Mon pc n'avance plus :(( !!! VIRUS!!!!

morgan24 -  
Bonjour,

Depuis plusieurs semaines, mon pc n'avance plus du tout, j'ai parfois mon UC à 100 %, ça ressemble bien à un voir plusieurs virus.

J'ai déjà Avria antivirus.

Quelqu'un pour m'aider ?
Configuration: Windows XP
Firefox 3.0.13

33 réponses

Résumé de la discussion

Un utilisateur signale un PC Windows XP extrêmement lent avec une utilisation CPU proche de 100 %, suspectant une infection virale malgré l'antivirus Avira. Les réponses préconisent des outils de diagnostic et de nettoyage comme USBfix et RSIT pour générer des rapports, puis Malwarebytes Anti-Malware pour identifier et supprimer les éléments malveillants. D'autres étapes impliquent d'interpréter ces rapports, d'effectuer la suppression avec USBfix en mode français puis de poursuivre avec MBAM, en partageant le contenu des fichiers rapport dans le fil. En dernier, certaines interventions soulignent qu'il vaut mieux comprendre l'origine du problème et sauvegarder les données avant une éventuelle réinstallation plutôt que de recourir immédiatement à un formatage.

Bobot (l’IA à votre service)
  1. Xplode Contributeur sécurité
    J'en pense qu'on a du boulot ! Commence par ceci :

    USBfix ------>

    [x] Télécharge USBfix à cette adresse : http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe

    [x] Un tutoriel est disponible ici : https://www.malekal.com/usbfix-supprimer-virus-usb/

    [x] Installe le

    [x] Branche tout tes médias amovibles ( clés USB, DD externe )

    [x] Lance USBfix en cliquant sur l'icône qui est sur ton bureau

    [x] Choisis l'option F ( pour français ) puis clique sur entrée.

    [x] Au menu principal, choisi l'option 1

    [x] Laisse l'outil travailler puis poste le rapport dans ton prochain message
    1. morgan24 Auteur
      Bonjour, excusez moi de vous relancer, mais que pensez vous des résultats du scan ?
      Cdlt
      1. morgan24 Auteur
        Pas de prob, c'est déjà super sympa de votre part de m'aider. Voici le rapport :

        Infections :
        ==========

        ¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

        "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
        "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
        "C:\WINDOWS\system32\drivers\ch7xxnt5.dll"
        "C:\WINDOWS\system32\sfcfiles.dll"

        ¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

        HKLM\Software\Microsoft\Windows\CurrentVersion\Run "msconfig"

        ¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

        AVWSC.EXE-21D2C1ED.pf
        Layout.ini
        NTOSBOOT-B00DFAAD.pf
        REG.EXE-07FA5B3F.pf

        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

        Kill'em by g3n-h@ckm@n 1.0.3.0

        updated on 03.09.2009 ::::: 0.25

        Microsoft Windows XP [version 5.1.2600]

        03/09/2009 17:18:28,48

        Fichiers analysés :
        =================

        ¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

        "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
        "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
        "C:\WINDOWS\jautoexp.dat"
        "C:\WINDOWS\system32\drivers\ch7xxnt5.dll"
        "C:\WINDOWS\system32\prntvpt.dll"
        C:\WINDOWS\System32\SET6D.tmp
        C:\WINDOWS\System32\SET6F.tmp
        C:\WINDOWS\System32\SET73.tmp
        C:\WINDOWS\System32\SET7B.tmp
        C:\WINDOWS\System32\SETBE.tmp
        "C:\WINDOWS\system32\sfcfiles.dll"
        C:\Documents and Settings\Societe buro\LOCAL Settings\Temp\wlsetup-cvr.exe

        ¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers :

        Quarantaine :

        ch7xxnt5.dll.Kill'em
        jautoexp.dat.Kill'em
        prntvpt.dll.Kill'em
        SET6D.tmp.Kill'em
        SET6F.tmp.Kill'em
        SET73.tmp.Kill'em
        SET7B.tmp.Kill'em
        SETBE.tmp.Kill'em
        sfcfiles.dll.Kill'em
        wlsetup-cvr.exe.Kill'em

        ¤¤¤¤¤¤¤¤¤¤ Verification :

        Infections :
        ==========

        ¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

        "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
        "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
        "C:\WINDOWS\system32\drivers\ch7xxnt5.dll"
        "C:\WINDOWS\system32\sfcfiles.dll"

        ¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

        HKLM\Software\Microsoft\Windows\CurrentVersion\Run "msconfig"

        ¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

        AVWSC.EXE-21D2C1ED.pf
        Layout.ini
        NTOSBOOT-B00DFAAD.pf
        REG.EXE-07FA5B3F.pf

        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
        1. Xplode Contributeur sécurité
          Salut, désolé pour la réponse tardive mais avec la rentrée c'est dur lol

