probleme virus

Question

Bonjour,
je nrrive pas a supprimer plusieurs virus ainfo.txt logfile of random's system information tool 1.06 2009-10-27 18:08:09
si quelqu un peut m aider merci d avance de plus je ne peut pas formater mon disque c  anti virus inactif  ni msn impossible a reinstaller

======Uninstall list======

-->"C:\Program Files\Creative\SBAudigy2\Program\Ctzapxx.EXE" /U /S /L:FRN
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ABBYY FineReader 5.0 Sprint-->MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A92000000001}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Azureus-->C:\Program Files\Azureus\Uninstall.exe
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Dell AIO Printer A920-->C:\WINDOWS\System32\spool\drivers\w32x86\3\DLBKUN5C.EXE -dDell AIO Printer A920
Dell ResourceCD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe" 
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DVD Region+CSS Free 5.9.8.3-->"C:\Program Files\DVD Region+CSS Free\unins000.exe"
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Galerie de photos Windows Live-->MsiExec.exe /X{B131E59D-202C-43C6-84C9-68F0C37541F1}
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Hercules Deluxe Optical Glass-->C:\Program Files\InstallShield Installation Information\{56298F72-C2CC-4FE5-ACEA-30C7A866BF4C}\setup.exe -runfromtemp -l0x040c -removeonly
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
ImgBurn 2.3.2.0 Fr-->"C:\Program Files\ImgBurn\unins000.exe"
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Intel(R) PRO Network Adapters and Drivers-->Prounstl.exe
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
K-Lite Mega Codec Pack 3.8.5-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
livebox-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe" -l0x40c 
Logitech Harmony Remote Software 7-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5C6F884D-680C-448B-B4C9-22296EE1B206}\setup.exe" -l0x40c  -removeonly
Luxor Mega Pack-->"C:\WINDOWS\Luxor Mega Pack\uninstall.exe" "/U:C:\Program Files\Luxor Mega Pack\Uninstall\uninstall.xml"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Search Enhancement Pack-->MsiExec.exe /I{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB971930)-->"C:\WINDOWS\ie8updates\KB971930-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe
Mozilla Firefox (2.0.0.14)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
Nero 9-->C:\Program Files\Fichiers communs\Nero\Nero ProductInstaller 4\SetupX.exe  REMOVESERIALNUMBER="9M03-01A1-PCX7-K31A-8A94-98PT-KT2E-522A"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers-->C:\WINDOWS\system32
vuninst.exe UninstallGUI
OpenOffice.org 3.1-->MsiExec.exe /I{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}
Original-Solitaire-->C:\Program Files\Original-Solitaire\uninst.exe
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
Remote Control USB Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8471021C-F529-43DE-84DF-3612E10F58C4}\setup.exe" -l0x9  -removeonly
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Sound Blaster Audigy 2-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E82BF103-904F-49C0-B77F-6EC110B71E87}\SETUP.EXE" -l0x40c 
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VLC media player 1.0.2-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vuze-->C:\Program Files\Azureus\uninstall.exe
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Contrôle parental-->MsiExec.exe /X{D5D81435-B8DE-4CAF-867F-7998F2B92CFC}
Windows Live Mail-->MsiExec.exe /I{5DD76286-9BE7-4894-A990-E905E91AC818}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Live Toolbar-->MsiExec.exe /X{F7D27C70-90F5-49B9-B188-0A133C0CE353}
Windows Live Writer-->MsiExec.exe /X{4634B21A-CC07-4396-890C-2B8168661FEA}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation FR Language Pack-->MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
Zuma's Revenge!-->"C:\WINDOWS\Zuma's Revenge!\uninstall.exe" "/U:C:\Program Files\Zuma's Revenge!\Uninstall\uninstall.xml"

======System event log======

Computer Name: DELL
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 1516776
Source Name: Tcpip
Time Written: 20091002120049.000000+120
Event Type: Avertissement
User: 

Computer Name: DELL
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 1516775
Source Name: Tcpip
Time Written: 20091002113055.000000+120
Event Type: Avertissement
User: 

Computer Name: DELL
Event Code: 7036
Message: Le service HTTP SSL est entré dans l'état : en cours d'exécution.

Record Number: 1516774
Source Name: Service Control Manager
Time Written: 20091002094544.000000+120
Event Type: Informations
User: 

Computer Name: DELL
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service HTTP SSL.

Record Number: 1516773
Source Name: Service Control Manager
Time Written: 20091002094544.000000+120
Event Type: Informations
User: AUTORITE NT\SERVICE LOCAL

Computer Name: DELL
Event Code: 7036
Message: Le service Carte de performance WMI est entré dans l'état : arrêté.

Record Number: 1516772
Source Name: Service Control Manager
Time Written: 20091002085922.000000+120
Event Type: Informations
User: 

=====Application event log=====

Computer Name: DELL
Event Code: 1
Message: 
Record Number: 20383
Source Name: nview_info
Time Written: 20090722074058.000000+120
Event Type: erreur
User: 

Computer Name: DELL
Event Code: 1
Message: 
Record Number: 20382
Source Name: nview_info
Time Written: 20090722074056.000000+120
Event Type: erreur
User: 

Computer Name: DELL
Event Code: 1
Message: 
Record Number: 20381
Source Name: nview_info
Time Written: 20090722074056.000000+120
Event Type: erreur
User: 

Computer Name: DELL
Event Code: 1
Message: 
Record Number: 20380
Source Name: nview_info
Time Written: 20090722074056.000000+120
Event Type: erreur
User: 

Computer Name: DELL
Event Code: 1
Message: 
Record Number: 20379
Source Name: nview_info
Time Written: 20090722074056.000000+120
Event Type: erreur
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Samsung\Samsung PC Studio 3\C:\Program Files\DMV\MaxTV4\plugins;
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO

-----------------EOF-----------------
rrive pas a supprimer plusieurs virus Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3038
Windows 5.1.2600 Service Pack 3 (Safe Mode)

27/10/2009 09:45:03
mbam-log-2009-10-27 (09-45-03).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 149132
Temps écoulé: 20 minute(s), 42 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 10
Fichier(s) infecté(s): 229

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\sK9Ou0s (Worm.Bagle) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\srosa (Worm.Bagle) -> Delete on reboot.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flec003.exe (Email.Worm) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\drvsyskit (Worm.Bagle) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\german.exe (Worm.Bagle) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mule_st_key (Worm.Bagle) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\carole\Application Data\drivers\downld (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\Incoming (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\lang (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\skins (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\Temp (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\WDIR (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\webserver (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\m (Trojan.Agent) -> Delete on reboot.

Fichier(s) infecté(s):
C:\Documents and Settings\carole\Application Data\hidires\flec003.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\117593.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\118734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\121218.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\129265.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\133734.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\135562.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\144562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\150796.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\151281.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\154750.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\154890.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\159515.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\181109.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\184359.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\193562.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\196890.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\m\flec006.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP390\A0077406.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP390\A0077407.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP391\A0077524.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP391\A0077525.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP391\A0077526.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077636.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077637.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077638.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077650.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077651.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077652.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077667.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077668.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077669.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mdelk.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wintems.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\119265.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\123156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\124484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\125531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\127390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\131203.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\142062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\142250.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\142468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\147312.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\150750.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\155562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\164812.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\171796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\171984.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\172046.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\173828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\184828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\185296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\185750.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\186375.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\186828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\186859.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\194375.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\195437.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\195937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\196750.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\196812.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\207515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\208578.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\208781.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\209031.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\209156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\209187.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\209515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\209734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\225390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\225734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\225875.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\226156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\227031.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\227109.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\228078.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\229140.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\229937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\230796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\230890.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\243562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\245062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\246562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\247406.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\248093.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\248218.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\261968.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\262359.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\263000.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\263625.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\264281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\264656.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\264984.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\265281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\265796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\282437.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\283937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\284906.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\329359.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\330296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\330437.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\330968.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\331515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\331609.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\346171.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\346734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\346828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\347203.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\347468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\353000.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\353671.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\353843.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\354484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\355156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\355328.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\355703.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\356734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\356937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\357890.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\358734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\358875.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\361562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\362250.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\362406.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\368843.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\369765.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\370031.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\373484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\374078.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\374234.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\375593.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\376171.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\376250.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\376671.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\376937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\376953.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\391468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\392796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\393031.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\394656.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\396296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\396578.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\401718.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\403125.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\403281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\405921.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\406484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\407781.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\408109.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\410187.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\410312.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\415437.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\416390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\416562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\419484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\420375.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\420656.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\421265.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\422921.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\423828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\423859.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\424109.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\424156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\424718.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\425812.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\426531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\428468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\429875.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\430531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\435171.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\436593.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\436843.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\449531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\450468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\450515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\456859.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\457984.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\458156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\458937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\460484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\461421.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\469125.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\469875.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\469968.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\510203.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\516796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\529359.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\531187.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\531953.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\545296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\556453.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\557390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\566390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\567750.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\568265.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\581062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\583625.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\592953.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\594765.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\595234.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\692546.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\695000.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\705062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\706812.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\707296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\downloads.bak (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\downloads.txt (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\file.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires
ames.txt (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\server.txt (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\cancelled.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\clients.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\clients.met.bak (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\cryptkey.dat (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\emfriends.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\known.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\known2_64.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\preferences.ini (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\server.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\server_met.old (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\statistics.ini (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\WDIR\EnviroDuck Carbon Footprint Calculator 1.0.zip (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\WDIR\Mp3 Editor for Free 3.2.7 Build 79.czip (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\WDIR\WhenOnEarth 1.10.zip (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\m\data.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\m\list.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\m\srvlist.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\winupgro.exe (Trojan.Agent) -> Quarantined and deleted successfully.

jfkpresident · Answer

Hello ;

? Télécharge FindyKill de Chiquitine29 sur ton bureau : 

http://pagesperso-orange.fr/NosTools/Chiquitine29/FindyKill.exe

! Déconnecte toi et ferme toutes applications en cours ! 

• Double clique sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut . 

• Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

• Double-clique sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .
 
• Au menu principal choisis l'option " F " pour français et tape sur [entrée] . 

• Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée] 

? Laisse travailler l'outil et ne touche à rien ... 

