Help !! virus redirection IE + google

ok..j'ai coché "résolu"

je parlais d'un éventuel numéro de mon PC, pour les intrusions...

aucun risque?

(j'ai du mal à lacher les gens qui m'aident)....c'est si froid ces discutions info...hahaha !

mais je saurais où te retrouver sans ou avec virus ;-)

!!!

une dernière chose.....

mes infos...là...mes rapports.....

y a t il des gens mal intentionnés qui pourraient se servir de ces infos??

il y parait mon nom + prénom..ok, .... mais je veux dire....le PC...
peut on "entrer" dans mon PC avec ces infos là?

si oui...puis je détruire tout les msg?

mais..en même temps..cela peut servir à d'autres....

et aussi...
comment passe t on en "problème résolu" ?

(si t'as le temps..hein...sinon...ça peut attendre...)

ok...

en ce qui me concerne, j'ai Antivir + le pare feu Windows

j'ai gardé aussi malwarebytes...et tous les autres d'ailleurs

j'avais chopé le virus très connement en cliquant sur une fausse page "windows" -- ATTENTION VIRUS-- cliquez ici pour que windows s'occupe d'éradiquer les virus...truc dans le genre, avec plein de virus notés en rouge...bref....l'attrappe-couillon par excellence, je suppose.....

couillonne en l'occurence

j'ai appris depuis qu'il faut faire confiance à mon antivirus, et qu'Antivir est pas mal du tout d'après les avis glannés de ci de là auprès de gens qui "touchent leur bille " en informatique...

et puis..toi aussi tu me le conseilles..donc...
et oui..j'ai installé mozillafirefox aussitôt que mon ordinateur fut guéri !

et là..je dis....

merci jlpjlp ! je ne te remercierais jamais assez
tu m'as épargné un coût de réparation, un voire plusieurs déplacements vers la ville,
et même que je me suis trouvée moins conne à avoir (presque) tout pigé "qu'est ce que tu me disais"...!!!!

@stoopidahttps://www.espacerezo.fr/?tag/materiel

:-)

Sonia

le PC marche mieux qu'avant!!

donc.....
je t'envoie 1000 mercis !!

vraiment..je me demande ce que je peux faire pour te remercier.....

c'est que....
on s'attache aux interlocuteurs qui donnent sans compter !!

Sonia

ben...la suite tu l'as...C'est mon rapport antivir ci dessus

oui...désactivé, pardon.....je me mélange les pinceaux dans le langage informatique
désactivé et réactivé suite au redémarrage

j'avais suivi les instruction du lien infotruc
c'est bien ce que je devais faire, non?

en tous cas..mon ordi marche toujours bien....

bon..j'espère ne pas avoir fait de bétise

à+

So

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:
le rapport toolscleaner :

C:\Combofix.txt: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Rapior Sonia\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Rapior Sonia\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\Rapior Sonia\Bureau\SDFIX: trouvé !
C:\Documents and Settings\Rapior Sonia\Recent\MSNFix.lnk: trouvé !
C:\Program Files\MsnFix: trouvé !
C:\Program Files\AntiVir PersonalEdition Classic\MSNFix.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\RECYCLER\S-1-5-21-1343024091-507921405-839522115-1004\Dc3\Qoobox: trouvé !
C:\RECYCLER\S-1-5-21-1343024091-507921405-839522115-1004\Dc3\Documents and Settings\Rapior Sonia\Bureau\SDFIX: trouvé !
C:\WINDOWS\msnfix.txt: trouvé !

@stoopidaok.....

j'ai restauré le système, cette fois pour de bon
-j'avais merdouillé une première fois-
(j'ai viré le post précédent)

je scanne antivir et poste le rapport dès que possible

à +
So

@stoopidaLE VOICI LE VOILA !! :-)

et après ça...dis....
elle est partie la maladie ??