          Relance list&kill'em avec l'option n°2 et copie/colle le rapport dans ton prochain message
          1. morgan24 Auteur
            Bonjour, vous m'avez beaucoup aidé, je vous remercie, parc contre à votre avis, est ce qu'il reste à faire quelque chose car je trouve que mon ordi rame encore.
            Vous remerciant
            Cdlt
        4. morgan24 Auteur
          Ok, voici le résultat. Merci encore pour votre aide :

          List'em by g3n-h@ckm@n 1.0.2.9

          updated on 01.09.2009 ::::: 12.00

          Microsoft Windows XP [version 5.1.2600]

          02/09/2009 17:44:30,82

          Infections :
          ==========

          ¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

          "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
          "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
          "C:\WINDOWS\jautoexp.dat"
          "C:\WINDOWS\system32\prntvpt.dll"
          C:\WINDOWS\System32\SET6D.tmp
          C:\WINDOWS\System32\SET6F.tmp
          C:\WINDOWS\System32\SET73.tmp
          C:\WINDOWS\System32\SET7B.tmp
          C:\WINDOWS\System32\SETBE.tmp
          C:\Documents and Settings\Societe buro\LOCAL Settings\Temp\wlsetup-cvr.exe

          ¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

          HKLM\Software\Microsoft\Windows\CurrentVersion\Run "msconfig"

          ¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

          ACRORD32.EXE-01080F7C.pf
          ADOBEUPDATER.EXE-27F5105F.pf
          ALG.EXE-275708CF.pf
          ATTRIB.EXE-15ACDFFE.pf
          AVCENTER.EXE-05983540.pf
          AVCONFIG.EXE-0164DD33.pf
          AVGNT.EXE-08C8F6E1.pf
          AVNOTIFY.EXE-1A41E508.pf
          AVSCAN.EXE-0A98540D.pf
          AVWSC.EXE-21D2C1ED.pf
          CLEANMGR.EXE-31B430FE.pf
          CLVIEW.EXE-174D6B5B.pf
          CMD.EXE-034B0549.pf
          CSCRIPT.EXE-0A13A05C.pf
          CTFMON.EXE-05E57A5E.pf
          DEFRAG.EXE-2858C7E2.pf
          DFRGNTFS.EXE-38C3807C.pf
          DRWTSN32.EXE-01DDCF15.pf
          ECHOX.EXE-1FCE4B11.pf
          EXCEL.EXE-1FF53647.pf
          FIND.EXE-0EEAD1A7.pf
          FIREFOX.EXE-06188867.pf
          GOOGLETALK.EXE-1BCE1B4A.pf
          GOOGLEUPDATE.EXE-059A9F9A.pf
          GUARDGUI.EXE-2C1384C2.pf
          HELPER.EXE-0324EC74.pf
          HELPSVC.EXE-1C192440.pf
          HOTFIXINSTALLER.EXE-21A87DEA.pf
          IEXPLORE.EXE-2D97EBE6.pf
          IMAPI.EXE-201490BB.pf
          IPCONFIG.EXE-05D7908C.pf
          Layout.ini
          LIST_KILLEM.EXE-14B521D3.pf
          LOGON.SCR-24ADF392.pf
          LOGONUI.EXE-312BE1BF.pf
          MBAM-DOR.EXE-0C3D2F85.pf
          MBAM-SETUP(2).EXE-09251327.pf
          MBAM-SETUP(2).TMP-12F28981.pf
          MBAM-SETUP.EXE-39E1D845.pf
          MBAM-SETUP.TMP-0730BA3D.pf
          MBAM-SETUP.TMP-0767090C.pf
          MBAM-SETUP.TMP-39F36834.pf
          MBAM.EXE-0D37CDF0.pf
