Antispyware xp : risque de contamination? - Page 2

Euh impossible de désactiver l'auto protection d'Avast...donc impossible de le supprimer...Je commence à penser assez sérieusement au formatage là...

Je tente avec le mode sans échec...

C'est bon ça a fonctionné...Voici le rapport d'antivir :

Avira AntiVir Personal
Report file date: mardi 28 octobre 2008 13:34

Scanning for 1369550 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: utilisateur
Computer name: SN200913530001

Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 09:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 08:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 13:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 08:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 11:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 14:54:15
ANTIVIR2.VDF : 7.0.5.20 142336 Bytes 30/06/2008 06:20:53
ANTIVIR3.VDF : 7.0.5.23 17408 Bytes 30/06/2008 10:24:47
Engineversion : 8.1.1.19
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 10:58:21
AESCRIPT.DLL : 8.1.0.63 311673 Bytes 06/08/2008 14:13:47
AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 13:44:49
AERDL.DLL : 8.1.0.20 418165 Bytes 24/04/2008 13:37:48
AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 13:58:35
AEOFFICE.DLL : 8.1.0.21 192891 Bytes 18/07/2008 07:35:21
AEHEUR.DLL : 8.1.0.47 1368437 Bytes 06/08/2008 14:13:47
AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 13:44:48
AEGEN.DLL : 8.1.0.35 315764 Bytes 06/08/2008 15:38:47
AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 09:33:21
AECORE.DLL : 8.1.1.8 172406 Bytes 31/07/2008 09:33:21
AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 13:44:48
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 09:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 10:28:01
AVREP.DLL : 7.0.0.1 155688 Bytes 30/06/2008 15:35:20
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 12:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 09:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 13:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 18:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 13:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 13:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 14:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 14:34:37

Configuration settings for the scan:
Jobname..........................: Windows System Directory
Configuration file...............: C:\Program Files\Avira\AntiVir PersonalEdition Classic\setupprf.dat
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 28 octobre 2008 13:34

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'antivir-personal-edition_avira_antivir_' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'TabUserW.exe' - '1' Module(s) have been scanned
Scan process 'FINDFAST.EXE' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'msiexec.exe' - '1' Module(s) have been scanned
Scan process 'OSA.EXE' - '1' Module(s) have been scanned
Scan process 'CalCheck.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'DrvMon.exe' - '1' Module(s) have been scanned
Scan process 'LVComS.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'EoEngine.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'LogiTray.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'StartMessager.exe' - '1' Module(s) have been scanned
Scan process 'hpztsb05.exe' - '1' Module(s) have been scanned
Scan process 'AOSD.EXE' - '1' Module(s) have been scanned
Scan process 'vcsplay.exe' - '1' Module(s) have been scanned
Scan process 'WkUFind.exe' - '1' Module(s) have been scanned
Scan process 'ABOARD.EXE' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'wanmpsvc.exe' - '1' Module(s) have been scanned
Scan process 'vcssecs.exe' - '1' Module(s) have been scanned
Scan process 'UStorSrv.exe' - '1' Module(s) have been scanned
Scan process 'Tablet.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'snmp.exe' - '1' Module(s) have been scanned
Scan process 'slserv.exe' - '1' Module(s) have been scanned
Scan process 'mdm.exe' - '1' Module(s) have been scanned
Scan process 'fswsclds.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
52 processes with 52 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '67' files ).

Starting the file scan:

Begin scan in 'C:\WINDOWS\system32'

End of the scan: mardi 28 octobre 2008 13:38
Used time: 03:20 Minute(s)

The scan has been done completely.

248 Scanning directories
6607 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
0 Files cannot be scanned
6607 Files not concerned
16 Archives were scanned
0 Warnings
0 Notes

ok encore des soucis???

remets un rapport sdfix pour voir

Je crois qu'il y a plus de virus, je peux de nouveau me connecter à Internet, par contre toutes mes applications ne fonctionnent plus, je vais devoir toutes les réinstaller je crois...Toujours le même souci au démarrage qui est apparu en même temps que le virus (coincidence?).
Je poste le rapport SDFix quand mon ordi aura bien voulu redémarrer...

ok vire ta version combofix aussi et télécharge la dernière et colle ton rapport

pour bien vérifier car ton infection est en cours d'expansion et de développement et donc en mettant a jour les logciels cela partira

a plus

Voici le rapport SDFix :

[b]SDFix: Version 1.238 [/b]
Run by utilisateur on 28/10/2008 at 14:42

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

No Trojan Files Found

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-28 15:06:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys]
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=str(2):"\systemroot\system32\drivers\TDSSpqxt.sys"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\TDSSserv.sys]
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=str(2):"\systemroot\system32\drivers\TDSSpqxt.sys"