Avira AntiVir Personal
Report file date: mercredi 11 février 2009 21:05

Scanning for 1331058 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: Rapior Sonia
Computer name: RAPIOR-4EA0D10B

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 17:42:46
AVSCAN.DLL : 8.1.4.0 40705 Bytes 18/07/2008 07:21:01
LUKE.DLL : 8.1.4.5 164097 Bytes 18/07/2008 07:21:01
LUKERES.DLL : 8.1.4.0 12033 Bytes 18/07/2008 07:21:01
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 18:18:32
ANTIVIR1.VDF : 7.1.1.113 2817536 Bytes 14/01/2009 10:18:00
ANTIVIR2.VDF : 7.1.1.240 1659904 Bytes 07/02/2009 16:54:42
ANTIVIR3.VDF : 7.1.2.10 107520 Bytes 11/02/2009 17:45:33
Engineversion : 8.2.0.76
AEVDF.DLL : 8.1.1.0 106868 Bytes 31/01/2009 11:52:53
AESCRIPT.DLL : 8.1.1.43 344442 Bytes 07/02/2009 14:13:07
AESCN.DLL : 8.1.1.6 127348 Bytes 31/01/2009 11:52:50
AERDL.DLL : 8.1.1.3 438645 Bytes 06/11/2008 18:10:01
AEPACK.DLL : 8.1.3.8 397684 Bytes 05/02/2009 14:13:08
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 12/12/2008 09:59:20
AEHEUR.DLL : 8.1.0.90 1573237 Bytes 05/02/2009 14:13:07
AEHELP.DLL : 8.1.2.0 119159 Bytes 19/11/2008 09:45:45
AEGEN.DLL : 8.1.1.14 332148 Bytes 07/02/2009 14:13:07
AEEMU.DLL : 8.1.0.9 393588 Bytes 16/10/2008 13:28:47
AECORE.DLL : 8.1.6.4 176501 Bytes 03/02/2009 11:51:45
AEBB.DLL : 8.1.0.3 53618 Bytes 16/10/2008 13:28:46
AVWINLL.DLL : 1.0.0.12 15105 Bytes 18/07/2008 07:21:01
AVPREF.DLL : 8.0.2.0 38657 Bytes 18/07/2008 07:21:01
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 14:56:42
AVREG.DLL : 8.0.0.1 33537 Bytes 18/07/2008 07:21:01
AVARKT.DLL : 1.0.0.23 307457 Bytes 14/04/2008 15:39:49
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 18/07/2008 07:21:01
SQLITE3.DLL : 3.3.17.1 339968 Bytes 14/04/2008 15:39:50
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 18/07/2008 07:21:02
NETNT.DLL : 8.0.0.1 7937 Bytes 14/04/2008 15:39:50
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 18/07/2008 07:21:00
RCTEXT.DLL : 8.0.52.0 86273 Bytes 18/07/2008 07:21:00

Configuration settings for the scan:
Jobname..........................: Local Drives
Configuration file...............: c:\program files\antivir personaledition classic\alldrives.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, E:, F:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mercredi 11 février 2009 21:05

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'acrotray.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'VersionCueTray.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'smax4pnp.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
38 processes with 38 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '53' files ).

Starting the file scan:

Begin scan in 'C:\' <SYSTEM>
C:\pagefile.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <DATA>
Begin scan in 'E:\'
Search path E:\ could not be opened!
System error [21]: Le périphérique n'est pas prêt.
Begin scan in 'F:\'
Search path F:\ could not be opened!
System error [21]: Le périphérique n'est pas prêt.

End of the scan: mercredi 11 février 2009 21:26
Used time: 20:52 Minute(s)

The scan has been done completely.