          MBAMGUI.EXE-17BFFE8F.pf
          MINIDIR.EXE-0E1164BC.pf
          MINIIMA.EXE-2E854C3E.pf
          MODE.COM-318FFE37.pf
          MSCONFIG.EXE-1EF1EA0F.pf
          MSCORSVW.EXE-310BC412.pf
          MSIEXEC.EXE-330626DC.pf
          MSIMN.EXE-183B59AF.pf
          MSMSGS.EXE-0620E8B3.pf
          MSNMSGR.EXE-0EBDBC56.pf
          MSPAINT.EXE-146E0237.pf
          NDP35SP1-KB963707-X86.EXE-143DA529.pf
          NGEN.EXE-20BDC4FB.pf
          NOTEPAD.EXE-2F2D61E1.pf
          NTOSBOOT-B00DFAAD.pf
          NTVDM.EXE-0A81AB7B.pf
          OFFLB.EXE-21E94D32.pf
          PATCH.EXE-38DD8219.pf
          POWERPNT.EXE-2F92D967.pf
          PREUPD.EXE-16574861.pf
          REG.EXE-07FA5B3F.pf
          REGEDIT.EXE-2AE3423E.pf
          REGSVR32.EXE-396DEA2C.pf
          RSIT(2).EXE-224C9505.pf
          RUNDLL32.EXE-3B23C10C.pf
          RUNDLL32.EXE-3CF2FCD3.pf
          RUNDLL32.EXE-3D479208.pf
          RUNDLL32.EXE-3DB1870D.pf
          RUNDLL32.EXE-3EF38E9E.pf
          RUNDLL32.EXE-3FEDBBA7.pf
          RUNDLL32.EXE-4035FFC9.pf
          RUNDLL32.EXE-40A01710.pf
          RUNDLL32.EXE-44BDA2F2.pf
          RUNDLL32.EXE-48C471EC.pf
          RUNDLL32.EXE-4B81F958.pf
          RUNDLL32.EXE-4C48A33F.pf
          RUNDLL32.EXE-4E9C8C9E.pf
          RUNDLL32.EXE-506698F4.pf
          RUNDLL32.EXE-52264C45.pf
          RUNDLL32.EXE-55AA0896.pf
          RUNDLL32.EXE-59F0F264.pf
          RUNDLL32.EXE-59F775E8.pf
          RUNDLL32.EXE-5D74AEB5.pf
          RUNDLL32.EXE-63224E60.pf
          RUNDLL32.EXE-641901A2.pf
          RUNDLL32.EXE-6669D9F7.pf
          RUNDLL32.EXE-670791A5.pf
          RUNDLL32.EXE-6ADD5808.pf
          RUNDLL32.EXE-6C7C44CC.pf
          RUNDLL32.EXE-6DDA791B.pf
          RUNDLL32.EXE-6DF739B2.pf
          RUNDLL32.EXE-6E8D4657.pf
          RUNDLL32.EXE-6F2441D6.pf
          RUNDLL32.EXE-6FADD0B3.pf
          RUNDLL32.EXE-72A7FE27.pf
          RUNDLL32.EXE-753F1DF3.pf
          RUNDLL32.EXE-75E8983C.pf
          SETPATH.EXE-280CF3BE.pf
          SETUP_WM.EXE-02751BCA.pf
          SKYPENAMES.EXE-150E8F7C.pf
          SOCIETE buro.EXE-11F48D35.pf
          SWREG.EXE-33A4ADA3.pf
          TASKMGR.EXE-06144C13.pf
          UNINS000.EXE-17225EDF.pf
          UNINSTALLER.EXE-33F07D58.pf
          UPDATE.EXE-380C6CAC.pf
          UPDATE.EXE-3A14C2CB.pf
          UPDATER.EXE-29A0FB08.pf
          USNSVC.EXE-05B86444.pf
          VLC.EXE-02F29DFD.pf
          WEBEDITOR.EXE-07A6368F.pf
          WINRAR.EXE-0AA31BB9.pf
          WINWORD.EXE-15ED065E.pf
          WMIAPSRV.EXE-02740A4B.pf
          WMIPRVSE.EXE-0D449B4F.pf
          WMPLAYER.EXE-1ACCF80B.pf
          WMPLAYER.EXE-1ACCF80D.pf
          WSCNTFY.EXE-0B14C27D.pf
          WUAUCLT.EXE-1360D60A.pf
          XCOPY.EXE-3AC22479.pf
          YAHOOMESSENGER.EXE-3AEC6C9B.pf
          YMSGR_TRAY.EXE-1ED50356.pf
          YUPDATER.EXE-1A952531.pf
          _IU14D2N.TMP-29732E13.pf

          ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
          1. Xplode Contributeur sécurité
            Salut, fais ceci :

            List&Kill'em ---->

            [x] Télécharge List&Kill'em (par Gen-Hackman) sur ton bureau à cette adresse : http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem.exe

            /!\ Désactive tes protections le temps de la manip' ( Antivirus, Pare-Feu ) /!\

            /!\ Déconnecte internet et ferme toutes tes applications en cours /!\

            [x] Lance le en double cliquant dessus ( Si tu es sous Vista -> Clique droit -> " Exécuter en tant qu'administrateur " )

            [x] Choisis l'option F ( pour français ) et valide par "entrée".

            [x] Choisis ensuite l'option 1 ( Recherche )

            [x] Ne fais rien pendant le scan

            [x] Copie/Colle le rapport qui s'ouvrira dans ton prochain message
            1. morgan24 Auteur
              Bonjour,

              Ca vous semble bon, que dois je faire de plus ?

              Merci encore pour votre aide

              Cdlt
              1. morgan24 Auteur
                le voila :

                Logfile of random's system information tool 1.06 (written by random/random)
                Run by Societe buro at 2009-08-31 16:41:22
                Microsoft Windows XP Édition familiale Service Pack 2
                System drive C: has 53 GB (70%) free of 76 GB
                Total RAM: 255 MB (14% free)

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 16:42:14, on 31/08/2009
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16876)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\Explorer.EXE
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                C:\Program Files\Messenger\msmsgs.exe
                C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
                C:\WINDOWS\system32\ntvdm.exe
                C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\System32\wbem\wmiapsrv.exe
                C:\WINDOWS\system32\wuauclt.exe
                C:\Program Files\Windows Live\Messenger\usnsvc.exe
                C:\Program Files\Google\Google Talk\googletalk.exe
                C:\Program Files\Mozilla Firefox\firefox.exe
                C:\Program Files\Outlook Express\msimn.exe
                C:\Program Files\Namo\WebEditor 6 Trial\bin\WebEditor.exe
                C:\Documents and Settings\Societe buro\Bureau\RSIT(2).exe
                C:\Program Files\trend micro\Societe buro.exe

                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
                O4 - HKLM\..\Run: [yt8a] C:\WINDOWS\system32\yt8a.exe
                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
                O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
                O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
                O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
                O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
                O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                O20 - AppInit_DLLs: craoe.dll delnice.dll meyotme.dll comboaus.dll mirwznt.dll svtepps.dll lensch.dll rexljeh.dll cmbdaf.dll wonlins.dll thermnc.dll fliecods.dll,HBASKTAO.dll zesttns.dll qanhllao.dll woodken.dll lenyuns.dll xsisco.dll kandawf.dll,HBmhly.dll zongxim.dll kodens.dll docyanx.dll xuntxn.dll ×ÀÝÉÏÀÍ‹ÁÉÉ cenvta.dll ÝÖÌÖÆÊ‹ÁÉÉ qensng.dll cenbezn.dll,HBJXSJ.dll tobaoup.dll
                O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                O23 - Service: B3E3A48D - Unknown owner - C:\WINDOWS\system32\AEB5947B.EXE (file missing)
                O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                1. Xplode Contributeur sécurité
                  Ok ! Peux tu reposter un rapport RSIT comme je t'ai demandé au tout début pour voir ou on en ai. y'a surement encore du ménage à faire.
                  1. morgan24 Auteur
                    ok le voilà, pour info mon pc avance un peu plus vite mais rame qd même encore. Bon c'est vrai aussi que c'est un vieux pc

                    Malwarebytes' Anti-Malware 1.40
                    Version de la base de données: 2706
                    Windows 5.1.2600 Service Pack 2

                    29/08/2009 04:38:57
                    mbam-log-2009-08-29 (04-38-57).txt

                    Type de recherche: Examen complet (C:\|F:\|G:\|)
                    Eléments examinés: 231211
                    Temps écoulé: 5 hour(s), 11 minute(s), 2 second(s)

                    Processus mémoire infecté(s): 0
                    Module(s) mémoire infecté(s): 0
                    Clé(s) du Registre infectée(s): 133
                    Valeur(s) du Registre infectée(s): 22
                    Elément(s) de données du Registre infecté(s): 0
                    Dossier(s) infecté(s): 0
                    Fichier(s) infecté(s): 1

                    Processus mémoire infecté(s):
                    (Aucun élément nuisible détecté)

                    Module(s) mémoire infecté(s):
                    (Aucun élément nuisible détecté)

                    Clé(s) du Registre infectée(s):
                    HKEY_CLASSES_ROOT\CLSID\{3fdeb171-8f86-0003-0001-69b8db553683} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{3fdeb171-8f86-0004-0001-69b8db553683} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{f0930a2f-d971-4828-8209-b7dfd266ed44} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{71a78cd4-e470-4a18-8457-e0e0283dd507} (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{9e8287b0-0f3a-48ae-99c5-a6e0aac36bc5} (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hbkernel32 (Backdoor.Bot) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\hbkernel32 (Backdoor.Bot) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hbkernel32 (Backdoor.Bot) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antiarp.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arvmon.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoGuarder.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ÐÞ¸´¹¤¾ß.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\findt2005.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icesword.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IsHelp.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KavStart.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killhidepid.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.COM (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.KXP (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavCopy.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStore.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravt08.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwolusr.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsTray.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartassistant.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngPS.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syscheck.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Syscheck2.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ToolsUp.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tqat.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe (Security.Hijack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\msfpfis64 (Spyware.OnlineGames) -> Quarantined and deleted successfully.

                    Valeur(s) du Registre infectée(s):
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{3fdeb171-8f86-0003-0001-69b8db553683} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{3fdeb171-8f86-0004-0001-69b8db553683} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{f0930a2f-d971-4828-8209-b7dfd266ed44} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{71a78cd4-e470-4a18-8457-e0e0283dd507} (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{9e8287b0-0f3a-48ae-99c5-a6e0aac36bc5} (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ymulljdo.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\bwoqeknz.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ufcyeavx.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\mpesxzsp.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\chrjevyq.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\fgqeplfk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ijkjhlyu.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\toptxjsr.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\kyccwfys.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdwg32 (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdog32 (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdsg32 (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdmg32 (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdhg32 (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdqg32 (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdcg32 (Spyware.OnlineGames) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HBService32 (Trojan.Agent) -> Quarantined and deleted successfully.

