mon poste est très lent

Question

Bonjour, mon ordinateur est devenu très lent je crois que j'ai pris un virus alors j'ai fais un scan avec combofix voici le rapport , s'il vous plait venez moi en aide ComboFix 10-02-25.02 - Administrateur 28/02/2010 9:00:43.2.1 - x86 MINIMAL Lancé depuis: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Exécution préalable ------- . C:\WINDOWS\srchasst ls302en.lex C:\WINDOWS\system32\og.dll C:\WINDOWS\system32\og.edt C:\WINDOWS\system32\ul.dll . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_AVPsys ((((((((((((((((((((((((((((( Fichiers créés du 2010-01-28 au 2010-02-28 )))))))))))))))))))))))))))))))))))) . 2010-02-28 01:04:46 . 2010-02-28 01:04:46 -------- d-----w- C:\WINDOWS\147BCE03C0F14C9F81576A89B6D2D973.TMP 2010-02-26 19:35:08 . 2010-02-28 00:59:15 -------- dc----w- C:\RECYCLER(2) 2010-02-26 14:45:58 . 2010-02-26 14:45:58 -------- d-----w- C:\Program Files\Fichiers communs\McAfee 2010-02-26 13:14:40 . 2008-07-09 07:40:25 26488 ----a-w- C:\WINDOWS\system32\spupdsvc.exe 2010-02-26 12:17:40 . 2010-02-26 12:17:40 -------- d-----w- C:\WINDOWS\ServicePackFiles 2010-02-26 03:08:43 . 2010-02-27 19:47:59 -------- d--h--w- C:\WINDOWS\$hf_mig$ 2010-02-26 02:11:05 . 2010-02-26 02:11:05 -------- dc----w- C:\QUARANTINE 2010-02-25 23:03:12 . 2010-02-25 23:03:12 -------- d-----w- C:\WINDOWS\system32\CatRoot_bak 2010-02-25 22:41:21 . 2009-02-09 11:50:13 2059776 -c----w- C:\WINDOWS\system32\dllcache tkrnlpa.exe 2010-02-25 22:41:11 . 2009-02-09 11:50:17 2017792 -c----w- C:\WINDOWS\system32\dllcache tkrpamp.exe 2010-02-25 22:40:55 . 2009-02-09 11:50:10 2182528 -c----w- C:\WINDOWS\system32\dllcache toskrnl.exe 2010-02-25 22:40:31 . 2009-02-09 11:50:09 2138112 -c----w- C:\WINDOWS\system32\dllcache tkrnlmp.exe 2010-02-25 22:24:01 . 2009-11-27 17:34:49 17920 -c----w- C:\WINDOWS\system32\dllcache\msyuv.dll 2010-02-25 12:17:02 . 2009-12-04 14:41:55 453760 -c----w- C:\WINDOWS\system32\dllcache\mrxsmb.sys 2010-02-23 20:52:55 . 2010-02-23 21:02:00 -------- d-----w- C:\Documents and Settings\Administrateur\DoctorWeb 2010-02-23 20:37:51 . 2010-02-25 20:35:38 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Doctor Web 2010-02-22 20:42:02 . 2010-02-22 20:42:02 603904 ----a-w- C:\WINDOWS\system32\TUProgSt.exe 2010-02-22 20:42:00 . 2008-12-11 13:31:36 27904 ----a-w- C:\WINDOWS\system32\uxtuneup.dll 2010-02-22 20:41:58 . 2010-02-22 20:41:59 360192 ----a-w- C:\WINDOWS\system32\TuneUpDefragService.exe 2010-02-22 20:41:37 . 