6979 Scanning directories
294265 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
294264 Files not concerned
2274 Archives were scanned
1 Warnings
0 Notes

hello jlpjlp

voici le rapport Otmovelt de ce soir où j'avais copié/collé
tes instructions
ai redémarré

ai viré les files dans c/otmovelt/movedfiles comme tu me l'as dit

en revanche....toolscleaner ne se trouve plus à la bonne page
le lien est expiré semble t il
je ne voudrais pas charger encore une fois un truc foireux...

mon ordi marche bien...
je préfère prendre le temps pour réparer....alors..j'attends un nouveau lien de ta part

je sais...j'ai un côté laborieux.... :-)

j'ai viré les quarantaines aussi dans malwarebytes et antivir
celà depuis un moment déjà

merci encore et bonne soirée

So

========== FILES ==========
C:\Documents and Settings\Rapior Sonia\Bureau\SDFix\backups moved successfully.
File/Folder C:\Documents and Settings\Rapior Sonia\Local Settings\Temp\TDSS3fc7.tmp not found.
File/Folder C:\Documents and Settings\Rapior Sonia\Local Settings\Temp\TDSS3fe6.tmp not found.
C:\Qoobox\Quarantine moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02112009_200511

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.

hello jlpjlp

je ferai tout cela ce week-end....pas eu le temps depuis tes derniers posts

je te tiens au courant pour les rapport et tout ça..promis!

je crains de faire cette manip' de restauration du système....
peur de faire une bétise.....alors je préfère prendre mon temps

bon week end !! :-)

So

oui, j'ai eu un rapport.. je laisse finir le scan de malware et je t'envoie ça...
je crains de toucher à quoi que ce soit durant le scan que j'ai demandé minutieux

@stoopidasuis passée de 0 puis 7 et directement 34 elements infectés !!!!!!

que dois je faire sur malware de toute cette daube lorsqu'il aura terminé son job...serais je guidée par le logiciel pour exterminer la vermine?

@stoopidaen 1er enregistrer le rapport ?
supprimer la vermine?

@stoopidaRapport de combofix :

ComboFix 09-01-19.05 - Rapior Sonia 2009-02-03 21:32:28.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.990.638 [GMT 1:00]
Lancé depuis: c:\documents and settings\Rapior Sonia\Bureau\Killfix.exe
Commutateurs utilisés :: c:\documents and settings\Rapior Sonia\Bureau\CFscript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)
.
- Mode FONCTIONNALITES REDUITES -

FILE ::
c:\windows\system32\TDSSkfkl.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\TDSSkfkl.dll . . . . impossible à supprimer

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-03 au 2009-02-03 ))))))))))))))))))))))))))))))))))))
.

2009-02-03 20:34 . 2009-02-03 20:34 <REP> d-------- c:\windows\ERUNT
2009-02-02 21:18 . 2009-02-02 21:18 <REP> d-------- C:\_OTMoveIt
2009-02-02 21:02 . 2009-02-03 10:17 <REP> d-------- c:\program files\Exterminate It!
2009-01-31 11:43 . 2009-01-31 11:43 <REP> d-------- c:\program files\Trend Micro
2009-01-26 07:37 . 2009-01-26 07:37 <REP> d--h----- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-03 20:41 --------- d-----w c:\documents and settings\Rapior Sonia\Application Data\OpenOffice.org2
2009-02-03 11:51 --------- d-----w c:\documents and settings\All Users\Application Data\AntiVir PersonalEdition Classic
2009-01-14 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-23 13:44 --------- d-----w c:\program files\Google
2008-12-21 16:02 --------- d-----w c:\program files\Windows Live Safety Center
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
2008-01-01 14:08 32 -c--a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2007-12-25 12:31 5,843,256 ----a-w c:\program files\Firefox Setup 2.0.0.11.exe
2007-08-10 14:00 9,516,033 -c--a-w c:\program files\VLCplayer-0.8.6b-win32.exe
2007-07-29 11:44 114,896,847 -c--a-w c:\program files\Openoffice.exe
.