                    Elément(s) de données du Registre infecté(s):
                    (Aucun élément nuisible détecté)

                    Dossier(s) infecté(s):
                    (Aucun élément nuisible détecté)

                    Fichier(s) infecté(s):
                    C:\WINDOWS\system32\drivers\HBKernel32.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
                    1. Xplode Contributeur sécurité
                      Salut, le rapport se trouve dans la partie " Rapports/Logs " de malwarebyte's ( Copie/Colle le rapport le plus récent )
                      1. morgan24 Auteur
                        Bonjour,
                        Donc j'ai rescané le pc avec Malwarebytes' Anti-Malware et j'ai supprimé ts les virus, sauf que maintenant je n'ai plus le rapport d'analyse !
                        Nannnn il ne faut pas que je le rescan encore, ça me bloque le pc pendans 6h :(((((
                        1. Xplode Contributeur sécurité
                          Tu as oublié de faire ceci :

                          [x] Coche bien tout les éléments trouvés et supprime les !

                          [x] Tu seras peut être amené à redémarrer ton PC, fait le.

                          ( Pour la petite touche d'humour, tu détiens le record du nombre d'élément infectés trouvés par MBAM que j'aie pu voir ^^' )
                          1. Krapsman
                            J'avoue pas mal du tout!!!!!

                            Mais j'ai déjà vu 235 infections sur un rapport MBAM :)))

                            Ca a bien soulagé l'ordi!

                            Il est vraiment bien cet outil, quoiqu'à compléter parfois avec d'autres (Navipromo, ...)

                            Bonne continuation!
                          2. Frederic76
                            @Krapsmanvi mais pas pour les debutants sauf si aidés et vraiment à manier avec des pincettes
                          3. Krapsman
                            @Frederic76Pas du tout, lol,

                            MBAM est conseillé pour tout le monde, c'est bien de le passer une fois par mois à une fois par semaine suivant son utilisation d'internet...
                        2. morgan24 Auteur
                          Bonjour, voici le rapport :

                          Malwarebytes' Anti-Malware 1.40
                          Version de la base de données: 2706
                          Windows 5.1.2600 Service Pack 2

                          28/08/2009 03:15:55
                          mbam-log-2009-08-28 (03-15-29).txt

                          Type de recherche: Examen complet (C:\|F:\|G:\|)
                          Eléments examinés: 231136
                          Temps écoulé: 5 hour(s), 16 minute(s), 38 second(s)

                          Processus mémoire infecté(s): 0
                          Module(s) mémoire infecté(s): 0
                          Clé(s) du Registre infectée(s): 133
                          Valeur(s) du Registre infectée(s): 22
                          Elément(s) de données du Registre infecté(s): 0
                          Dossier(s) infecté(s): 0
                          Fichier(s) infecté(s): 1

                          Processus mémoire infecté(s):
                          (Aucun élément nuisible détecté)

                          Module(s) mémoire infecté(s):
                          (Aucun élément nuisible détecté)

                          Clé(s) du Registre infectée(s):
                          HKEY_CLASSES_ROOT\CLSID\{3fdeb171-8f86-0003-0001-69b8db553683} (Spyware.OnlineGames) -> No action taken.
                          HKEY_CLASSES_ROOT\CLSID\{3fdeb171-8f86-0004-0001-69b8db553683} (Spyware.OnlineGames) -> No action taken.
                          HKEY_CLASSES_ROOT\CLSID\{f0930a2f-d971-4828-8209-b7dfd266ed44} (Spyware.OnlineGames) -> No action taken.
                          HKEY_CLASSES_ROOT\CLSID\{71a78cd4-e470-4a18-8457-e0e0283dd507} (Trojan.Agent) -> No action taken.
                          HKEY_CLASSES_ROOT\CLSID\{9e8287b0-0f3a-48ae-99c5-a6e0aac36bc5} (Trojan.Agent) -> No action taken.
                          HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hbkernel32 (Backdoor.Bot) -> No action taken.
                          HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\hbkernel32 (Backdoor.Bot) -> No action taken.
                          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hbkernel32 (Backdoor.Bot) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antiarp.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arvmon.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoGuarder.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ÐÞ¸´¹¤¾ß.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\findt2005.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icesword.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IsHelp.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KavStart.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killhidepid.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.COM (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.KXP (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavCopy.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStore.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravt08.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwolusr.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsTray.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartassistant.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngPS.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syscheck.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Syscheck2.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ToolsUp.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tqat.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe (Security.Hijack) -> No action taken.
                          HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\msfpfis64 (Spyware.OnlineGames) -> No action taken.