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:

[b]Files with Hidden Attributes [/b]:

Wed 12 Nov 2003 193 A.SHR --- "C:\BOOT.BAK"
Wed 28 May 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 14 Jul 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue 26 Feb 2008 5,815,712 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0dc0cd248a1e330b1c8d60afcf364e70\BIT6F.tmp"
Tue 29 Jan 2008 43,008 A..H. --- "C:\Documents and Settings\utilisateur\Mes documents\Elodie\m‚moire master pro\m‚moire master pro\~WRL0204.tmp"
Mon 2 Jun 2008 25,600 A..H. --- "C:\Documents and Settings\utilisateur\Mes documents\Elodie\m‚moire master pro\m‚moire master pro\~WRL0282.tmp"
Tue 3 Jun 2008 25,088 A..H. --- "C:\Documents and Settings\utilisateur\Mes documents\Elodie\m‚moire master pro\m‚moire master pro\~WRL0420.tmp"
Mon 28 Jan 2008 22,016 A..H. --- "C:\Documents and Settings\utilisateur\Mes documents\Elodie\m‚moire master pro\m‚moire master pro\~WRL1061.tmp"
Tue 25 Mar 2008 44,544 A..H. --- "C:\Documents and Settings\utilisateur\Mes documents\Elodie\m‚moire master pro\m‚moire master pro\~WRL1134.tmp"

[b]Finished![/b]

Et le rapport Combofix :

ComboFix 08-10-27.05 - utilisateur 2008-10-28 15:23:16.5 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.454 [GMT 1:00]
Lancé depuis: C:\Documents and Settings\utilisateur\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv.sys

((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-28 ))))))))))))))))))))))))))))))))))))
.