((((((((((((((((((((((((((((( snapshot@2009-02-02_15.30.45.84 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-02-03 19:34:29 9,510,912 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0/u0000001\NTUSER.DAT
+ 2009-02-03 19:34:29 311,296 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0/u0000002\UsrClass.dat
+ 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-02-03 19:34:28 9,510,912 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0/u0000001\NTUSER.DAT
+ 2009-02-03 19:34:28 311,296 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0/u0000002\UsrClass.dat
+ 2009-01-30 16:53:42 175,120 ----a-w c:\windows\pchealth\helpctr\Config\Cache\Personal_32_1036.dat
+ 2009-01-30 16:53:42 175,120 ----a-w c:\windows\pchealth\helpctr\Config\Cache\Personal_32_1036.dat.bak
- 2009-02-02 14:28:06 16,384 -c--a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-03 20:41:36 16,384 -c--a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-02-02 14:28:06 32,768 -c--a-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2009-02-03 20:41:36 32,768 -c--a-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2009-02-02 14:28:06 32,768 -c--a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-03 20:41:36 32,768 -c--a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-03 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-03-02 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-24 7311360]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-05-18 925696]
"avgnt"="c:\program files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AdobeVersionCue"="c:\program files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2004-03-25 1732608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

c:\documents and settings\Rapior Sonia\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.2.lnk - c:\program files\OpenOffice.org 2.2\program\quickstart.exe [2007-02-02 393216]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Assistant d'Acrobat.lnk - c:\program files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Documents and Settings\\Rapior Sonia\\Mes documents\\Ma musique\\eMule\\emule.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Internet Explorer\\iexplore.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

R1 as6eio;as6eio;c:\windows\system32\drivers\As6eio.sys [2007-08-15 3616]
R3 ovt530;Webcam Classic;c:\windows\system32\drivers\ov530vid.sys [2007-05-19 161792]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - TDSSserv.sys
.
.
------- Examen supplémentaire -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Télécharger avec &BitSpirit - c:\program files\BitSpirit\bsurl.htm
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-03 21:42:51
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSrfdc.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.­sys]
"imagepath"="\systemroot\system32\drivers\TDSSrfdc.sys"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\TDSSrfdc.sys"
"group"="file system"
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\nvsvc32.exe
c:\program files\OpenOffice.org 2.2\program\soffice.exe
c:\program files\OpenOffice.org 2.2\program\soffice.bin
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2009-02-03 21:44:22 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-02-03 20:44:17
ComboFix2.txt 2009-02-02 14:31:17

Avant-CF: 43 572 670 464 octets libres
Après-CF: 43,589,173,248 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect /usepmtimer

145 --- E O F --- 2009-01-14 20:35:28

......................................................................................

Rapport de MalwareByte's Anti-Malware :

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1721
Windows 5.1.2600 Service Pack 2

03/02/2009 22:21:36
mbam-log-2009-02-03 (22-21-36).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 110742
Temps écoulé: 21 minute(s), 49 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 36

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSkfkl.dll.vir (Trojan.TDSS) -> Delete on reboot.
C:\System Volume Information\_restore{B01DE736-32E8-4D93-AA4D-7AB34B66CEDC}\RP494\A0042233.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSkfkl.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSovba.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSStnyq.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSurkv.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\drivers\TDSSrfdc.sys (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\temp\TDSS7fbf.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS30da.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS35eb.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS4fcc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS5402.tmp (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\temp\TDSS5819.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS5d1a.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS61fc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS7772.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS7a31.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS7b79.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS7c83.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS7d00.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS7e38.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS7eb5.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS7ef4.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS8174.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS8193.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS831a.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS83f5.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS8618.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS8666.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS88e6.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS8bb5.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS8e07.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS91d0.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\TDSS9441.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSqomd.log (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSxnpb.dll (Rootkit.Agent) -> Delete on reboot.

........................................................................................................