                          Valeur(s) du Registre infectée(s):
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{3fdeb171-8f86-0003-0001-69b8db553683} (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{3fdeb171-8f86-0004-0001-69b8db553683} (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{f0930a2f-d971-4828-8209-b7dfd266ed44} (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{71a78cd4-e470-4a18-8457-e0e0283dd507} (Trojan.Agent) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{9e8287b0-0f3a-48ae-99c5-a6e0aac36bc5} (Trojan.Agent) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ymulljdo.dll (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\bwoqeknz.dll (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ufcyeavx.dll (Trojan.Agent) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\mpesxzsp.dll (Trojan.Agent) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\chrjevyq.dll (Trojan.Agent) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\fgqeplfk.dll (Trojan.Agent) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ijkjhlyu.dll (Trojan.Agent) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\toptxjsr.dll (Trojan.Agent) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\kyccwfys.dll (Trojan.Agent) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdwg32 (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdog32 (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdsg32 (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdmg32 (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdhg32 (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdqg32 (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msdcg32 (Spyware.OnlineGames) -> No action taken.
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HBService32 (Trojan.Agent) -> No action taken.

                          Elément(s) de données du Registre infecté(s):
                          (Aucun élément nuisible détecté)

                          Dossier(s) infecté(s):
                          (Aucun élément nuisible détecté)

                          Fichier(s) infecté(s):
                          C:\WINDOWS\system32\drivers\HBKernel32.sys (Backdoor.Bot) -> No action taken.
                          1. Xplode Contributeur sécurité
                            Malwarebyte's anti-malware ----->

                            [x] Télécharge Malwarebyte's anti-malware (MBAM) à cette adresse : http://www.malwarebytes.org/mbam/program/mbam-setup.exe

                            [x] Installe le

                            [x] Un tutoriel pour son utilisation est disponible ici : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

                            [x] A la fin du scan n'oublie pas de tout cocher puis -> Supprimer la séléction

                            [x] Suis les indications données sur le lien précédent puis copie/colle le rapport généré dans ton prochain message
                            1. morgan24 Auteur
                              ok voila le rapport :

                              Logfile of random's system information tool 1.06 (written by random/random)
                              Run by Societe buro at 2009-08-27 11:16:48
                              Microsoft Windows XP Édition familiale Service Pack 2
                              System drive C: has 54 GB (70%) free of 76 GB
                              Total RAM: 255 MB (6% free)

                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 11:17:11, on 27/08/2009
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v7.00 (7.00.6000.16876)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                              C:\Program Files\Messenger\msmsgs.exe
                              C:\WINDOWS\system32\ntvdm.exe
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\Program Files\Google\Google Talk\googletalk.exe
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                              C:\Program Files\Mozilla Firefox\firefox.exe
                              C:\WINDOWS\system32\wscntfy.exe
                              C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
                              C:\Program Files\Windows Live\Messenger\usnsvc.exe
                              C:\Program Files\Outlook Express\msimn.exe
                              C:\Documents and Settings\Societe buro\Bureau\RSIT(2).exe
                              C:\Program Files\trend micro\Societe buro.exe

