysApp]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrdmserver]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsusnjsvc]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsVSS]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonBrowserLmHosts]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonThemes]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TrkWksNetDDE]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\upnphostMessengerProtectedStorage]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UPSTermService]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmdmPmSNWmiApSrvImapiService]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApSrvImapiService]
            "ImagePath"=" srv"

            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wuauservRemoteAccess]
            "ImagePath"=" srv"
            .
            --------------------- DLLs charg‚es dans les processus actifs ---------------------

            PROCESSUS: C:\WINDOWS\system32\winlogon.exe
            -> C:\WINDOWS\system32\NavLogon.dll
            .
            ------------------------ Autres processus actifs ------------------------
            .
            C:\PROGRAM FILES\A-SQUARED FREE\A2SERVICE.EXE
            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
            C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
            C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
            C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
            C:\WINDOWS\system32\wscntfy.exe
            .
            **************************************************************************
            .
            Heure de fin: 2008-09-13 16:42:06 - La machine a red‚marr‚ [user]
            ComboFix-quarantined-files.txt 2008-09-13 14:41:54

            Avant-CF: 5,793,849,344 octets libres
            Après-CF: 5,754,134,528 octets libres

            302
            0
            1. ludsfa
              salut,

              Télécharge Gmer:
              http://www2.gmer.net/gmer.zip
              Dézippe le dans un dossier ou sur ton bureau:
              http://www.7-zip.org/fr/

              Déconnecte toi d'Internet puis et ferme tous les programmes.
              Double-clique sur Gmer.exe.

              IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.

              Clique sur l'onglet rootkit.
              A droite, coche Files et Services.
              Clique maintenant sur Scan.

              Lorsque le scan est terminé, clique sur Copy.

              Ouvre le Bloc-notes puis clique sur le Menu Edition / Coller.
              Le rapport doit alors apparaître.
              Enregistre le fichier sur ton bureau et copie/colle le contenu ici.
              -1
              1. ludsfa
                Bonjour,

                Télécharge ComboFix (de sUBs) sur ton Bureau.
                http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                * Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
                * Double clique sur ComboFix.exe.
                * Accepte la licence en cliquant sur Oui.
                * Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

                Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

                Aide : Comment utiliser ComboFix.
                https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
                -1
                1. malou
                  j'ai pas compris le fonctiionnement de combofix
                  j'ai fait avec hijack
                  voici le rapport
                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 16:41:46, on 11-09-2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  c:\windows\explorer.exe
                  C:\Program Files\a-squared Free\a2service.exe
                  C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
                  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
                  C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
                  C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe
                  C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
                  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
                  C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
                  C:\WINDOWS\system32\braviax.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
                  C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                  F2 - REG:system.ini: Shell=c:\windows\explorer.exe
                  F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
                  O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
                  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                  O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
                  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
                  O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                  O4 - HKLM\..\Run: [advap32] "C:\DOCUME~1\user\LOCALS~1\Temp\loader.exe" /r
                  O4 - HKLM\..\Run: [SpyRemoverPro] C:\PROGRA~1\SPYREM~1\SpyRemoverPro.exe
                  O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
                  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                  O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
                  O4 - HKLM\..\Policies\Explorer\Run: [LTXA09sMbw] C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe
                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                  O4 - Global Startup: DSLMON.lnk = ?
                  O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
                  O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
                  O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
                  O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
                  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{C935A448-A7B1-4F04-885B-12507C6CD6FB}: NameServer = 41.221.20.4 193.251.169.165
                  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                  O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
                  O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                  O23 - Service: Service de transfert intelligent en arrière-plan BITSUMWdf (BITSUMWdf) - Unknown owner - .exe (file missing)
                  O23 - Service: Explorateur d'ordinateur BrowserLmHosts (BrowserLmHosts) - Unknown owner - .exe (file missing)
                  O23 - Service: Service d'indexation CiSvcAudioSrv (CiSvcAudioSrv) - Unknown owner - .exe (file missing)
                  O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
                  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
                  O23 - Service: Machine Debug Manager (MDM) - Network Associates, Inc. - (no file)
                  O23 - Service: Machine Debug Manager MDMSchedule (MDMSchedule) - Unknown owner - .exe (file missing)
                  O23 - Service: Affichage des messages MessengerProtectedStorage (MessengerProtectedStorage) - Unknown owner - .exe (file missing)
                  O23 - Service: DSDM DDE réseau NetDDEdsdmwuauserv (NetDDEdsdmwuauserv) - Unknown owner - .exe (file missing)
                  O23 - Service: Ouverture de session réseau Netlogonmnmsrvc (Netlogonmnmsrvc) - Unknown owner - .exe (file missing)
                  O23 - Service: NLA (Network Location Awareness) NlaMcAfeeFramework (NlaMcAfeeFramework) - Unknown owner - .exe (file missing)
                  O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
                  O23 - Service: Services IPSEC PolicyAgentShellHWDetection (PolicyAgentShellHWDetection) - Unknown owner - .exe (file missing)
                  O23 - Service: Services IPSEC PolicyAgentShellHWDetection PolicyAgentShellHWDetectionCOMSysApp (PolicyAgentShellHWDetectionCOMSysApp) - Unknown owner - .exe (file missing)
                  O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance RDSessMgrdmserver (RDSessMgrdmserver) - Unknown owner - .exe (file missing)
                  O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
                  O23 - Service: Appel de procédure distante (RPC) RpcSsusnjsvc (RpcSsusnjsvc) - Unknown owner - .exe (file missing)
                  O23 - Service: Connexion secondaire seclogonThemes (seclogonThemes) - Unknown owner - .exe (file missing)
                  O23 - Service: Client de suivi de lien distribué TrkWksNetDDE (TrkWksNetDDE) - Unknown owner - .exe (file missing)
                  O23 - Service: Hôte de périphérique universel Plug-and-Play upnphostMessengerProtectedStorage (upnphostMessengerProtectedStorage) - Unknown owner - .exe (file missing)
                  O23 - Service: Onduleur UPSTermService (UPSTermService) - Unknown owner - .exe (file missing)
                  O23 - Service: Carte de performance WMI WmiApSrvImapiService (WmiApSrvImapiService) - Unknown owner - .exe (file missing)
                  O23 - Service: Mises à jour automatiques wuauservRemoteAccess (wuauservRemoteAccess) - Unknown owner - .exe (file missing)
                  0
              2. ludsfa
                salut malou,

                Si tu as passer combofix peux tu m'envoyer le rapport.
                -1
                1. ludsfa
                  salut,

                  Télécharge ComboFix (de sUBs) sur ton Bureau.
                  http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                  * Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
                  * Double clique sur ComboFix.exe.
                  * Accepte la licence en cliquant sur Oui.
                  * Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

                  Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)
                  -1
                  1. malou
                    bonjour
                    j'ai telechargé combofix
                    j'ai fait un scan
                    le message" your computer is infected" a disparu
                    je pense que tout est reglé
                    je te remercie
                    0
                2. ludsfa
                  salut malou,

                  peux tu m'envoyer le rapport car il y à certainement des infections que combofix n'à pas supprimé.
                  -1

                  Discussions similaires

                  Spam SMS : your messenger vérification code is ***
                  Metheor

                  1 réponse
                  Sms étranges "... is your instagram code"
                  Anon_4067

                  5 réponses
                  Page bleue : your PC ran into a problem and needs to restart
                  pitchalou

                  2 réponses
                  TokyVideo : avis, site fiable ou arnaque ?
                  timinie

                  8 réponses
                  Rtc battery low
                  Laeti28

                  15 réponses