Rapport de Antivir :

Avira AntiVir Personal
Report file date: mardi 3 février 2009 22:26

Scanning for 1311197 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: RAPIOR-4EA0D10B

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 17:42:46
AVSCAN.DLL : 8.1.4.0 40705 Bytes 18/07/2008 07:21:01
LUKE.DLL : 8.1.4.5 164097 Bytes 18/07/2008 07:21:01
LUKERES.DLL : 8.1.4.0 12033 Bytes 18/07/2008 07:21:01
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 18:18:32
ANTIVIR1.VDF : 7.1.1.113 2817536 Bytes 14/01/2009 10:18:00
ANTIVIR2.VDF : 7.1.1.207 1359360 Bytes 30/01/2009 11:52:36
ANTIVIR3.VDF : 7.1.1.219 134656 Bytes 03/02/2009 11:51:45
Engineversion : 8.2.0.71
AEVDF.DLL : 8.1.1.0 106868 Bytes 31/01/2009 11:52:53
AESCRIPT.DLL : 8.1.1.39 344443 Bytes 31/01/2009 11:52:51
AESCN.DLL : 8.1.1.6 127348 Bytes 31/01/2009 11:52:50
AERDL.DLL : 8.1.1.3 438645 Bytes 06/11/2008 18:10:01
AEPACK.DLL : 8.1.3.6 393589 Bytes 03/02/2009 11:51:46
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 12/12/2008 09:59:20
AEHEUR.DLL : 8.1.0.89 1569143 Bytes 31/01/2009 11:52:49
AEHELP.DLL : 8.1.2.0 119159 Bytes 19/11/2008 09:45:45
AEGEN.DLL : 8.1.1.12 328053 Bytes 31/01/2009 11:52:41
AEEMU.DLL : 8.1.0.9 393588 Bytes 16/10/2008 13:28:47
AECORE.DLL : 8.1.6.4 176501 Bytes 03/02/2009 11:51:45
AEBB.DLL : 8.1.0.3 53618 Bytes 16/10/2008 13:28:46
AVWINLL.DLL : 1.0.0.12 15105 Bytes 18/07/2008 07:21:01
AVPREF.DLL : 8.0.2.0 38657 Bytes 18/07/2008 07:21:01
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 14:56:42
AVREG.DLL : 8.0.0.1 33537 Bytes 18/07/2008 07:21:01
AVARKT.DLL : 1.0.0.23 307457 Bytes 14/04/2008 15:39:49
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 18/07/2008 07:21:01
SQLITE3.DLL : 3.3.17.1 339968 Bytes 14/04/2008 15:39:50
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 18/07/2008 07:21:02
NETNT.DLL : 8.0.0.1 7937 Bytes 14/04/2008 15:39:50
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 18/07/2008 07:21:00
RCTEXT.DLL : 8.0.52.0 86273 Bytes 18/07/2008 07:21:00

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 3 février 2009 22:26

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'acrotray.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'VersionCueTray.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'smax4pnp.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
36 processes with 36 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '51' files ).

Starting the file scan:

Begin scan in 'C:\' <SYSTEM>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Rapior Sonia\Bureau\SDFix\backups\catchme.zip
[0] Archive type: ZIP
--> TDSSkfkl.dll
[DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.JW back-door program
--> TDSSurkv.dll
[DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.adb back-door program
--> TDSSovba.dll
[DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.acs back-door program
--> TDSStnyq.dll
[DETECTION] Is the TR/TDss.AT.518 Trojan
[NOTE] The file was deleted!
C:\Documents and Settings\Rapior Sonia\Local Settings\Temp\TDSS3fc7.tmp
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\Documents and Settings\Rapior Sonia\Local Settings\Temp\TDSS3fe6.tmp
[DETECTION] Is the TR/Patched.CK.56 Trojan
[NOTE] The file was deleted!
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\tdssserv.sys.vir
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was deleted!
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\__.zip
[0] Archive type: ZIP
--> tdssserv.sys
[DETECTION] Is the TR/Rootkit.Gen Trojan
--> tdssserv.sys.1
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{B01DE736-32E8-4D93-AA4D-7AB34B66CEDC}\RP494\A0041233.sys
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{B01DE736-32E8-4D93-AA4D-7AB34B66CEDC}\RP494\A0043237.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{B01DE736-32E8-4D93-AA4D-7AB34B66CEDC}\RP494\A0043238.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{B01DE736-32E8-4D93-AA4D-7AB34B66CEDC}\RP494\A0043239.sys
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{B01DE736-32E8-4D93-AA4D-7AB34B66CEDC}\RP494\A0043240.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{B01DE736-32E8-4D93-AA4D-7AB34B66CEDC}\RP494\A0043241.dll
[DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.adb back-door program
[NOTE] The file was deleted!
Begin scan in 'D:\' <DATA>

End of the scan: mardi 3 février 2009 22:47
Used time: 21:33 Minute(s)

The scan has been done completely.