2008-10-28 13:33 . 2008-10-28 13:33 <REP> d-------- C:\Program Files\Avira
2008-10-28 13:33 . 2008-10-28 13:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-10-27 21:09 . 2008-10-27 21:11 <REP> d-------- C:\HiJackThis
2008-10-27 19:31 . 2008-10-27 19:31 <REP> d-------- C:\Program Files\EoRezo
2008-10-27 19:31 . 2008-10-28 15:32 <REP> d-------- C:\Documents and Settings\utilisateur\Application Data\EoRezo
2008-10-27 18:17 . 2008-10-27 18:17 579,584 --a------ C:\WINDOWS\system32\dllcache\user32.dll
2008-10-27 18:14 . 2008-10-27 18:14 <REP> d-------- C:\WINDOWS\ERUNT
2008-10-27 18:12 . 2008-10-28 15:12 <REP> d-------- C:\SDFix
2008-10-27 13:50 . 2008-10-27 13:50 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-27 13:50 . 2008-10-27 13:50 <REP> d-------- C:\Documents and Settings\utilisateur\Application Data\Malwarebytes
2008-10-27 13:50 . 2008-10-27 13:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-27 13:50 . 2008-10-22 16:10 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-27 13:50 . 2008-10-22 16:10 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-27 10:24 . 2002-08-30 13:00 73,728 --a------ C:\WINDOWS\system32\dllcache\icwtutor.exe
2008-10-27 10:24 . 2002-08-30 13:00 65,536 --a------ C:\WINDOWS\system32\dllcache\icwres.dll
2008-10-27 10:24 . 2002-08-30 13:00 40,960 --a------ C:\WINDOWS\system32\dllcache\trialoc.dll
2008-10-27 10:24 . 2002-08-30 13:00 16,384 --a------ C:\WINDOWS\system32\dllcache\isignup.exe
2008-10-27 10:23 . 2002-08-30 13:00 1,685,606 --a------ C:\WINDOWS\system32\dllcache\sam.spd
2008-10-27 10:23 . 2002-08-30 13:00 774,144 --a------ C:\WINDOWS\system32\dllcache\spttseng.dll
2008-10-27 10:23 . 2002-08-30 13:00 605,050 --a------ C:\WINDOWS\system32\dllcache\r1033tts.lxa
2008-10-27 10:23 . 2002-08-30 13:00 94,720 --a------ C:\WINDOWS\system32\dllcache\ieinfo5.ocx
2008-10-27 10:23 . 2002-08-30 13:00 40,448 --a------ C:\WINDOWS\system32\dllcache\msinfo32.exe
2008-10-27 10:23 . 2002-08-30 13:00 888 --a------ C:\WINDOWS\system32\dllcache\sam.sdf
2008-10-24 06:10 . 2008-10-15 17:35 337,408 --------- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-15 05:53 . 2008-09-08 11:41 333,824 --------- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-15 05:52 . 2008-08-14 14:23 2,191,232 --------- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 05:52 . 2008-08-14 14:23 2,147,328 --------- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 05:52 . 2008-08-14 14:23 2,068,096 --------- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 05:52 . 2008-08-14 14:23 2,025,984 --------- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 05:52 . 2008-09-15 16:26 1,846,528 --------- C:\WINDOWS\system32\dllcache\win32k.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-28 12:27 --------- d-----w C:\Program Files\Alwil Software
2008-10-27 09:41 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-10-27 09:26 --------- d-----w C:\Program Files\Windows Live
2008-10-27 09:26 --------- d-----w C:\Program Files\Wanadoo
2008-10-27 09:25 --------- d-----w C:\Program Files\Tablette
2008-10-27 09:25 --------- d-----w C:\Program Files\Securitoo
2008-10-27 09:25 --------- d-----w C:\Program Files\QuickTime
2008-10-27 09:24 --------- d-----w C:\Program Files\Microsoft Works
2008-10-27 09:24 --------- d-----w C:\Program Files\Microsoft Picture It! 7
2008-10-27 09:24 --------- d-----w C:\Program Files\Microsoft Money
2008-10-27 09:24 --------- d-----w C:\Program Files\Microsoft AutoRoute
2008-10-27 09:24 --------- d-----w C:\Program Files\Messager Wanadoo
2008-10-27 09:24 --------- d-----w C:\Program Files\Logitech
2008-10-27 09:24 --------- d-----w C:\Program Files\Jardinains 2!
2008-10-27 09:23 --------- d-s---w C:\Program Files\Fichiers communs\Teknum Systems
2008-10-27 09:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-27 09:23 --------- d-----w C:\Program Files\Fichiers communs\Real
2008-10-27 09:23 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-10-27 09:23 --------- d-----w C:\Program Files\EHMINSTALL
2008-10-26 21:24 261,020 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-26 21:24 22,003,744 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-19 13:09 1,577,984 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-10-12 07:05 12,091,894 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-10-05 14:43 33,280 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-10-05 13:44 2,759,168 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-07-31 11:57 2,688,000 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-07-10 10:54 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008071020080711\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-10-27_16.00.32.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-10-28 13:38:23 7,565,312 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-10-28 13:38:23 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-10-27 17:14:46 7,565,312 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-10-27 17:14:46 57,344 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-05-09 12:15:51 45,376 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys
+ 2008-01-21 17:11:28 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
+ 2008-06-27 14:03:55 75,072 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2007-03-01 09:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
- 2008-10-27 14:49:54 12,398 ----a-w C:\WINDOWS\system32\tablet.dat
+ 2008-10-28 14:29:27 12,398 ----a-w C:\WINDOWS\system32\tablet.dat
+ 2008-10-28 14:29:43 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_c0.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\mnyexpr.exe" [2002-07-17 204863]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-20 67128]
"DrvMon.exe"="C:\WINDOWS\System32\DrvMon.exe" [2004-09-22 53248]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-12 335872]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
"Microsoft Works Update Detection"="C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-18 28672]
"VCSPlayer"="C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe" [2003-08-13 299008]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-18 188416]
"MessagerStarter Wanadoo"="C:\PROGRA~1\MESSAG~1\StartMessager.exe" [2003-04-11 32768]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2003-11-12 151597]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2003-12-16 77824]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-07 98304]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"EoEngine"="C:\Program Files\EoRezo\EoEngine.exe" [2008-09-23 565248]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 C:\WINDOWS\system32\Ati2mdxx.exe]
"SoundMan"="SOUNDMAN.EXE" [2003-08-05 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.enc"= ITIG726.acm
"VIDC.DVSD"= pdvcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys [2002-08-06 11264]
R1 vcsmpdrv;vcsmpdrv;C:\WINDOWS\system32\DRIVERS\vcsmpdrv.sys [2003-06-16 49024]
R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\Securitoo\av_fw\fswsclds.exe [2006-06-30 45056]
R2 VCSSecS;Virtual CD v4 Security service (SDK - Version);C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe [2002-05-16 139264]
S2 NetThb;NetThb;\\?\C:\Program Files\Fichiers communs\Microsoft Shared\lpt4.exe [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2aa1856-e518-11db-8bed-00038a000015}]
\Shell\AutoRun\command - explorer.exe
.
Contenu du dossier 'Tâches planifiées'