2010-02-22 20:41:38 -------- d-----w- C:\Documents and Settings\Administrateur\Application Data\TuneUp Software 2010-02-22 20:38:48 . 2010-02-22 20:38:48 -------- d-----w- C:\Documents and Settings\All Users\Application Data\TuneUp Software 2010-02-22 20:38:32 . 2010-02-22 20:41:02 -------- d-----w- C:\Program Files\TuneUp Utilities 2009 2010-02-22 20:36:16 . 2010-02-22 20:36:19 -------- d-sh--w- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357} 2010-02-14 19:36:03 . 2010-02-14 19:36:03 -------- d-----w- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google 2010-02-14 19:35:22 . 2010-02-14 19:35:22 -------- d-----w- C:\Program Files\Google 2010-02-14 19:35:21 . 2010-02-14 19:35:21 -------- d-----w- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Google . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-28 01:04:57 . 2007-09-02 22:00:46 -------- d-----w- C:\Documents and Settings\All Users\Application Data\McAfee 2010-02-26 18:46:00 . 2001-09-28 12:00:00 55860 ----a-w- C:\WINDOWS\system32\perfc00C.dat 2010-02-26 18:46:00 . 2001-09-28 12:00:00 429450 ----a-w- C:\WINDOWS\system32\perfh00C.dat 2010-02-26 14:20:59 . 2007-09-02 22:00:00 -------- d-----w- C:\Program Files\McAfee 2010-02-25 21:51:25 . 2008-04-12 19:09:37 -------- d-----w- C:\Program Files\SuperCopier2 2010-02-23 07:53:25 . 2006-04-07 15:15:17 359080 ----a-w- C:\Documents and Settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-02-21 12:42:24 . 2007-04-03 00:53:11 10 ----a-w- C:\WINDOWS\popcinfo.dat 2009-12-08 09:12:33 . 2004-08-19 16:09:42 474624 ----a-w- C:\WINDOWS\system32\shlwapi(2).dll 2009-12-04 14:41:55 . 2004-08-03 23:15:18 453760 ----a-w- C:\WINDOWS\system32\drivers\mrxsmb.sys . [code]

C:\WINDOWS\arrière  plan  webshots\web mer .exe

/code ((((((((((((((((((((((((((((( SnapShot@2010-02-25_22.34.51 ))))))))))))))))))))))))))))))))))))))))) . + 2004-08-19 16:09:48 . 2009-06-25 08:44:40 59392 C:\WINDOWS\system32\wdigest.dll + 2004-08-19 16:09:40 . 2009-06-25 08:44:40 56320 C:\WINDOWS\system32\secur32.dll + 2004-08-19 16:09:36 . 2009-11-27 17:34:49 17920 C:\WINDOWS\system32\msyuv.dll + 2004-08-19 16:09:34 . 2005-05-04 14:45:36 15360 C:\WINDOWS\system32\msisip.dll + 2004-08-19 16:10:00 . 2005-05-04 14:45:36 78848 C:\WINDOWS\system32\msiexec.exe + 2008-09-29 08:07:00 . 2008-09-29 08:07:00 19480 C:\WINDOWS\system32\MFEOtlk.dll + 2004-08-19 16:09:48 . 2009-06-25 08:44:40 59392 C:\WINDOWS\system32\dllcache\wdigest.dll + 2004-08-19 16:09:40 . 2009-06-25 08:44:40 56320 C:\WINDOWS\system32\dllcache\secur32.dll + 2004-08-19 16:09:34 . 