--> Poste le rapport qui apparait à la fin , sur le forum ...

( le rapport est sauvegardé aussi sous C:\FindyKill.txt ) 
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html

jfkpresident · Answer

! Déconnecte toi et ferme toutes application en cours ( navigateur compris ) . 

• Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

• Relance "FindyKill" : au menu principal choisis l'option " F " pour français et tape sur [entrée] .

• Au second menu choisis l'option 2 (suppression) et tape sur [entrée] 

• Le pc va redémarrer automatiquement ...

? le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

--> Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt ) 

/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide 

Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html
                                 =============================
Télécharges ComboFix à partir d'un de ces liens :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
https://forospyware.com
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

Et important, enregistre le sur le bureau.

Avant d'utiliser ComboFix :

? Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

? Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
la protection en temps réel de ton Antivirus et de tes Antispywares,
qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.


Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt,.
est automatiquement sauvegardé et rangé à C:\Combofix.txt)

? Réactive la protection en temps réel de ton Antivirus et de tes Antispywares,
avant de te reconnecter à internet.

? Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

ben06 · Answer

############################## | FindyKill V5.016 |

# User : carole (Administrateurs) # DELL
# Update on 26/10/2009 by Chiquitine29
# Start at: 07:04:42 | 31/10/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

#               Intel(R) Pentium(R) 4 CPU 2.80GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 39,06 Go (23,1 Go free) # NTFS
# D:\ # Disque fixe local # 72,69 Go (214,74 Mo free) # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32undll32.exe

################## | C: |


################## | C:\WINDOWS |

Supprimé ! C:\WINDOWS\Prefetch\WINUPGRO.EXE-17681AA8.pf  

################## | C:\WINDOWS\system32 |


################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\carole\Application Data |

################## | Autres suppressions ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses | 

Supprimé ! [HKLM\software\microsoft\security center] "AntiVirusDisableNotify"  
Supprimé ! [HKLM\software\microsoft\security center] "AntiVirusOverride"  
Supprimé ! [HKLM\software\microsoft\security center] "FirewallDisableNotify"  
Supprimé ! [HKLM\software\microsoft\security center] "FirewallOverride"  
Supprimé ! [HKLM\software\microsoft\security center] "UpdatesDisableNotify"  

################## | Etat / Services / Informations |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

################## | PEH ... |


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.016 ! |

jfkpresident · Answer

Ensuite le rapport de Combofix .

ben06 · Answer

ComboFix 09-10-30.01 - carole 31/10/2009 10:42.2.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.1535.1087 [GMT 1:00]
Lancé depuis: c:\documents and settings\carole\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Il y a peut-être des sites infectés -----

hxxp://www.nicematin.com
.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-09-28 au 2009-10-31  ))))))))))))))))))))))))))))))))))))
.

2009-10-31 09:02 . 2009-10-31 09:02	--------	d-----w-	c:\windows\LastGood
2009-10-31 09:01 . 2009-10-31 09:01	--------	d-----w-	c:\program files\Windows Live SkyDrive
2009-10-31 09:00 . 2009-10-31 09:02	--------	d-----w-	c:\program files\Windows Live
2009-10-31 08:48 . 2009-10-31 08:48	--------	d-----w-	c:\program files\Windows Installer Clean Up
2009-10-31 08:46 . 2009-10-31 08:48	--------	d-----w-	c:\program files\MSECACHE
2009-10-31 08:06 . 2009-10-31 08:06	--------	d-----w-	c:\program files\Fichiers communs\Windows Live
2009-10-31 08:01 . 2009-10-31 08:01	664	----a-w-	c:\windows\system32\d3d9caps.dat
2009-10-31 06:30 . 2009-10-31 06:30	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2009-10-31 06:19 . 2009-03-30 09:32	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-10-31 06:19 . 2009-02-13 11:28	22360	----a-w-	c:\windows\system32\drivers\avgntmgr.sys
2009-10-31 06:19 . 2009-02-13 11:17	45416	----a-w-	c:\windows\system32\drivers\avgntdd.sys
2009-10-31 06:19 . 2009-10-31 06:19	--------	d-----w-	c:\program files\Avira
2009-10-31 06:19 . 2009-10-31 06:19	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-10-30 16:10 . 2009-10-27 08:32	15360	-c--a-w-	c:\windows\system32\dllcacheegister.exe.REN
2009-10-30 13:51 . 2009-10-31 06:11	--------	d-----w-	C:\FindyKill
2009-10-30 08:25 . 2009-10-31 06:23	55656	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-10-30 08:03 . 2009-10-30 08:10	--------	d-----w-	c:\windows\BDOSCAN8
2009-10-29 17:54 . 2009-10-29 17:54	--------	d-----w-	c:\windows\Performance
2009-10-29 17:54 . 2009-10-29 17:54	--------	d-----w-	c:\documents and settings\carole\Local Settings\Application Data\Microsoft Corporation
2009-10-27 22:08 . 2009-10-27 22:08	--------	d-----w-	c:\documents and settings\carole\Application Data\VitySoft
2009-10-27 19:47 . 2009-10-31 07:00	--------	d-----w-	c:\documents and settings\carole\Application Data\skypePM
2009-10-27 19:47 . 2009-10-31 05:49	56	---ha-w-	c:\windows\system32\ezsidmv.dat
2009-10-27 19:39 . 2009-10-31 09:40	--------	d-----w-	c:\documents and settings\carole\Application Data\Skype
2009-10-27 19:38 . 2009-10-27 19:38	--------	d-----w-	c:\program files\Fichiers communs\Skype
2009-10-27 19:38 . 2009-10-27 19:39	--------	d-----r-	c:\program files\Skype
2009-10-27 19:38 . 2009-10-27 19:38	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype
2009-10-27 16:08 . 2009-08-05 21:48	54752	----a-w-	c:\windows\system32\drivers\fssfltr_tdi.sys
2009-10-27 16:07 . 2009-10-27 16:07	--------	d-----w-	c:\program files\Microsoft Sync Framework
2009-10-27 08:57 . 2003-03-18 21:20	1060864	----a-w-	c:\windows\system32\MFC71.dll
2009-10-27 08:57 . 2003-03-18 20:14	499712	----a-w-	c:\windows\system32\MSVCP71.dll
2009-10-27 08:56 . 2009-10-27 08:56	--------	d-----w-	c:\program files\Alwil Software
2009-10-27 08:15 . 2009-09-10 13:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-27 08:15 . 2009-10-27 08:15	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-10-27 08:15 . 2009-09-10 13:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-10-27 08:11 . 2009-10-30 07:43	--------	d-----w-	c:\documents and settings\All Users\Application Data\avg9
2009-10-27 00:51 . 2009-10-27 01:11	--------	d-----w-	c:\windows\SxsCaPendDel
2009-10-26 23:19 . 2009-10-31 06:58	--------	d-----w-	c:\program files\Registry Winner
2009-10-26 15:48 . 2009-10-30 17:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\great coal love default
2009-10-25 16:32 . 2009-10-25 16:32	--------	d-----w-	c:\documents and settings\carole\Application Data\PlayFirst
2009-10-25 16:32 . 2009-10-25 16:32	--------	d-----w-	c:\documents and settings\All Users\Application Data\PlayFirst
2009-10-25 16:31 . 2009-10-25 16:31	--------	d-----w-	c:\program files\GamesBar
2009-10-25 16:31 . 2009-10-25 16:31	--------	d-----w-	c:\program files\Oberon Media
2009-10-25 16:31 . 2009-10-25 16:31	--------	d-----w-	c:\program files\Fichiers communs\Oberon Media
2009-10-16 01:26 . 2009-10-16 01:26	--------	d-sh--w-	c:\documents and settings\LocalService\IETldCache
2009-10-11 08:14 . 2009-10-29 18:59	--------	d-----w-	c:\documents and settings\carole\Application Data\vlc
2009-10-04 18:34 . 2009-10-04 18:34	--------	d-----w-	c:\program files\Microsoft