2004-02-22 C:\WINDOWS\Tasks\Rappel d'enregistrement 1.job
- C:\WINDOWS\System32\OOBE\oobebaln.exe [2008-04-14 03:34]

2004-02-28 C:\WINDOWS\Tasks\Rappel d'enregistrement 2.job
- C:\WINDOWS\System32\OOBE\oobebaln.exe [2008-04-14 03:34]

2004-03-06 C:\WINDOWS\Tasks\Rappel d'enregistrement 3.job
- C:\WINDOWS\System32\OOBE\oobebaln.exe [2008-04-14 03:34]

2004-02-22 C:\WINDOWS\Tasks\Symantec NetDetect.job
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE []
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\qf6q9sto.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.lo.stFF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npqtplugin8.dll
FF -: plugin - C:\Program Files\QuickTime\Plugins\npqtplugin8.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-28 15:30:23
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\snmp.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\APPS\ABoard\AOSD.EXE
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\system32\msiexec.exe
C:\APPS\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Heure de fin: 2008-10-28 15:40:28 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-28 14:40:22
ComboFix2.txt 2008-10-27 20:04:39
ComboFix3.txt 2008-10-27 19:31:27
ComboFix4.txt 2008-10-27 17:51:07
ComboFix5.txt 2008-10-28 14:22:45

Avant-CF: 30 327 984 128 octets libres
Après-CF: 30,336,278,528 octets libres

206 --- E O F --- 2008-10-25 05:56:04

PARFAIT COMBOFIX S'EST MIS a jour ! et a enfin viré les restes infectieux

encore des soucis???

Toujours les mêmes problèmes, mais si le virus est plus là c'est déjà bien...Je risque de passer la soirée à tout réinstaller par contre ^^
Reste le problème de démarrage qui m'embête un peu plus mais ça a plus de rapport avec Antispyware xp, donc je vais essayer de regarder ailleurs d'où ça peut provenir...et je posterai un nouveau sujet au pire ^^
Merci beaucoup de ton aide!

télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\Program Files\EoRezo
C:\Documents and Settings\utilisateur\Application Data\EoRezo

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

_____________________

quels soucis au demarrage???

Voilà le rapport :
C:\Program Files\EoRezo\lang moved successfully.
C:\Program Files\EoRezo\EoAdv moved successfully.
C:\Program Files\EoRezo moved successfully.
C:\Documents and Settings\utilisateur\Application Data\EoRezo\eoDesktop moved successfully.
C:\Documents and Settings\utilisateur\Application Data\EoRezo\db moved successfully.
C:\Documents and Settings\utilisateur\Application Data\EoRezo moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 10282008_180115

Et concernant le problème au démarrage, j'ai le message suivant qui apparait quand je veux redémarrer :
BIOS ROM check sum error
Detecting floppy drive A media...
Drive A error. System halt.

accompagné par une série de bip ininterrompue. Je dois éteindre l'ordi au bouton et attendre au moins 5 min avant de pouvoir le redémarrer...

c'est depuis l'infection ou avant???

car cela ressemble a un souci materiel, regarde ton manuel ou renseigne toi sur ta carte mere pour savoir a quoi correspond les bips:

http://www.depannetonpc.net/fiches-pratiques/lire_32_1_bips-au-demarrage.html

______________

Detecting floppy drive A media...

cela vient en général de ton lecteur A qui doit etre un lecteur de disquette : vire la disquette qu'il y a dedans

si cela persiste essaye de debrancher le lecteur A pour voir

_______________

sinon

http://www.commentcamarche.net/faq/sujet 5644 bios rom checksum error system halted

Visiblement le problème daterait de 3 semaines à peu près (je ne sais pas exactement parce que c'est pas moi qui utilise l'ordi en général)...C'est effectivement possible que le problème vienne du lecteur de disquettes puisque, même si je n'en ai pas, un lecteur est apparu dans le poste de travail à ce moment là.

J'ai désinstallé le "pseudo" lecteur de disquettes et visiblement plus de bips au démarrage ^^
A priori j'ai donc plus de problèmes avec l'ordi maintenant...Merci encore!

ok lance tools cleaner pour virer ce qui a été utilisé:

http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

pour protéger gratos ton ordi
http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

ANTIVIR
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MALWAREBYTE ANTIMALWARE + SPYBOT
+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

--------
un pare feu :
(celui de Windows) ou mieux COMODO ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

http://www.clubic.com/telecharger-fiche11071-sunbelt-persona­l-firewall-e(...)
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
https://www.commentcamarche.net/telecharger/ 157 zonealarm

-----------

CCLEANER pour effacer les traces de surf