2005-05-04 14:45:36 15360 C:\WINDOWS\system32\dllcache\msisip.dll + 2004-08-19 16:10:00 . 2005-05-04 14:45:36 78848 C:\WINDOWS\system32\dllcache\msiexec.exe + 2004-08-19 16:09:20 . 2009-07-17 18:56:44 58880 C:\WINDOWS\system32\dllcache\atl.dll - 2004-08-19 16:09:20 . 2004-08-19 16:09:20 58880 C:\WINDOWS\system32\dllcache\atl.dll + 2004-08-19 16:09:20 . 2009-07-17 18:56:44 58880 C:\WINDOWS\system32\atl.dll - 2004-08-19 16:09:20 . 2004-08-19 16:09:20 58880 C:\WINDOWS\system32\atl.dll + 2010-02-25 23:42:06 . 2010-02-25 23:42:06 10134 C:\WINDOWS\Installer\{A638557B-1F13-40A0-9627-C892FBCA6960}\ARPPRODUCTICON.exe + 2010-02-25 22:24:01 . 2009-11-27 17:34:49 17920 C:\WINDOWS\Driver Cache\i386\msyuv.dll + 2010-02-26 14:19:58 . 2010-02-26 14:45:25 61457 C:\WINDOWS\147BCE03C0F14C9F81576A89B6D2D973.TMP\WiseCustomCalla.dll + 2009-04-15 15:26:10 . 2009-04-15 15:26:10 370176 C:\WINDOWS\system32\xpsp3res.dll + 2004-08-19 16:09:48 . 2007-12-18 14:41:59 417792 C:\WINDOWS\system32\vbscript.dll - 2004-08-19 16:09:48 . 2004-08-19 16:09:48 417792 C:\WINDOWS\system32\vbscript.dll + 2004-08-19 16:09:42 . 2004-08-19 16:09:42 474112 C:\WINDOWS\system32\shlwapi(3).dll + 2004-08-19 16:10:04 . 2009-02-09 10:08:26 111104 C:\WINDOWS\system32\services.exe + 2004-08-19 16:09:40 . 2009-06-25 08:44:40 168448 C:\WINDOWS\system32\schannel.dll + 2004-08-19 16:09:40 . 2009-02-09 10:20:31 399360 C:\WINDOWS\system32 pcss.dll + 2004-08-19 16:09:40 . 2009-04-15 15:17:17 584192 C:\WINDOWS\system32 pcrt4.dll + 2010-02-28 00:53:34 . 2010-02-28 01:05:00 393096 C:\WINDOWS\system32\Restore strlog.dat + 2004-08-19 16:09:38 . 2009-03-06 14:46:15 286208 C:\WINDOWS\system32\pdh.dll - 2004-08-19 16:09:38 . 2004-08-19 16:09:38 286208 C:\WINDOWS\system32\pdh.dll + 2004-08-19 16:09:38 . 2009-10-13 10:52:18 267776 C:\WINDOWS\system32\oakley.dll - 2004-08-19 16:09:38 . 2004-08-19 16:09:38 267776 C:\WINDOWS\system32\oakley.dll + 2004-08-19 16:09:16 . 2009-02-09 10:20:30 739840 C:\WINDOWS\system32 tdll.dll + 2004-08-19 16:09:36 . 2008-10-15 16:59:28 332800 C:\WINDOWS\system32 etapi32.dll - 2004-08-19 16:09:36 . 2004-08-19 16:09:36 247808 C:\WINDOWS\system32\mswsock.dll + 2004-08-19 16:09:36 . 2008-06-20 17:41:06 247808 C:\WINDOWS\system32\mswsock.dll + 2004-08-19 16:09:36 . 2009-08-05 09:06:31 205312 C:\WINDOWS\system32\mswebdvd.dll + 2004-08-19 16:09:36 . 2009-09-11 14:34:18 133632 C:\WINDOWS\system32\msv1_0.dll - 2004-08-19 16:08:34 . 2004-08-19 16:08:34 884736 C:\WINDOWS\system32\msimsg.dll + 2004-08-19 16:08:34 . 2005-05-04 14:45:36 884736 C:\WINDOWS\system32\msimsg.dll + 2004-08-19 16:09:34 . 