                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                              O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O4 - HKLM\..\Run: [HBService32] System.exe
                              O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
                              O4 - HKLM\..\Run: [yt8a] C:\WINDOWS\system32\yt8a.exe
                              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                              O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
                              O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                              O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
                              O4 - HKLM\..\Policies\Explorer\Run: [MSDWG32] LYLoadbr.exe
                              O4 - HKLM\..\Policies\Explorer\Run: [MSDCG32 ] LYLeador.exe
                              O4 - HKLM\..\Policies\Explorer\Run: [MSDOG32] LYLoador.exe
                              O4 - HKLM\..\Policies\Explorer\Run: [MSDSG32] LYLoadar.exe
                              O4 - HKLM\..\Policies\Explorer\Run: [MSDMG32] LYLoadmr.exe
                              O4 - HKLM\..\Policies\Explorer\Run: [MSDHG32] LYLoadhr.exe
                              O4 - HKLM\..\Policies\Explorer\Run: [MSDQG32] LYLoadqr.exe
                              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                              O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                              O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
                              O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
                              O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
                              O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
                              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                              O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                              O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
                              O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                              O20 - AppInit_DLLs: craoe.dll delnice.dll meyotme.dll comboaus.dll mirwznt.dll svtepps.dll lensch.dll rexljeh.dll cmbdaf.dll wonlins.dll thermnc.dll fliecods.dll,HBASKTAO.dll zesttns.dll qanhllao.dll woodken.dll lenyuns.dll xsisco.dll kandawf.dll,HBmhly.dll zongxim.dll kodens.dll docyanx.dll xuntxn.dll ×ÀÝÉÏÀÍ‹ÁÉÉ cenvta.dll ÝÖÌÖÆÊ‹ÁÉÉ qensng.dll cenbezn.dll,HBJXSJ.dll tobaoup.dll
                              O21 - SSODL: ufcyeavx.dll - {71A78CD4-E470-4a18-8457-E0E0283DD507} - C:\WINDOWS\system32\chrjevyq.dll (file missing)
                              O21 - SSODL: ymulljdo.dll - {F0930A2F-D971-4828-8209-B7DFD266ED44} - C:\WINDOWS\system32\bwoqeknz.dll (file missing)
                              O21 - SSODL: bwoqeknz.dll - {F0930A2F-D971-4828-8209-B7DFD266ED44} - C:\WINDOWS\system32\bwoqeknz.dll (file missing)
                              O21 - SSODL: fgqeplfk.dll - {9E8287B0-0F3A-48ae-99C5-A6E0AAC36BC5} - C:\WINDOWS\system32\kyccwfys.dll (file missing)
                              O21 - SSODL: ijkjhlyu.dll - {9E8287B0-0F3A-48ae-99C5-A6E0AAC36BC5} - C:\WINDOWS\system32\kyccwfys.dll (file missing)
                              O21 - SSODL: mpesxzsp.dll - {71A78CD4-E470-4a18-8457-E0E0283DD507} - C:\WINDOWS\system32\chrjevyq.dll (file missing)
                              O21 - SSODL: chrjevyq.dll - {71A78CD4-E470-4a18-8457-E0E0283DD507} - C:\WINDOWS\system32\chrjevyq.dll (file missing)
                              O21 - SSODL: toptxjsr.dll - {9E8287B0-0F3A-48ae-99C5-A6E0AAC36BC5} - C:\WINDOWS\system32\kyccwfys.dll (file missing)
                              O21 - SSODL: kyccwfys.dll - {9E8287B0-0F3A-48ae-99C5-A6E0AAC36BC5} - C:\WINDOWS\system32\kyccwfys.dll (file missing)
                              O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                              O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                              O23 - Service: B3E3A48D - Unknown owner - C:\WINDOWS\system32\AEB5947B.EXE (file missing)
                              O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                              1. Xplode Contributeur sécurité
                                Ok ils étaient dans la restauration système, on la purgera après.

                                Peux-tu me refaire un rapport RSIT s'il te plait ? ( Tu n'auras que le log.txt normalement )
                                1. Krapsman
                                  Recherche de Rootkits............: arrêt

                                  -> A activer pour la confiuration Antivir
                              2. morgan24 Auteur
                                Bonjour, voici le scan, il a fallu quelques heures :

                                Avira AntiVir Personal
                                Date de création du fichier de rapport : mercredi 26 août 2009 17:35

                                La recherche porte sur 1662186 souches de virus.

                                Détenteur de la licence :Avira AntiVir Personal - FREE Antivirus
                                Numéro de série : 0000149996-ADJIE-0000001
                                Plateforme : Windows XP
                                Version de Windows :(Service Pack 2) [5.1.2600]
                                Mode Boot : Démarré normalement
                                Identifiant : SYSTEM
                                Nom de l'ordinateur :BUREAU

                                Informations de version :
                                BUILD.DAT : 8.2.0.61 17752 Bytes 25/05/2009 13:47:00
                                AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:00
                                AVSCAN.DLL : 8.1.4.1 49921 Bytes 21/07/2008 13:44:27
                                LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:16
                                LUKERES.DLL : 8.1.4.0 13057 Bytes 04/07/2008 07:30:27
                                ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
                                ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 24/06/2009 07:49:25
                                ANTIVIR2.VDF : 7.1.5.146 3087360 Bytes 21/08/2009 08:31:40
                                ANTIVIR3.VDF : 7.1.5.163 152064 Bytes 26/08/2009 08:31:39
                                Version du moteur: 8.2.1.3
                                AEVDF.DLL : 8.1.1.1 106868 Bytes 05/05/2009 09:45:17
                                AESCRIPT.DLL : 8.1.2.25 459130 Bytes 17/08/2009 10:48:04
                                AESCN.DLL : 8.1.2.4 127348 Bytes 28/07/2009 08:57:01
                                AERDL.DLL : 8.1.2.4 430452 Bytes 16/07/2009 10:16:07
                                AEPACK.DLL : 8.1.3.18 401783 Bytes 02/06/2009 07:39:23
                                AEOFFICE.DLL : 8.1.0.38 196987 Bytes 24/06/2009 08:20:44
                                AEHEUR.DLL : 8.1.0.155 1921400 Bytes 25/08/2009 08:31:47
                                AEHELP.DLL : 8.1.6.0 233846 Bytes 25/08/2009 08:31:45
                                AEGEN.DLL : 8.1.1.57 356725 Bytes 25/08/2009 08:31:43
                                AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
                                AECORE.DLL : 8.1.7.6 184694 Bytes 28/07/2009 08:56:59
                                AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
                                AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:02
                                AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:27:58
                                AVREP.DLL : 8.0.0.3 155688 Bytes 22/04/2009 08:56:00
                                AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:37
                                AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:19
                                AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:46
                                SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
                                SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:36
                                NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:07
                                RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 04/07/2008 07:23:16
                                RCTEXT.DLL : 8.0.52.1 86273 Bytes 17/07/2008 10:08:43