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-31 07:52 . 2003-07-22 16:49	510204	----a-w-	c:\windows\system32\perfh00C.dat
2009-10-31 07:52 . 2003-07-22 16:49	85304	----a-w-	c:\windows\system32\perfc00C.dat
2009-10-31 07:47 . 2009-01-16 15:33	288	----a-w-	c:\windows\system32\DVCStateBkp-{00000002-00000000-00000000-00001102-00000004-10031102}.dat
2009-10-31 07:47 . 2009-01-16 15:33	288	----a-w-	c:\windows\system32\DVCState-{00000002-00000000-00000000-00001102-00000004-10031102}.dat
2009-10-31 07:31 . 2009-06-07 12:31	--------	d-----w-	c:\program files\DivX
2009-10-31 06:58 . 2009-05-12 15:19	--------	d-----w-	c:\program files\Original-Solitaire
2009-10-31 05:29 . 2009-01-16 18:43	--------	d-----w-	c:\documents and settings\carole\Application Data\Azureus
2009-10-30 18:11 . 2009-09-16 17:18	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2009-10-30 09:53 . 2009-01-16 14:59	--------	d-----w-	c:\program files\Dell AIO Printer A920
2009-10-27 19:39 . 2009-01-18 10:21	--------	d-----w-	c:\program files\Google
2009-10-27 16:02 . 2009-07-18 07:50	--------	d-----w-	c:\documents and settings\carole\Application Data\Media Player
2009-10-26 05:17 . 2009-07-18 07:41	--------	d-----w-	c:\program files\Orange
2009-10-16 11:23 . 2009-01-16 18:38	--------	d-----w-	c:\program files\Azureus
2009-10-15 06:56 . 2009-01-21 17:21	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2009-09-16 17:19 . 2009-09-16 17:17	--------	d-----w-	c:\program files\Zuma's Revenge!
2009-09-11 14:18 . 2003-07-22 16:44	136192	----a-w-	c:\windows\system32\msv1_0.dll
2009-09-09 21:47 . 2009-06-06 06:06	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-09-04 21:04 . 2003-07-22 16:42	58880	----a-w-	c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2003-07-22 17:01	916480	------w-	c:\windows\system32\wininet.dll
2009-08-26 08:01 . 2003-07-22 16:56	247326	----a-w-	c:\windows\system32\strmdll.dll
2009-08-22 01:19 . 2009-01-16 15:22	17864	-c--a-w-	c:\documents and settings\carole\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-06 17:24 . 2009-01-16 15:15	327896	----a-w-	c:\windows\system32\wucltui.dll
2009-08-06 17:24 . 2009-01-16 15:15	209632	----a-w-	c:\windows\system32\wuweb.dll
2009-08-06 17:24 . 2009-01-16 15:15	35552	----a-w-	c:\windows\system32\wups.dll
2009-08-06 17:24 . 2008-10-16 13:09	44768	----a-w-	c:\windows\system32\wups2.dll
2009-08-06 17:24 . 2009-01-16 14:37	53472	------w-	c:\windows\system32\wuauclt.exe
2009-08-06 17:24 . 2003-07-22 16:31	96480	----a-w-	c:\windows\system32\cdm.dll
2009-08-06 17:23 . 2009-01-16 15:15	575704	----a-w-	c:\windows\system32\wuapi.dll
2009-08-06 17:23 . 2009-03-26 03:36	215920	----a-w-	c:\windows\system32\muweb.dll
2009-08-06 17:23 . 2009-03-26 03:36	274288	----a-w-	c:\windows\system32\mucltui.dll
2009-08-06 17:23 . 2009-01-16 14:37	1929952	----a-w-	c:\windows\system32\wuaueng.dll
2009-08-05 09:00 . 2003-07-22 16:45	205312	-c--a-w-	c:\windows\system32\mswebdvd.dll
2009-08-04 20:58 . 2003-07-22 16:48	2191232	------w-	c:\windows\system32
toskrnl.exe
2009-08-04 17:28 . 2002-08-29 11:42	2068096	------w-	c:\windows\system32
tkrnlpa.exe
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"Dell AIO Printer A920"="c:\program files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-06-02 270336]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"CamserviceDeluxe2"="c:\program files\Hercules\Deluxe Optical Glass\Camservice.exe" [2007-08-10 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"CTHelper"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2003-02-20 28672]
"AsioReg"="CTASIO.DLL" - c:\windows\system32\CTASIO.DLL [2003-02-20 110592]
"nwiz"="nwiz.exe" - c:\windows\system32
wiz.exe [2008-05-03 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "c:\progra~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Azureus\Azureus.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\Hercules\Deluxe Optical Glass\Station2.exe"=
"c:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe"=
"c:\Program Files\Java\jre6\bin\java.exe"=
"c:\Program Files\Hercules\Deluxe Optical Glass\ControlUI.exe"=
"c:\Program Files\Skype\Plugin Manager\skypePM.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [31/10/2009 07:19 108289]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [27/10/2009 17:08 54752]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [27/10/2009 09:15 269648]
R3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [12/03/2009 19:19 94720]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [27/10/2009 09:15 19160]
S2 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [22/07/2003 17:56 14336]
S3 APL531;Hercules Dualpix HD Webcam;c:\windows\system32\Drivers\HDvid.sys --> c:\windows\system32\Drivers\HDvid.sys [?]
S3 camfilt;camfilt;c:\windows\system32\Drivers\camfilt.sys --> c:\windows\system32\Drivers\camfilt.sys [?]
S3 fsssvc;Service Windows Live Contrôle parental;"c:\program files\Windows Live\Family Safety\fsssvc.exe" --> c:\program files\Windows Live\Family Safety\fsssvc.exe [?]
S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\system32\driverscblan.sys [03/04/2009 15:49 39704]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - PCIIDEX_2
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
*Deregistered* - PCIIDEX_2
.
Contenu du dossier 'Tâches planifiées'

2009-10-31 c:\windows\Tasks\Malwarebytes' Scheduled Update for carole.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-27 13:53]

2009-10-31 c:\windows\Tasks\User_Feed_Synchronization-{F6A67EAF-6081-4907-B7D9-A0AAEA79BC17}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
mStart Page = hxxp://www.duxet.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_8971.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-31 10:48
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-10-31 10:50
ComboFix-quarantined-files.txt  2009-10-31 09:50

Avant-CF: 24 176 594 944 octets libres
Après-CF: 24 143 593 472 octets libres

- - End Of File - - C38E1AD62EF4FF589F09A49D0F4132DC

jfkpresident · Answer

Il va falloir analyser un ou des fichier(s) suspect(s) !

Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme.
Il faut donc les rendre visibles pour le scan.

Pour afficher les dossiers et fichiers cachés:

Panneau de configuration > Options des dossiers > onglet Affichage.

Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence. 

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : c:\windows\system32\drivers\fssfltr_tdi­.sys       

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

ben06 · Answer

Srpski | &#1052;&#1072;&#1082;&#1077;&#1076;&#1086;&#1085;&#1089;&#1082;&#1080; | &#1575;&#1604;&#1593;&#1585;&#1576;&#1610;&#1577; | Suomi | ihMdI |  | &#1506;&#1489;&#1512;&#1497;&#1514; |  | Slovenš&#269;ina | Dansk | &#1056;&#1091;&#1089;&#1089;&#1082;&#1080;&#1081; | Român&#259; | Türkçe | Nederlands | &#917;&#955;&#955;&#951;&#957;&#953;&#954;&#940; | Svenska | Português | Italiano |  |  | Magyar | Deutsch | &#268;esky | Polski | Español | English  
  Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations... 

Fichier fssfltr_tdi.sys1 reçu le 2009.10.29 21:36:00 (UTC)
Situation actuelle: terminé 

Résultat: 0/41 (0.00%)
 Formaté Impression des résultats  Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.41 2009.10.29 - 
AhnLab-V3 5.0.0.2 2009.10.29 - 
AntiVir 7.9.1.50 2009.10.29 - 
Antiy-AVL 2.0.3.7 2009.10.27 - 
Authentium 5.1.2.4 2009.10.29 - 
Avast 4.8.1351.0 2009.10.29 - 
AVG 8.5.0.423 2009.10.29 - 
BitDefender 7.2 2009.10.29 - 
CAT-QuickHeal 10.00 2009.10.29 - 
ClamAV 0.94.1 2009.10.29 - 
Comodo 2772 2009.10.29 - 
DrWeb 5.0.0.12182 2009.10.29 - 
eSafe 7.0.17.0 2009.10.29 - 
eTrust-Vet 35.1.7092 2009.10.29 - 
F-Prot 4.5.1.85 2009.10.29 - 
F-Secure 9.0.15370.0 2009.10.27 - 
Fortinet 3.120.0.0 2009.10.29 - 
GData 19 2009.10.29 - 
Ikarus T3.1.1.72.0 2009.10.29 - 
Jiangmin 11.0.800 2009.10.29 - 
K7AntiVirus 7.10.883 2009.10.29 - 
Kaspersky 7.0.0.125 2009.10.29 - 
McAfee 5786 2009.10.29 - 
McAfee+Artemis 5786 2009.10.29 - 
McAfee-GW-Edition 6.8.5 2009.10.29 - 
Microsoft 1.5202 2009.10.29 - 
NOD32 4556 2009.10.29 - 
Norman 6.03.02 2009.10.29 - 
nProtect 2009.1.8.0 2009.10.29 - 
Panda 10.0.2.2 2009.10.29 - 
PCTools 4.4.2.0 2009.10.19 - 
Prevx 3.0 2009.10.29 - 
Rising 21.53.34.00 2009.10.29 - 
Sophos 4.47.0 2009.10.29 - 
Sunbelt 3.2.1858.2 2009.10.29 - 
Symantec 1.4.4.12 2009.10.29 - 
TheHacker 6.5.0.2.056 2009.10.28 - 
TrendMicro 8.950.0.1094 2009.10.29 - 
VBA32 3.12.10.11 2009.10.29 - 
ViRobot 2009.10.29.2011 2009.10.29 - 
VirusBuster 4.6.5.0 2009.10.29 - 
Information additionnelle 
File size: 54752 bytes 
MD5   : c6ee3a87fe609d3e1db9dbd072a248de 
SHA1  : 3b5ec3ba91ca30522d825a91b35aa33479bc4f27 
SHA256: 9c2189fa09a9e1dc39f9ab8f0c9c0b44be0e11fc3165bcd0813dfa85ea62907c 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x99F1
timedatestamp.....: 0x4A7A6E81 (Thu Aug 6 07:47:45 2009)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x480 0x5D39 0x5D80 6.53 bea300ce15cfffb4e3db424619fd423a
.rdata 0x6200 0xA4D 0xA80 4.81 f28f87e7621a677cec55f0e8fb61ec04
.data 0x6C80 0x6F0 0x700 0.75 2de88d9cab4fead0a2d37188d8c69b3a
PAGE 0x7380 0x2460 0x2480 6.39 c6a35bda388d7551e96358a84a3cdcd7
INIT 0x9800 0x13E4 0x1400 6.22 89135a12ec609b314bf0773c8ef9ea7d
.rsrc 0xAC00 0x918 0x980 5.98 4b4314e10a7677711d8cb1eaa8ca95d8
.reloc 0xB580 0x8AC 0x900 6.25 a47d12ff72962c116e547e5f90b9e309

( 4 imports )