2005-05-04 14:45:36 271360 C:\WINDOWS\system32\msihnd.dll + 2004-08-19 16:09:32 . 2009-06-25 08:44:40 731136 C:\WINDOWS\system32\lsasrv.dll + 2004-08-19 16:09:32 . 2009-06-25 08:44:39 298496 C:\WINDOWS\system32\kerberos.dll - 2004-08-19 16:09:32 . 2004-08-19 16:09:32 450560 C:\WINDOWS\system32\jscript.dll + 2004-08-19 16:09:32 . 2007-12-18 14:41:58 450560 C:\WINDOWS\system32\jscript.dll + 2004-08-19 16:09:26 . 2004-08-19 16:09:26 243200 C:\WINDOWS\system32\es(2).dll + 2004-08-03 23:14:42 . 2008-06-20 10:45:13 360320 C:\WINDOWS\system32\drivers cpip.sys + 2004-08-03 23:14:16 . 2008-06-20 10:44:38 138368 C:\WINDOWS\system32\drivers\afd.sys + 2004-08-19 16:09:24 . 2008-06-20 23:11:08 148992 C:\WINDOWS\system32\dnsapi.dll + 2004-08-19 16:09:48 . 2007-12-18 14:41:59 417792 C:\WINDOWS\system32\dllcache\vbscript.dll - 2004-08-19 16:09:48 . 2004-08-19 16:09:48 417792 C:\WINDOWS\system32\dllcache\vbscript.dll + 2004-08-03 23:07:46 . 2008-06-20 15:22:08 225920 C:\WINDOWS\system32\dllcache cpip6.sys + 2004-08-03 23:14:42 . 2008-06-20 10:45:13 360320 C:\WINDOWS\system32\dllcache cpip.sys + 2004-08-19 16:10:04 . 2009-02-09 10:08:26 111104 C:\WINDOWS\system32\dllcache\services.exe + 2004-08-19 16:09:40 . 2009-06-25 08:44:40 168448 C:\WINDOWS\system32\dllcache\schannel.dll + 2004-08-19 16:09:40 . 2009-02-09 10:20:31 399360 C:\WINDOWS\system32\dllcache pcss.dll + 2004-08-19 16:09:40 . 2009-04-15 15:17:17 584192 C:\WINDOWS\system32\dllcache pcrt4.dll - 2004-08-19 16:09:38 . 2004-08-19 16:09:38 286208 C:\WINDOWS\system32\dllcache\pdh.dll + 2004-08-19 16:09:38 . 2009-03-06 14:46:15 286208 C:\WINDOWS\system32\dllcache\pdh.dll - 2004-08-19 16:09:38 . 2004-08-19 16:09:38 267776 C:\WINDOWS\system32\dllcache\oakley.dll + 2004-08-19 16:09:38 . 2009-10-13 10:52:18 267776 C:\WINDOWS\system32\dllcache\oakley.dll + 2004-08-19 16:09:16 . 2009-02-09 10:20:30 739840 C:\WINDOWS\system32\dllcache tdll.dll + 2004-08-19 16:09:36 . 2008-10-15 16:59:28 332800 C:\WINDOWS\system32\dllcache etapi32.dll + 2004-08-19 16:09:36 . 2008-06-20 17:41:06 247808 C:\WINDOWS\system32\dllcache\mswsock.dll - 2004-08-19 16:09:36 . 2004-08-19 16:09:36 247808 C:\WINDOWS\system32\dllcache\mswsock.dll + 2004-08-19 16:09:36 . 2009-08-05 09:06:31 205312 C:\WINDOWS\system32\dllcache\mswebdvd.dll + 2004-08-19 16:09:36 . 2009-09-11 14:34:18 133632 C:\WINDOWS\system32\dllcache\msv1_0.dll + 2004-08-19 16:08:34 . 2005-05-04 14:45:36 884736 C:\WINDOWS\system32\dllcache\msimsg.dll - 2004-08-19 16:08:34 . 2004-08-19 16:08:34 884736 C:\WINDOWS\system32\dllcache\msimsg.dll + 2004-08-19 16:09:34 . 