                                Configuration pour la recherche actuelle :
                                Nom de la tâche..................: Contrôle intégral du système
                                Fichier de configuration.........: c:\program files\avira\antivir personaledition classic\sysscan.avp
                                Documentation....................: bas
                                Action principale................: interactif
                                Action secondaire................: ignorer
                                Recherche sur les secteurs d'amorçage maître: marche
                                Recherche sur les secteurs d'amorçage: marche
                                Secteurs d'amorçage..............: C:, G:,
                                Recherche dans les programmes actifs: marche
                                Recherche en cours sur l'enregistrement: marche
                                Recherche de Rootkits............: arrêt
                                Fichier mode de recherche........: Sélection de fichiers intelligente
                                Recherche sur les archives.......: marche
                                Limiter la profondeur de récursivité: 20
                                Archive Smart Extensions.........: marche
                                Heuristique de macrovirus........: marche
                                Heuristique fichier..............: moyen

                                Début de la recherche : mercredi 26 août 2009 17:35

                                La recherche sur les processus démarrés commence :
                                Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'usnsvc.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'WebEditor.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'wuauclt.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'firefox.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'wmiprvse.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'wmiapsrv.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'googletalk.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'ntvdm.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'YahooMessenger.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'msmsgs.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'msnmsgr.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
                                Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
                                '31' processus ont été contrôlés avec '31' modules

                                La recherche sur les secteurs d'amorçage maître commence :
                                Secteur d'amorçage maître HD0
                                [INFO] Aucun virus trouvé !
                                Secteur d'amorçage maître HD1
                                [INFO] Aucun virus trouvé !
                                Secteur d'amorçage maître HD2
                                [INFO] Aucun virus trouvé !

                                La recherche sur les secteurs d'amorçage commence :
                                Secteur d'amorçage 'C:\'
                                [INFO] Aucun virus trouvé !
                                Secteur d'amorçage 'G:\'
                                [INFO] Aucun virus trouvé !

                                La recherche sur les renvois aux fichiers exécutables (registre) commence.
                                Le registre a été contrôlé ( '47' fichiers).

                                La recherche sur les fichiers sélectionnés commence :

                                Recherche débutant dans 'C:\'
                                C:\pagefile.sys
                                [AVERTISSEMENT] Impossible d'ouvrir le fichier !
                                Recherche débutant dans 'G:\'
                                G:\System Volume Information\_restore{2DB37729-7E03-4F82-ADEF-4057C22A22C7}\RP139\A0021855.inf
                                [RESULTAT] Contient le code du virus Windows W32/Autorun.mg
                                [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4ac58a00.qua' !
                                G:\System Volume Information\_restore{744A52D3-7253-4348-B0A1-F4D3615D92C2}\RP12\A0011072.inf
                                [RESULTAT] Contient le code du virus Windows W32/Autorun.mg
                                [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4ac58a06.qua' !
                                G:\System Volume Information\_restore{744A52D3-7253-4348-B0A1-F4D3615D92C2}\RP13\A0011153.inf
                                [RESULTAT] Contient le code du virus Windows W32/Autorun.mg
                                [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4ac58a18.qua' !
                                G:\System Volume Information\_restore{74B3BF8D-F0B7-4C2D-9239-3078C1898158}\RP276\A0112624.exe
                                [RESULTAT] Contient le cheval de Troie TR/Crypt.XPACK.Gen
                                [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4ac68b0f.qua' !

                                Fin de la recherche : mercredi 26 août 2009 21:24
                                Temps nécessaire: 3:49:13 Heure(s)

                                La recherche a été effectuée intégralement

                                10511 Les répertoires ont été contrôlés
                                293641 Des fichiers ont été contrôlés
                                4 Des virus ou programmes indésirables ont été trouvés
                                0 Des fichiers ont été classés comme suspects
                                0 Des fichiers ont été supprimés
                                0 Des virus ou programmes indésirables ont été réparés
                                4 Les fichiers ont été déplacés dans la quarantaine
                                0 Les fichiers ont été renommés
                                1 Impossible de contrôler des fichiers
                                293636 Fichiers non infectés
                                3947 Les archives ont été contrôlées
                                1 Avertissements
                                4 Consignes
                                1. Xplode Contributeur sécurité
                                  Ok passe un scan avec AntiVir puis poste moi le rapport.
                                  • 1
                                  • 2