> hal.dll: KeAcquireInStackQueuedSpinLock, KfReleaseSpinLock, KfAcquireSpinLock, KeReleaseInStackQueuedSpinLock
> ntoskrnl.exe: MmMapLockedPagesSpecifyCache, IoCsqRemoveNextIrp, IoSetCompletionRoutineEx, MmBuildMdlForNonPagedPool, IoAllocateMdl, ExInitializeNPagedLookasideList, ExDeleteNPagedLookasideList, RtlCompareMemory, RtlInitString, IoFreeMdl, ObfDereferenceObject, IoDeleteDevice, IoDetachDevice, InterlockedPopEntrySList, InterlockedPushEntrySList, ObReferenceObjectByHandle, IoFileObjectType, IoAttachDeviceToDeviceStackSafe, IoGetDeviceObjectPointer, RtlInitUnicodeString, IoCsqInsertIrp, KeTickCount, KeBugCheckEx, IofCallDriver, IoGetRequestorProcessId, memcpy, SeQueryInformationToken, RtlLengthSid, RtlInitializeGenericTableAvl, ExFreePoolWithTag, ExAllocatePoolWithTag, RtlLookupElementGenericTableAvl, IofCompleteRequest, KeSetTimer, KeCancelTimer, KeInsertQueueDpc, KeInitializeTimer, KeInitializeDpc, IoDeleteSymbolicLink, IoWMIRegistrationControl, RtlValidSid, IoCreateSymbolicLink, RtlCopyUnicodeString, IoWMIWriteEvent, MmGetSystemRoutineAddress, IoCsqInitialize, ExAllocatePool, RtlDeleteElementGenericTableAvl, RtlLookupElementGenericTableFullAvl, RtlInsertElementGenericTableFullAvl, memset, IoCreateDevice, ZwClose, ZwSetSecurityObject, ObOpenObjectByPointer, IoDeviceObjectType, RtlGetDaclSecurityDescriptor, RtlGetSaclSecurityDescriptor, RtlGetGroupSecurityDescriptor, RtlGetOwnerSecurityDescriptor, _snwprintf, RtlLengthSecurityDescriptor, SeCaptureSecurityDescriptor, SeExports, IoIsWdmVersionAvailable, _wcsnicmp, RtlAddAccessAllowedAce, wcschr, RtlAbsoluteToSelfRelativeSD, RtlSetDaclSecurityDescriptor, RtlCreateSecurityDescriptor, ZwOpenKey, ZwCreateKey, ZwQueryValueKey, ZwSetValueKey, RtlFreeUnicodeString
> tdi.sys: TdiMapUserRequest, TdiDefaultChainedRcvExpeditedHandler, TdiDefaultChainedReceiveHandler, TdiDefaultRcvExpeditedHandler, TdiDefaultReceiveHandler
> wmilib.sys: WmiCompleteRequest, WmiSystemControl

( 0 exports )
 
TrID  : File type identification
- 
ssdeep: 768:plrSclHrGx6tB1H9xllMGCa3kgTgPGBlkF3TWqUoTsqsM/gINz4Z1jxhp:brzlLM6tB1TwNTWxoTB45Z1Nhp 
PEiD  : - 
RDS   : NSRL Reference Data Set
- 


 ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares. 

VirusTotal © Hispasec Sistemas -  Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy

jfkpresident · Answer

> Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)
- Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie/colle dedans les lignes suivantes :

           


Folder::
c:\program files\Registry Winner       




- Enregistre ce fichier sous le nom CFScript
- Fait un glisser/déposer de ce fichier CFScrïpt sur le fichier ComboFix.exe comme sur cette image. (Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris.) Combofix va démarrer.
- Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
- Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
- Ne touche à rien tant que le scan n'est pas terminé sinon le PC peut planter !
- Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Note : Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt 
                                         =================

télécharge lopS&D

*double-cliquez dessus pour installer le programme.
* Un raccourci sera créé sur votre bureau , double-cliquez dessus pour lancer l'outil.
*choisis la langue .
*choisis l'option 1 (recherche) .
*copie/colle le rapport sur le forum.

ben06 · Answer

ComboFix 09-10-30.01 - carole 01/11/2009 11:51.3.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.1535.1081 [GMT 1:00]
Lancé depuis: c:\documents and settings\carole\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\carole\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Registry Winner
c:\program files\Registry Winner\AutoBackup\AutoBackup20091027004844.zip
c:\program files\Registry Winner\RegistryWinner.exe.wbak
c:\program files\Registry Winner\RWCleaner.ini
c:\program files\Registry Winner\RWOptimizer.ini
c:\program files\Registry Winner\Settings.ini
c:\program files\Registry Winner\Utilities\Favorites\? Riad Marrakech, Riads de charme Marrakech, Liste Riads Marrakech.url
c:\program files\Registry Winner\Utilities\Favorites\Annonces immobilieres  Vente Maison 5 pieces (06400) prix 1000000 EUR.url
c:\program files\Registry Winner\Utilities\Favorites\ASOS.com - Women's Clothing - Womens Fashion - Designer Clothes For Women.url
c:\program files\Registry Winner\Utilities\Favorites\Body Bumps.url
c:\program files\Registry Winner\Utilities\Favorites\Celebrity Dresses.url
c:\program files\Registry Winner\Utilities\Favorites\christian louboutin classic sheos on sale,free shipping,discout louboutin shoes,sandal,high heel shoes,CLASSIC sheos.url
c:\program files\Registry Winner\Utilities\Favorites\Console extensible Amandine - Meubles and Co.url
c:\program files\Registry Winner\Utilities\Favorites\cydia.url
c:\program files\Registry Winner\Utilities\Favorites\Derniers ajouts - eMule-Island.url
c:\program files\Registry Winner\Utilities\Favorites\Desktop.ini
c:\program files\Registry Winner\Utilities\Favorites\dismoioù.url
c:\program files\Registry Winner\Utilities\Favorites\Dsone-i pour dsi-ds+ micro sd 4go - Supercard DSOne-i - M3 R4 DSTT.url
c:\program files\Registry Winner\Utilities\Favorites\DVDRiP  Mega Films.url
c:\program files\Registry Winner\Utilities\Favorites\Evening Dresses - Women's Evening Dresses - Designer Dresses - ASOS.com.url
c:\program files\Registry Winner\Utilities\Favorites\HD-Life.Net - La Vie En Haute Définition.url
c:\program files\Registry Winner\Utilities\Favorites\Hermes - Handbags - products list.url
c:\program files\Registry Winner\Utilities\Favorites\http--www.achatdesign.com-.url
c:\program files\Registry Winner\Utilities\Favorites\http--www.photoweb.fr-produit-tirage-eco-tirage-photo-economique.asp.url
c:\program files\Registry Winner\Utilities\Favorites\http--www2.equipement.gouv.fr-formulaires-fic_pdf-cerce.pdf.url
c:\program files\Registry Winner\Utilities\Favorites\https--www.highreplica.com-home.html.url
c:\program files\Registry Winner\Utilities\Favorites\interencheres.com  site d'annonce de ventes aux enchères publiques. Art, matériel, voiture..url
c:\program files\Registry Winner\Utilities\Favorites\iPhoneGen.fr.url
c:\program files\Registry Winner\Utilities\Favorites\Itoma  Accueil.url
c:\program files\Registry Winner\Utilities\Favorites\Lesmagouilles.url
c:\program files\Registry Winner\Utilities\Favorites\Liens\desktop.ini
c:\program files\Registry Winner\Utilities\Favorites\Liste des dernieres fiche ajoutees - eMule-Box.url
c:\program files\Registry Winner\Utilities\Favorites\Liste des formulaires à télécharger.url
c:\program files\Registry Winner\Utilities\Favorites\Maquillage, cosmétiques, produits de beauté elf, EyesLipsFace.url
c:\program files\Registry Winner\Utilities\Favorites\Megaupload  transformer un compte membre en compte premium.url
c:\program files\Registry Winner\Utilities\Favorites\Mod Dresses.url
c:\program files\Registry Winner\Utilities\Favorites\MSC Croisières.url
c:\program files\Registry Winner\Utilities\Favorites\Nappage - VEGA, matériel pour la restauration et l'hôtellerie.url
c:\program files\Registry Winner\Utilities\Favorites\New Arrivals Replica Handbags - Fake Purses - 2008 Collection.url
c:\program files\Registry Winner\Utilities\Favorites\New Look.url
c:\program files\Registry Winner\Utilities\Favorites\Pages Jaunes.url
c:\program files\Registry Winner\Utilities\Favorites\Play-The.Net - Envie de Jouer.url
c:\program files\Registry Winner\Utilities\Favorites\Prestige Replicas  Luxury at affordable prices!.url
c:\program files\Registry Winner\Utilities\Favorites\PS3Gen.fr - [TUTO] La solution pour la vidéo en HD sur PS3.url
c:\program files\Registry Winner\Utilities\Favorites\PS3Gen.fr - Accueil.url
c:\program files\Registry Winner\Utilities\Favorites\Ralph Lauren Polo - Men's Apparel.url
c:\program files\Registry Winner\Utilities\Favorites\Reload Paradise Infos.url
c:\program files\Registry Winner\Utilities\Favorites\Replica Bvlgari Designer Jewelry.url
c:\program files\Registry Winner\Utilities\Favorites\RISERVA BIANCA LIMONE PIEMONTE SCI  SKI.url
c:\program files\Registry Winner\Utilities\Favorites\Robe de bal courte dentelle et tulle beige 04090914A.url
c:\program files\Registry Winner\Utilities\Favorites\Sherri Hill Prom Dresses, 2009 Prom Dresses, Formal Dresses.url
c:\program files\Registry Winner\Utilities\Favorites\Sports98.com.url
c:\program files\Registry Winner\Utilities\Favorites\Sun Dresses - Dresses - Topshop.url
c:\program files\Registry Winner\Utilities\Favorites\Toutes les ventes en cours - myfab.com.url
c:\program files\Registry Winner\Utilities\Favorites\Uploader-Team-Tracker  Home.url
c:\program files\Registry Winner\Utilities\Favorites\USG  Demarche à suivre.url
c:\program files\Registry Winner\Utilities\Favorites\vente-privee.com.url
c:\program files\Registry Winner\Utilities\Favorites\Version traduite de la page http--www.replica031.com-Replica_Handbags-Hermes_Replica_Handbags_1.html.url
c:\program files\Registry Winner\Utilities\Favorites\Version traduite de la page http--www.tvix.co.kr-eng-.url
c:\program files\Registry Winner\Utilities\Favorites\Walter ... et vos nuits s'éclairent !.url
c:\program files\Registry Winner\Utilities\Favorites\Wii Info - Article - Graver un backup de jeu Wii-GameCube sur DVD.url
c:\program files\Registry Winner\Utilities\Favorites\Women's Dresses  Ladies Designer Dresses.url
c:\program files\Registry Winner\Utilities\Favorites\XTREAMER France.url

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-10-01 au 2009-11-01  ))))))))))))))))))))))))))))))))))))
.