6942 Scanning directories
292935 Files were scanned
15 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
11 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
292919 Files not concerned
2270 Archives were scanned
1 Warnings
11 Notes

.....................................................................

ok jlpjlp......je vois que je t'ai hypnotisé par ma naïveté..... !

bon....
il semble que tout ne soit pas nettoyé d'après le rapport antivir qui me donne 15 infections et n'en a supprimé que 11....
mais well...
je peux à nouveau naviguer pourvu que ça dure...car......
ces infections ne sont elles pas récurrentes si tout n'est pas éradiqué???
par propagations, par exemple?

en tous cas merci de ta patience, (celle qui me fait défaut)
je te donne des nouvelles demain en attendant des tiennes

So

@stoopidahello again....

la machine s'allume bien, le navigateur fonctionne bien
tout semble être rentré dans l'ordre

(qu'en est il des 4 fichiers non supprimés par Antivir???)

anyway...je ne sais comment je peux te remercier
des fleurs? des chocolats? des antivirus en spray?
vraiment...MERCI

Sonia

ai relancé...
malwarebyte a été chargé avec succès et updaté...il scanne en ce moment mon disque C:

(on est chez moi, l'ordi de mon ami en wifi sur le mien) car mon ordi n'est pas un portable.....

tu fais si impossible tu ne la mets pas et tu lance la procedure

@jlpjlpconsole de réparation installée avec succès

combofix a continué son travail...a redémarré...et maintenant, j'ai l"écran noir avec pointeur de la souris......

dois je éteindre et relancer? car en général, ça reste bloqué là.....

euh...combofix....tu me remémores où c'est....please........?

je veux dire, c'est par ex. dans un truc comme otmovelt....

(excuse ma naiveté, hein....ça doit etre enervant....)

hello
voici le rapport de SDfix ci dessous
mais je n'arrive toujours pas à naviguer avec IE....
je t'écris depuis l'ordi d'un ami et on a mis le rapport sur une clé usb

(F5 était la bonne touche pour le mode sans echec)

[b]SDFix: Version 1.240 [/b]
Run by Rapior Sonia on 03/02/2009 at 20:42

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\RAPIOR~1\Bureau\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\system32\TDSSurkv.dll - Deleted
C:\WINDOWS\system32\TDSSovba.dll - Deleted
C:\WINDOWS\system32\TDSStnyq.dll - Deleted
C:\WINDOWS\system32\TDSSxnpb.dll - Deleted
C:\WINDOWS\system32\TDSSbeat.dat - Deleted
C:\WINDOWS\system32\TDSSqomd.log - Deleted

Could Not Remove C:\WINDOWS\system32\TDSSkfkl.dll

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-03 20:48:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

disk error: C:\WINDOWS\system32\config\system, 0
scanning hidden registry entries ...

disk error: C:\WINDOWS\system32\config\software, 0
disk error: C:\Documents and Settings\Rapior Sonia\ntuser.dat, 0
scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Documents and Settings\\Rapior Sonia\\Mes documents\\Ma musique\\eMule\\emule.exe"="C:\\Documents and Settings\\Rapior Sonia\\Mes documents\\Ma musique\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:

C:\WINDOWS\system32\TDSSkfkl.dll Found

File Backups: - C:\DOCUME~1\RAPIOR~1\Bureau\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Sat 15 Nov 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 18 May 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]

@stoopidaet aussi...
je trouve étrange que la fenetre windows apparaisse 2 fois lors du démarrage de l'ordi (jauge de chargement + icone windows)