2009-10-31 09:02 . 2009-10-31 09:02	--------	d-----w-	c:\windows\LastGood
2009-10-31 09:01 . 2009-10-31 09:01	--------	d-----w-	c:\program files\Windows Live SkyDrive
2009-10-31 09:00 . 2009-10-31 09:02	--------	d-----w-	c:\program files\Windows Live
2009-10-31 08:48 . 2009-10-31 08:48	--------	d-----w-	c:\program files\Windows Installer Clean Up
2009-10-31 08:46 . 2009-10-31 08:48	--------	d-----w-	c:\program files\MSECACHE
2009-10-31 08:06 . 2009-10-31 08:06	--------	d-----w-	c:\program files\Fichiers communs\Windows Live
2009-10-31 08:01 . 2009-10-31 08:01	664	----a-w-	c:\windows\system32\d3d9caps.dat
2009-10-31 06:30 . 2009-10-31 06:30	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2009-10-31 06:19 . 2009-03-30 09:32	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-10-31 06:19 . 2009-02-13 11:28	22360	----a-w-	c:\windows\system32\drivers\avgntmgr.sys
2009-10-31 06:19 . 2009-02-13 11:17	45416	----a-w-	c:\windows\system32\drivers\avgntdd.sys
2009-10-31 06:19 . 2009-10-31 06:19	--------	d-----w-	c:\program files\Avira
2009-10-31 06:19 . 2009-10-31 06:19	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-10-30 16:10 . 2009-10-27 08:32	15360	-c--a-w-	c:\windows\system32\dllcacheegister.exe.REN
2009-10-30 13:51 . 2009-10-31 06:11	--------	d-----w-	C:\FindyKill
2009-10-30 08:25 . 2009-10-31 06:23	55656	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-10-30 08:03 . 2009-10-30 08:10	--------	d-----w-	c:\windows\BDOSCAN8
2009-10-29 17:54 . 2009-10-29 17:54	--------	d-----w-	c:\windows\Performance
2009-10-29 17:54 . 2009-10-29 17:54	--------	d-----w-	c:\documents and settings\carole\Local Settings\Application Data\Microsoft Corporation
2009-10-27 22:08 . 2009-10-27 22:08	--------	d-----w-	c:\documents and settings\carole\Application Data\VitySoft
2009-10-27 19:47 . 2009-10-31 07:00	--------	d-----w-	c:\documents and settings\carole\Application Data\skypePM
2009-10-27 19:47 . 2009-10-31 05:49	56	---ha-w-	c:\windows\system32\ezsidmv.dat
2009-10-27 19:39 . 2009-10-31 09:40	--------	d-----w-	c:\documents and settings\carole\Application Data\Skype
2009-10-27 19:38 . 2009-10-27 19:38	--------	d-----w-	c:\program files\Fichiers communs\Skype
2009-10-27 19:38 . 2009-10-27 19:39	--------	d-----r-	c:\program files\Skype
2009-10-27 19:38 . 2009-10-27 19:38	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype
2009-10-27 16:08 . 2009-08-05 21:48	54752	----a-w-	c:\windows\system32\drivers\fssfltr_tdi.sys
2009-10-27 16:07 . 2009-10-27 16:07	--------	d-----w-	c:\program files\Microsoft Sync Framework
2009-10-27 08:57 . 2003-03-18 21:20	1060864	----a-w-	c:\windows\system32\MFC71.dll
2009-10-27 08:57 . 2003-03-18 20:14	499712	----a-w-	c:\windows\system32\MSVCP71.dll
2009-10-27 08:56 . 2009-10-27 08:56	--------	d-----w-	c:\program files\Alwil Software
2009-10-27 08:15 . 2009-09-10 13:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-27 08:15 . 2009-10-27 08:15	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-10-27 08:15 . 2009-09-10 13:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-10-27 08:11 . 2009-10-30 07:43	--------	d-----w-	c:\documents and settings\All Users\Application Data\avg9
2009-10-27 00:51 . 2009-10-27 01:11	--------	d-----w-	c:\windows\SxsCaPendDel
2009-10-26 15:48 . 2009-10-30 17:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\great coal love default
2009-10-25 16:32 . 2009-10-25 16:32	--------	d-----w-	c:\documents and settings\carole\Application Data\PlayFirst
2009-10-25 16:32 . 2009-10-25 16:32	--------	d-----w-	c:\documents and settings\All Users\Application Data\PlayFirst
2009-10-25 16:31 . 2009-10-25 16:31	--------	d-----w-	c:\program files\GamesBar
2009-10-25 16:31 . 2009-10-25 16:31	--------	d-----w-	c:\program files\Oberon Media
2009-10-25 16:31 . 2009-10-25 16:31	--------	d-----w-	c:\program files\Fichiers communs\Oberon Media
2009-10-16 01:26 . 2009-10-16 01:26	--------	d-sh--w-	c:\documents and settings\LocalService\IETldCache
2009-10-11 08:14 . 2009-10-31 10:11	--------	d-----w-	c:\documents and settings\carole\Application Data\vlc
2009-10-04 18:34 . 2009-10-04 18:34	--------	d-----w-	c:\program files\Microsoft

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-01 08:23 . 2009-01-16 18:43	--------	d-----w-	c:\documents and settings\carole\Application Data\Azureus
2009-10-31 07:52 . 2003-07-22 16:49	510204	----a-w-	c:\windows\system32\perfh00C.dat
2009-10-31 07:52 . 2003-07-22 16:49	85304	----a-w-	c:\windows\system32\perfc00C.dat
2009-10-31 07:47 . 2009-01-16 15:33	288	----a-w-	c:\windows\system32\DVCStateBkp-{00000002-00000000-00000000-00001102-00000004-10031102}.dat
2009-10-31 07:47 . 2009-01-16 15:33	288	----a-w-	c:\windows\system32\DVCState-{00000002-00000000-00000000-00001102-00000004-10031102}.dat
2009-10-31 07:31 . 2009-06-07 12:31	--------	d-----w-	c:\program files\DivX
2009-10-31 06:58 . 2009-05-12 15:19	--------	d-----w-	c:\program files\Original-Solitaire
2009-10-30 18:11 . 2009-09-16 17:18	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2009-10-30 09:53 . 2009-01-16 14:59	--------	d-----w-	c:\program files\Dell AIO Printer A920
2009-10-27 19:39 . 2009-01-18 10:21	--------	d-----w-	c:\program files\Google
2009-10-27 16:02 . 2009-07-18 07:50	--------	d-----w-	c:\documents and settings\carole\Application Data\Media Player
2009-10-26 05:17 . 2009-07-18 07:41	--------	d-----w-	c:\program files\Orange
2009-10-16 11:23 . 2009-01-16 18:38	--------	d-----w-	c:\program files\Azureus
2009-10-15 06:56 . 2009-01-21 17:21	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2009-09-16 17:19 . 2009-09-16 17:17	--------	d-----w-	c:\program files\Zuma's Revenge!
2009-09-11 14:18 . 2003-07-22 16:44	136192	----a-w-	c:\windows\system32\msv1_0.dll
2009-09-09 21:47 . 2009-06-06 06:06	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-09-04 21:04 . 2003-07-22 16:42	58880	----a-w-	c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2003-07-22 17:01	916480	------w-	c:\windows\system32\wininet.dll
2009-08-26 08:01 . 2003-07-22 16:56	247326	----a-w-	c:\windows\system32\strmdll.dll
2009-08-22 01:19 . 2009-01-16 15:22	17864	-c--a-w-	c:\documents and settings\carole\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-06 17:24 . 2009-01-16 15:15	327896	----a-w-	c:\windows\system32\wucltui.dll
2009-08-06 17:24 . 2009-01-16 15:15	209632	----a-w-	c:\windows\system32\wuweb.dll
2009-08-06 17:24 . 2009-01-16 15:15	35552	----a-w-	c:\windows\system32\wups.dll
2009-08-06 17:24 . 2008-10-16 13:09	44768	----a-w-	c:\windows\system32\wups2.dll
2009-08-06 17:24 . 2009-01-16 14:37	53472	------w-	c:\windows\system32\wuauclt.exe
2009-08-06 17:24 . 2003-07-22 16:31	96480	----a-w-	c:\windows\system32\cdm.dll
2009-08-06 17:23 . 2009-01-16 15:15	575704	----a-w-	c:\windows\system32\wuapi.dll
2009-08-06 17:23 . 2009-03-26 03:36	215920	----a-w-	c:\windows\system32\muweb.dll
2009-08-06 17:23 . 2009-03-26 03:36	274288	----a-w-	c:\windows\system32\mucltui.dll
2009-08-06 17:23 . 2009-01-16 14:37	1929952	----a-w-	c:\windows\system32\wuaueng.dll
2009-08-05 09:00 . 2003-07-22 16:45	205312	-c--a-w-	c:\windows\system32\mswebdvd.dll
2009-08-04 20:58 . 2003-07-22 16:48	2191232	------w-	c:\windows\system32
toskrnl.exe
2009-08-04 17:28 . 2002-08-29 11:42	2068096	------w-	c:\windows\system32
tkrnlpa.exe
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"Dell AIO Printer A920"="c:\program files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-06-02 270336]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"CamserviceDeluxe2"="c:\program files\Hercules\Deluxe Optical Glass\Camservice.exe" [2007-08-10 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"CTHelper"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2003-02-20 28672]
"AsioReg"="CTASIO.DLL" - c:\windows\system32\CTASIO.DLL [2003-02-20 110592]
"nwiz"="nwiz.exe" - c:\windows\system32
wiz.exe [2008-05-03 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "c:\progra~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Azureus\Azureus.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\Hercules\Deluxe Optical Glass\Station2.exe"=
"c:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe"=
"c:\Program Files\Java\jre6\bin\java.exe"=
"c:\Program Files\Hercules\Deluxe Optical Glass\ControlUI.exe"=
"c:\Program Files\Skype\Plugin Manager\skypePM.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [31/10/2009 07:19 108289]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [27/10/2009 17:08 54752]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [27/10/2009 09:15 269648]
R3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [12/03/2009 19:19 94720]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [27/10/2009 09:15 19160]
S2 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [22/07/2003 17:56 14336]
S3 APL531;Hercules Dualpix HD Webcam;c:\windows\system32\Drivers\HDvid.sys --> c:\windows\system32\Drivers\HDvid.sys [?]
S3 camfilt;camfilt;c:\windows\system32\Drivers\camfilt.sys --> c:\windows\system32\Drivers\camfilt.sys [?]
S3 fsssvc;Service Windows Live Contrôle parental;"c:\program files\Windows Live\Family Safety\fsssvc.exe" --> c:\program files\Windows Live\Family Safety\fsssvc.exe [?]
S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\system32\driverscblan.sys [03/04/2009 15:49 39704]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - PCIIDEX_2
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
*Deregistered* - PCIIDEX_2
.
Contenu du dossier 'Tâches planifiées'

2009-11-01 c:\windows\Tasks\Malwarebytes' Scheduled Update for carole.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-27 13:53]

2009-11-01 c:\windows\Tasks\User_Feed_Synchronization-{F6A67EAF-6081-4907-B7D9-A0AAEA79BC17}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
mStart Page = hxxp://www.duxet.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_8971.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-01 11:56
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0




   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.80GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A12
   USER : carole ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir Desktop 9.0.1.32 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:39 Go (Free:20 Go)
   D:\ (Local Disk) - NTFS - Total:72 Go (Free:0 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 01/11/2009|12:03 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [30/10/2009|07:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [15/10/2009|07:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [30/10/2009|08:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg9
   [31/10/2009|07:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [16/01/2009|20:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [19/01/2009|13:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [27/10/2009|20:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [30/10/2009|18:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
   [06/08/2009|10:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HiYo
   [16/01/2009|19:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [09/08/2009|11:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [27/10/2009|17:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [26/08/2009|14:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
   [21/01/2009|14:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MumboJumbo
   [16/01/2009|21:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [22/01/2009|22:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [31/01/2009|14:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [25/10/2009|17:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
   [16/01/2009|16:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
   [27/10/2009|20:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [30/10/2009|19:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [04/02/2009|21:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

   [22/08/2009|18:09] C:\DOCUME~1\carole\APPLIC~1\Adobe
   [01/11/2009|09:23] C:\DOCUME~1\carole\APPLIC~1\Azureus
   [13/05/2009|11:17] C:\DOCUME~1\carole\APPLIC~1\DMV Technologies
   [24/08/2009|09:02] C:\DOCUME~1\carole\APPLIC~1\dvdcss
   [18/01/2009|11:23] C:\DOCUME~1\carole\APPLIC~1\Google
   [07/05/2009|16:00] C:\DOCUME~1\carole\APPLIC~1\Help
   [06/08/2009|10:03] C:\DOCUME~1\carole\APPLIC~1\HiYo
   [16/01/2009|15:48] C:\DOCUME~1\carole\APPLIC~1\Identities
   [11/07/2009|18:05] C:\DOCUME~1\carole\APPLIC~1\ImgBurn
   [12/03/2009|19:18] C:\DOCUME~1\carole\APPLIC~1\InstallShield
   [16/01/2009|16:55] C:\DOCUME~1\carole\APPLIC~1\Macromedia
   [09/08/2009|11:10] C:\DOCUME~1\carole\APPLIC~1\Malwarebytes
   [27/10/2009|17:02] C:\DOCUME~1\carole\APPLIC~1\Media Player
   [31/10/2009|09:48] C:\DOCUME~1\carole\APPLIC~1\Microsoft
   [13/05/2009|11:17] C:\DOCUME~1\carole\APPLIC~1\Mozilla
   [26/08/2009|14:54] C:\DOCUME~1\carole\APPLIC~1\MSN6
   [16/01/2009|22:04] C:\DOCUME~1\carole\APPLIC~1\Nero
   [04/03/2009|10:57] C:\DOCUME~1\carole\APPLIC~1\OneSwarm
   [02/02/2009|17:28] C:\DOCUME~1\carole\APPLIC~1\OpenOffice.org
   [25/10/2009|17:32] C:\DOCUME~1\carole\APPLIC~1\PlayFirst
   [16/01/2009|21:20] C:\DOCUME~1\carole\APPLIC~1\Real
   [18/05/2009|09:03] C:\DOCUME~1\carole\APPLIC~1\Samsung
   [31/10/2009|10:40] C:\DOCUME~1\carole\APPLIC~1\Skype
   [31/10/2009|08:00] C:\DOCUME~1\carole\APPLIC~1\skypePM
   [16/01/2009|19:41] C:\DOCUME~1\carole\APPLIC~1\Sun
   [27/10/2009|23:08] C:\DOCUME~1\carole\APPLIC~1\VitySoft
   [31/10/2009|11:11] C:\DOCUME~1\carole\APPLIC~1\vlc
   [02/02/2009|14:31] C:\DOCUME~1\carole\APPLIC~1\Yahoo!

   [18/07/2009|22:07] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [31/10/2009|07:30] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
   [30/10/2009|07:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [30/10/2009|07:25] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [01/11/2009 01:00][--a------] C:\WINDOWS	asks\Malwarebytes' Scheduled Update for carole.job
   [01/11/2009 12:02][--ah-----] C:\WINDOWS	asks\User_Feed_Synchronization-{F6A67EAF-6081-4907-B7D9-A0AAEA79BC17}.job
   [01/11/2009 11:58][--ah-----] C:\WINDOWS	asks\SA.DAT
   [22/07/2003 17:44][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [16/01/2009|16:01] C:\Program Files\ABBYY FineReader 5.0 Sprint
   [16/01/2009|16:01] C:\Program Files\ABBYY FineReader 6.0
   [22/01/2009|13:22] C:\Program Files\Adobe
   [27/10/2009|09:56] C:\Program Files\Alwil Software
   [31/10/2009|07:19] C:\Program Files\Avira
   [16/10/2009|12:23] C:\Program Files\Azureus
   [02/02/2009|14:31] C:\Program Files\CCleaner
   [16/01/2009|16:05] C:\Program Files\Creative
   [16/01/2009|15:59] C:\Program Files\Dell A920
   [30/10/2009|10:53] C:\Program Files\Dell AIO Printer A920
   [31/10/2009|08:31] C:\Program Files\DivX
   [29/01/2009|11:37] C:\Program Files\DVD Region+CSS Free
   [28/07/2009|09:32] C:\Program Files\eMule
   [01/11/2009|11:54] C:\Program Files\Fichiers communs
   [16/01/2009|16:12] C:\Program Files\Foxireader
   [25/10/2009|17:31] C:\Program Files\GamesBar
   [27/10/2009|20:39] C:\Program Files\Google
   [12/03/2009|19:18] C:\Program Files\Hercules
   [06/08/2009|10:03] C:\Program Files\HiYo
   [11/07/2009|18:03] C:\Program Files\ImgBurn
   [31/07/2009|08:24] C:\Program Files\InstallShield Installation Information
   [16/01/2009|15:50] C:\Program Files\Intel
   [16/10/2009|02:05] C:\Program Files\Internet Explorer
   [05/08/2009|21:35] C:\Program Files\Java
   [10/06/2009|12:39] C:\Program Files\JRE
   [16/01/2009|16:11] C:\Program Files\K-Lite Codec Pack
   [31/07/2009|08:23] C:\Program Files\Logitech
   [19/01/2009|22:52] C:\Program Files\Luxor Mega Pack
   [27/10/2009|09:15] C:\Program Files\Malwarebytes' Anti-Malware
   [04/10/2009|19:34] C:\Program Files\Microsoft
   [16/01/2009|15:45] C:\Program Files\microsoft frontpage
   [09/09/2009|22:47] C:\Program Files\Microsoft Silverlight
   [25/03/2009|09:37] C:\Program Files\Microsoft SQL Server Compact Edition
   [27/10/2009|17:07] C:\Program Files\Microsoft Sync Framework
   [17/06/2009|11:00] C:\Program Files\Mindscape
   [16/01/2009|18:01] C:\Program Files\Movie Maker
   [31/10/2009|08:31] C:\Program Files\Mozilla Firefox
   [20/04/2009|22:47] C:\Program Files\MSBuild
   [31/10/2009|09:48] C:\Program Files\MSECACHE
   [16/01/2009|15:37] C:\Program Files\MSN Gaming Zone
   [17/01/2009|18:47] C:\Program Files\MSXML 4.0
   [16/01/2009|21:36] C:\Program Files\Nero
   [16/01/2009|17:58] C:\Program Files\NetMeeting
   [22/01/2009|22:54] C:\Program Files\NOS
   [25/10/2009|17:31] C:\Program Files\Oberon Media
   [10/06/2009|12:39] C:\Program Files\OpenOffice.org 3
   [02/02/2009|17:23] C:\Program Files\OpenOffice.org 3.0 (fr) Installation Files
   [10/06/2009|12:26] C:\Program Files\OpenOffice.org 3.1 (fr) Installation Files
   [26/10/2009|06:17] C:\Program Files\Orange
   [31/10/2009|07:58] C:\Program Files\Original-Solitaire
   [13/08/2009|02:02] C:\Program Files\Outlook Express
   [20/04/2009|22:42] C:\Program Files\Reference Assemblies
   [16/01/2009|16:51] C:\Program Files\SAGEM
   [27/10/2009|20:39] C:\Program Files\Skype
   [16/01/2009|17:22] C:\Program Files\SystemRequirementsLab
   [06/08/2009|10:25] C:\Program Files\UltraISO
   [16/01/2009|15:48] C:\Program Files\Uninstall Information
   [16/01/2009|16:19] C:\Program Files\VideoLAN
   [16/01/2009|16:54] C:\Program Files\Wanadoo
   [31/10/2009|09:48] C:\Program Files\Windows Installer Clean Up
   [31/10/2009|10:02] C:\Program Files\Windows Live
   [31/10/2009|10:01] C:\Program Files\Windows Live SkyDrive
   [04/02/2009|21:12] C:\Program Files\Windows Media Connect 2
   [31/10/2009|07:58] C:\Program Files\Windows Media Player
   [16/01/2009|17:58] C:\Program Files\Windows NT
   [16/01/2009|15:38] C:\Program Files\WindowsUpdate
   [16/01/2009|16:10] C:\Program Files\WinRAR
   [16/01/2009|15:45] C:\Program Files\xerox
   [16/09/2009|18:19] C:\Program Files\Zuma's Revenge!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [15/10/2009|07:56] C:\Program Files\Fichiers communs\Adobe
   [16/01/2009|19:13] C:\Program Files\Fichiers communs\InstallShield
   [02/02/2009|17:24] C:\Program Files\Fichiers communs\Java
   [27/10/2009|17:08] C:\Program Files\Fichiers communs\Microsoft Shared
   [16/01/2009|15:38] C:\Program Files\Fichiers communs\MSSoap
   [16/01/2009|21:52] C:\Program Files\Fichiers communs\Nero
   [25/10/2009|17:31] C:\Program Files\Fichiers communs\Oberon Media
   [16/01/2009|15:33] C:\Program Files\Fichiers communs\ODBC
   [03/04/2009|15:49] C:\Program Files\Fichiers communs\Remote Control Software Common
   [03/04/2009|15:49] C:\Program Files\Fichiers communs\Remote Control USB Driver
   [16/01/2009|15:39] C:\Program Files\Fichiers communs\Services
   [27/10/2009|20:38] C:\Program Files\Fichiers communs\Skype
   [16/01/2009|15:33] C:\Program Files\Fichiers communs\SpeechEngines
   [16/01/2009|17:58] C:\Program Files\Fichiers communs\System
   [31/10/2009|09:06] C:\Program Files\Fichiers communs\Windows Live

   --------------------\  Process

   ( 39 Processes )

   iexplore.exe ~ [PID:4404]
   iexplore.exe ~ [PID:4508]
   iexplore.exe ~ [PID:4464]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
   C:\DOCUME~1\carole\Cookies\carole@advertising[2].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-11-01 12:05:02
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:3][D:0]-> C:\DOCUME~1\carole\Cookies
   [F:60][D:4]-> C:\DOCUME~1\carole\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 01/11/2009|12:05 - Option : [1]

   --------------------\  Fin du rapport a 12:05:44

**************************************************************************
.
Heure de fin: 2009-11-01 11:58
ComboFix-quarantined-files.txt  2009-11-01 10:57
ComboFix2.txt  2009-10-31 09:50

Avant-CF: 22 064 304 128 octets libres
Après-CF: 22 055 600 128 octets libres

- - End Of File - - BF43DD58C2FEB8CB6CA6A80E26F1702B

jfkpresident · Answer

relance LopS&D et choisis l'option 2 .
ensuite colle le rapport généré .
 
Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)

ben06 · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.80GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A12
   USER : carole ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir Desktop 9.0.1.32 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:39 Go (Free:20 Go)
   D:\ (Local Disk) - NTFS - Total:72 Go (Free:0 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 01/11/2009|13:20 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [30/10/2009|07:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [15/10/2009|07:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [30/10/2009|08:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg9
   [31/10/2009|07:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [16/01/2009|20:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [19/01/2009|13:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [27/10/2009|20:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [06/08/2009|10:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HiYo
   [16/01/2009|19:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [09/08/2009|11:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [27/10/2009|17:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [26/08/2009|14:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
   [21/01/2009|14:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MumboJumbo
   [16/01/2009|21:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [22/01/2009|22:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [31/01/2009|14:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [25/10/2009|17:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
   [16/01/2009|16:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
   [27/10/2009|20:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [30/10/2009|19:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [04/02/2009|21:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

   [22/08/2009|18:09] C:\DOCUME~1\carole\APPLIC~1\Adobe
   [01/11/2009|09:23] C:\DOCUME~1\carole\APPLIC~1\Azureus
   [13/05/2009|11:17] C:\DOCUME~1\carole\APPLIC~1\DMV Technologies
   [24/08/2009|09:02] C:\DOCUME~1\carole\APPLIC~1\dvdcss
   [18/01/2009|11:23] C:\DOCUME~1\carole\APPLIC~1\Google
   [07/05/2009|16:00] C:\DOCUME~1\carole\APPLIC~1\Help
   [06/08/2009|10:03] C:\DOCUME~1\carole\APPLIC~1\HiYo
   [16/01/2009|15:48] C:\DOCUME~1\carole\APPLIC~1\Identities
   [11/07/2009|18:05] C:\DOCUME~1\carole\APPLIC~1\ImgBurn
   [12/03/2009|19:18] C:\DOCUME~1\carole\APPLIC~1\InstallShield
   [16/01/2009|16:55] C:\DOCUME~1\carole\APPLIC~1\Macromedia
   [09/08/2009|11:10] C:\DOCUME~1\carole\APPLIC~1\Malwarebytes
   [27/10/2009|17:02] C:\DOCUME~1\carole\APPLIC~1\Media Player
   [31/10/2009|09:48] C:\DOCUME~1\carole\APPLIC~1\Microsoft
   [13/05/2009|11:17] C:\DOCUME~1\carole\APPLIC~1\Mozilla
   [26/08/2009|14:54] C:\DOCUME~1\carole\APPLIC~1\MSN6
   [16/01/2009|22:04] C:\DOCUME~1\carole\APPLIC~1\Nero
   [04/03/2009|10:57] C:\DOCUME~1\carole\APPLIC~1\OneSwarm
   [02/02/2009|17:28] C:\DOCUME~1\carole\APPLIC~1\OpenOffice.org
   [25/10/2009|17:32] C:\DOCUME~1\carole\APPLIC~1\PlayFirst
   [16/01/2009|21:20] C:\DOCUME~1\carole\APPLIC~1\Real
   [18/05/2009|09:03] C:\DOCUME~1\carole\APPLIC~1\Samsung
   [31/10/2009|10:40] C:\DOCUME~1\carole\APPLIC~1\Skype
   [31/10/2009|08:00] C:\DOCUME~1\carole\APPLIC~1\skypePM
   [16/01/2009|19:41] C:\DOCUME~1\carole\APPLIC~1\Sun
   [27/10/2009|23:08] C:\DOCUME~1\carole\APPLIC~1\VitySoft
   [01/11/2009|12:43] C:\DOCUME~1\carole\APPLIC~1\vlc
   [02/02/2009|14:31] C:\DOCUME~1\carole\APPLIC~1\Yahoo!

   [18/07/2009|22:07] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [31/10/2009|07:30] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
   [30/10/2009|07:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [30/10/2009|07:25] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [01/11/2009 01:00][--a------] C:\WINDOWS	asks\Malwarebytes' Scheduled Update for carole.job
   [01/11/2009 13:20][--ah-----] C:\WINDOWS	asks\User_Feed_Synchronization-{F6A67EAF-6081-4907-B7D9-A0AAEA79BC17}.job
   [01/11/2009 11:58][--ah-----] C:\WINDOWS	asks\SA.DAT
   [22/07/2003 17:44][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [16/01/2009|16:01] C:\Program Files\ABBYY FineReader 5.0 Sprint
   [16/01/2009|16:01] C:\Program Files\ABBYY FineReader 6.0
   [22/01/2009|13:22] C:\Program Files\Adobe
   [27/10/2009|09:56] C:\Program Files\Alwil Software
   [31/10/2009|07:19] C:\Program Files\Avira
   [16/10/2009|12:23] C:\Program Files\Azureus
   [02/02/2009|14:31] C:\Program Files\CCleaner
   [16/01/2009|16:05] C:\Program Files\Creative
   [16/01/2009|15:59] C:\Program Files\Dell A920
   [30/10/2009|10:53] C:\Program Files\Dell AIO Printer A920
   [31/10/2009|08:31] C:\Program Files\DivX
   [29/01/2009|11:37] C:\Program Files\DVD Region+CSS Free
   [28/07/2009|09:32] C:\Program Files\eMule
   [01/11/2009|11:54] C:\Program Files\Fichiers communs
   [16/01/2009|16:12] C:\Program Files\Foxireader
   [25/10/2009|17:31] C:\Program Files\GamesBar
   [27/10/2009|20:39] C:\Program Files\Google
   [12/03/2009|19:18] C:\Program Files\Hercules
   [06/08/2009|10:03] C:\Program Files\HiYo
   [11/07/2009|18:03] C:\Program Files\ImgBurn
   [31/07/2009|08:24] C:\Program Files\InstallShield Installation Information
   [16/01/2009|15:50] C:\Program Files\Intel
   [16/10/2009|02:05] C:\Program Files\Internet Explorer
   [05/08/2009|21:35] C:\Program Files\Java
   [10/06/2009|12:39] C:\Program Files\JRE
   [16/01/2009|16:11] C:\Program Files\K-Lite Codec Pack
   [31/07/2009|08:23] C:\Program Files\Logitech
   [19/01/2009|22:52] C:\Program Files\Luxor Mega Pack
   [27/10/2009|09:15] C:\Program Files\Malwarebytes' Anti-Malware
   [04/10/2009|19:34] C:\Program Files\Microsoft
   [16/01/2009|15:45] C:\Program Files\microsoft frontpage
   [09/09/2009|22:47] C:\Program Files\Microsoft Silverlight
   [25/03/2009|09:37] C:\Program Files\Microsoft SQL Server Compact Edition
   [27/10/2009|17:07] C:\Program Files\Microsoft Sync Framework
   [17/06/2009|11:00] C:\Program Files\Mindscape
   [16/01/2009|18:01] C:\Program Files\Movie Maker
   [31/10/2009|08:31] C:\Program Files\Mozilla Firefox
   [20/04/2009|22:47] C:\Program Files\MSBuild
   [31/10/2009|09:48] C:\Program Files\MSECACHE
   [16/01/2009|15:37] C:\Program Files\MSN Gaming Zone
   [17/01/2009|18:47] C:\Program Files\MSXML 4.0
   [16/01/2009|21:36] C:\Program Files\Nero
   [16/01/2009|17:58] C:\Program Files\NetMeeting
   [22/01/2009|22:54] C:\Program Files\NOS
   [25/10/2009|17:31] C:\Program Files\Oberon Media
   [10/06/2009|12:39] C:\Program Files\OpenOffice.org 3
   [02/02/2009|17:23] C:\Program Files\OpenOffice.org 3.0 (fr) Installation Files
   [10/06/2009|12:26] C:\Program Files\OpenOffice.org 3.1 (fr) Installation Files
   [26/10/2009|06:17] C:\Program Files\Orange
   [31/10/2009|07:58] C:\Program Files\Original-Solitaire
   [13/08/2009|02:02] C:\Program Files\Outlook Express
   [20/04/2009|22:42] C:\Program Files\Reference Assemblies
   [16/01/2009|16:51] C:\Program Files\SAGEM
   [27/10/2009|20:39] C:\Program Files\Skype
   [16/01/2009|17:22] C:\Program Files\SystemRequirementsLab
   [06/08/2009|10:25] C:\Program Files\UltraISO
   [16/01/2009|15:48] C:\Program Files\Uninstall Information
   [16/01/2009|16:19] C:\Program Files\VideoLAN
   [16/01/2009|16:54] C:\Program Files\Wanadoo
   [31/10/2009|09:48] C:\Program Files\Windows Installer Clean Up
   [31/10/2009|10:02] C:\Program Files\Windows Live
   [31/10/2009|10:01] C:\Program Files\Windows Live SkyDrive
   [04/02/2009|21:12] C:\Program Files\Windows Media Connect 2
   [31/10/2009|07:58] C:\Program Files\Windows Media Player
   [16/01/2009|17:58] C:\Program Files\Windows NT
   [16/01/2009|15:38] C:\Program Files\WindowsUpdate
   [16/01/2009|16:10] C:\Program Files\WinRAR
   [16/01/2009|15:45] C:\Program Files\xerox
   [16/09/2009|18:19] C:\Program Files\Zuma's Revenge!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [15/10/2009|07:56] C:\Program Files\Fichiers communs\Adobe
   [16/01/2009|19:13] C:\Program Files\Fichiers communs\InstallShield
   [02/02/2009|17:24] C:\Program Files\Fichiers communs\Java
   [27/10/2009|17:08] C:\Program Files\Fichiers communs\Microsoft Shared
   [16/01/2009|15:38] C:\Program Files\Fichiers communs\MSSoap
   [16/01/2009|21:52] C:\Program Files\Fichiers communs\Nero
   [25/10/2009|17:31] C:\Program Files\Fichiers communs\Oberon Media
   [16/01/2009|15:33] C:\Program Files\Fichiers communs\ODBC
   [03/04/2009|15:49] C:\Program Files\Fichiers communs\Remote Control Software Common
   [03/04/2009|15:49] C:\Program Files\Fichiers communs\Remote Control USB Driver
   [16/01/2009|15:39] C:\Program Files\Fichiers communs\Services
   [27/10/2009|20:38] C:\Program Files\Fichiers communs\Skype
   [16/01/2009|15:33] C:\Program Files\Fichiers communs\SpeechEngines
   [16/01/2009|17:58] C:\Program Files\Fichiers communs\System
   [31/10/2009|09:06] C:\Program Files\Fichiers communs\Windows Live

   --------------------\  Process

   ( 36 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-11-01 13:21:21
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:3][D:0]-> C:\DOCUME~1\carole\Cookies
   [F:89][D:4]-> C:\DOCUME~1\carole\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 01/11/2009|12:05 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 01/11/2009|13:22 - Option : [2]

   --------------------\  Fin du rapport a 13:22:03

ben06 · Answer

-----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.80GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A12
   USER : carole ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:39 Go (Free:20 Go)
   D:\ (Local Disk) - NTFS - Total:72 Go (Free:0 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [1] ( 01/11/2009|13:26 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Program Files\GamesBar
   C:\Program Files\GamesBar\Localization2-French.ini

   -----------\  Extensions

   (carole) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user
   (carole) - {bb6bc1bb-f824-4702-90cd-35e2fb24f25c} => addneditcookies


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.orange.fr/portail"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.hugedomains.com/domain_profile.cfm?d=duxet&e=com"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 01/11/2009|13:27 - Option : [1]

   -----------\  Fin du rapport a 13:27:07,06

merci de passer tant de temps sur mon probleme

jfkpresident · Answer

Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
Un rapport sera généré, poste son contenu ici.

Ensuite tu va me coller un nouveau rapport RSIT comme suit :

==>Double-clique sur RSIT.exe afin de lancer RSIT.

==>Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions).

==>Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

==>Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront :

log.txt (<<qui sera affiché) ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

==>Rend toi sur ce site: https://www.cjoint.com/

==>Clique sur "parcourir" et sélectionne ces fichiers ,un lien va etre créer .

==>Copie/colle ce lien dans ta prochaine réponse .

Aide en images si besoin

ben06 · Answer

Excusez moi je ne trouve pas RSIT.exe

jfkpresident · Answer

Je pensait que tu l'avais encore ...Sinon télécharge le ici: random's system information tool (RSIT)

jfkpresident · Answer

pardon de repondre que maintenant

On a chacun notre vie a coté alors inutile de me demander pardon -;)

Question : As tu utilisé un outil (C:\WINDOWS\MBR.exe) contre l'infection MBR ?

ben06 · Answer

non pas a ma connaissance

jfkpresident · Answer

Il va falloir analyser un ou des fichier(s) suspect(s) !

Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme.
Il faut donc les rendre visibles pour le scan.

Pour afficher les dossiers et fichiers cachés:

Panneau de configuration > Options des dossiers > onglet Affichage.

Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence. 

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : C:\WINDOWS\MBR.exe       
                                                              

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

ben06 · Answer

Srpski | &#1052;&#1072;&#1082;&#1077;&#1076;&#1086;&#1085;&#1089;&#1082;&#1080; | &#1575;&#1604;&#1593;&#1585;&#1576;&#1610;&#1577; | Suomi | ihMdI |  | &#1506;&#1489;&#1512;&#1497;&#1514; |  | Slovenš&#269;ina | Dansk | &#1056;&#1091;&#1089;&#1089;&#1082;&#1080;&#1081; | Român&#259; | Türkçe | Nederlands | &#917;&#955;&#955;&#951;&#957;&#953;&#954;&#940; | Svenska | Português | Italiano |  |  | Magyar | Deutsch | &#268;esky | Polski | Español | English  
  Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations... 

Fichier mbr.exe reçu le 2009.11.02 17:03:58 (UTC)
Situation actuelle: terminé 

Résultat: 3/40 (7.50%)
 Formaté Impression des résultats  Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.41 2009.11.02 - 
AhnLab-V3 5.0.0.2 2009.11.02 - 
AntiVir 7.9.1.53 2009.11.02 - 
Antiy-AVL 2.0.3.7 2009.11.02 - 
Authentium 5.1.2.4 2009.11.02 - 
Avast 4.8.1351.0 2009.11.01 - 
AVG 8.5.0.423 2009.11.02 - 
BitDefender 7.2 2009.11.02 - 
CAT-QuickHeal 10.00 2009.11.02 - 
ClamAV 0.94.1 2009.11.02 - 
Comodo 2816 2009.11.02 Heur.Suspicious 
DrWeb 5.0.0.12182 2009.11.02 - 
eSafe 7.0.17.0 2009.11.02 Suspicious File 
eTrust-Vet 35.1.7097 2009.11.02 - 
F-Prot 4.5.1.85 2009.11.02 - 
F-Secure 9.0.15370.0 2009.10.30 - 
Fortinet 3.120.0.0 2009.11.02 - 
GData 19 2009.11.02 - 
Ikarus T3.1.1.72.0 2009.11.02 - 
Jiangmin 11.0.800 2009.11.02 - 
K7AntiVirus 7.10.886 2009.11.02 - 
Kaspersky 7.0.0.125 2009.11.02 - 
McAfee 5789 2009.11.01 - 
McAfee+Artemis 5789 2009.11.01 - 
McAfee-GW-Edition 6.8.5 2009.11.02 - 
Microsoft 1.5202 2009.11.02 - 
NOD32 4565 2009.11.02 - 
Norman 6.03.02 2009.11.02 - 
nProtect 2009.1.8.0 2009.11.02 - 
Panda 10.0.2.2 2009.11.01 - 
PCTools 7.0.3.5 2009.11.02 - 
Rising 21.54.04.00 2009.11.02 - 
Sophos 4.47.0 2009.11.02 - 
Sunbelt 3.2.1858.2 2009.11.01 - 
Symantec 1.4.4.12 2009.11.02 - 
TheHacker 6.5.0.2.058 2009.10.31 - 
TrendMicro 8.950.0.1094 2009.11.02 PAK_Generic.001 
VBA32 3.12.10.11 2009.11.02 - 
ViRobot 2009.11.2.2017 2009.11.02 - 
VirusBuster 4.6.5.0 2009.11.02 - 
Information additionnelle 
File size: 77312 bytes 
MD5   : c5ec72a20b4c98db5314e6c46765b148 
SHA1  : e51e0b26d3a8fb28e0e4dcf78b6e4df2da879ff4 
SHA256: 42855149b90c059b62ebc4027188361860fb6ffd9e4a2aa074c665181a2b9326 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x30510
timedatestamp.....: 0x4ADD81E3 (Tue Oct 20 11:24:51 2009)
machinetype.......: 0x14C (Intel I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x1D000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x1E000 0x13000 0x12800 7.89 b382e0bad5749bcf197d12b291ced9c1
.rsrc 0x31000 0x1000 0x200 2.48 976be2cc34adbef1cc44f46191c5ea77

( 2 imports )

> advapi32.dll: RegCloseKey
> kernel32.dll: LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess

( 0 exports )
 
TrID  : File type identification
UPX compressed Win32 Executable (39.5%)
Win32 EXE Yoda's Crypter (34.3%)
Win32 Executable Generic (11.0%)
Win32 Dynamic Link Library (generic) (9.8%)
Generic Win/DOS Executable (2.5%) 
ssdeep: 1536:NVAHk0dbcNRrBamAh83imalysWPvRhzjJNJDs0YpvcgHHHM6:8Hk0dbcfrBamAh8fIWPLzJI0YpvcgHnp 
PEiD  : - 
packers (Kaspersky): PE_Patch.UPX, UPX, PE_Patch 
packers (F-Prot): UPX 
RDS   : NSRL Reference Data Set
- 


 ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares. 

VirusTotal © Hispasec Sistemas -  Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy

jfkpresident · Answer

Je ne suis pas sur de la légitimité de ce fichier .......

Peux tu refaire un scan complet avec MBAM et me poster le rapport STP ?

ben06 · Answer

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3081
Windows 5.1.2600 Service Pack 3 (Safe Mode)

02/11/2009 22:02:29
mbam-log-2009-11-02 (22-02-29).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 160785
Temps écoulé: 48 minute(s), 55 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Probleme virus

31 réponses

Discussions similaires

Newsletters