2005-05-04 14:45:36 271360 C:\WINDOWS\system32\dllcache\msihnd.dll + 2004-08-19 16:09:32 . 2009-06-25 08:44:40 731136 C:\WINDOWS\system32\dllcache\lsasrv.dll + 2004-08-19 16:09:32 . 2009-06-25 08:44:39 298496 C:\WINDOWS\system32\dllcache\kerberos.dll - 2004-08-19 16:09:32 . 2004-08-19 16:09:32 450560 C:\WINDOWS\system32\dllcache\jscript.dll + 2004-08-19 16:09:32 . 2007-12-18 14:41:58 450560 C:\WINDOWS\system32\dllcache\jscript.dll + 2004-08-19 16:09:24 . 2008-06-20 23:11:08 148992 C:\WINDOWS\system32\dllcache\dnsapi.dll + 2004-08-03 23:14:16 . 2008-06-20 10:44:38 138368 C:\WINDOWS\system32\dllcache\afd.sys - 2004-08-19 16:09:20 . 2004-08-19 16:09:20 685056 C:\WINDOWS\system32\dllcache\advapi32.dll + 2004-08-19 16:09:20 . 2009-02-09 10:20:31 685056 C:\WINDOWS\system32\dllcache\advapi32.dll - 2004-08-19 16:09:20 . 2004-08-19 16:09:20 100352 C:\WINDOWS\system32\dllcache\6to4svc.dll + 2004-08-19 16:09:20 . 2006-08-16 11:59:27 100352 C:\WINDOWS\system32\dllcache\6to4svc.dll + 2004-08-19 16:09:20 . 2009-02-09 10:20:31 685056 C:\WINDOWS\system32\advapi32.dll - 2004-08-19 16:09:20 . 2004-08-19 16:09:20 685056 C:\WINDOWS\system32\advapi32.dll + 2004-08-19 16:09:20 . 2006-08-16 11:59:27 100352 C:\WINDOWS\system32\6to4svc.dll - 2004-08-19 16:09:20 . 2004-08-19 16:09:20 100352 C:\WINDOWS\system32\6to4svc.dll + 2010-02-25 12:17:02 . 2009-12-04 14:41:55 453760 C:\WINDOWS\Driver Cache\i386\mrxsmb.sys + 2004-08-19 16:10:14 . 2009-05-20 12:24:06 2373504 C:\WINDOWS\system32\WMVCore.dll + 2004-08-19 16:09:40 . 2009-11-27 17:34:49 1297408 C:\WINDOWS\system32\quartz.dll + 2004-08-19 16:04:36 . 2009-02-09 11:50:10 2182528 C:\WINDOWS\system32 toskrnl.exe + 2004-08-19 16:04:20 . 2009-02-09 11:50:13 2059776 C:\WINDOWS\system32 tkrnlpa.exe + 2004-08-19 16:09:36 . 2009-07-31 04:58:48 1172480 C:\WINDOWS\system32\msxml3.dll + 2004-08-19 16:09:34 . 2005-05-04 14:45:32 2890240 C:\WINDOWS\system32\msi.dll + 2004-08-19 16:09:32 . 2009-03-21 14:20:10 1051136 C:\WINDOWS\system32\kernel32(2).dll + 2004-08-19 16:10:14 . 2009-05-20 12:24:06 2373504 C:\WINDOWS\system32\dllcache\WMVCore.dll + 2004-08-19 16:09:40 . 2009-11-27 17:34:49 1297408 C:\WINDOWS\system32\dllcache\quartz.dll + 2004-08-19 16:09:36 . 2009-07-31 04:58:48 1172480 C:\WINDOWS\system32\dllcache\msxml3.dll + 2004-08-19 16:09:34 . 2005-05-04 14:45:32 2890240 C:\WINDOWS\system32\dllcache\msi.dll + 2010-02-25 23:42:01 . 2010-02-25 23:42:03 1414656 C:\WINDOWS\Installer\5f599e.msi + 2010-02-25 22:40:55 . 2009-02-09 11:50:10 2182528 C:\WINDOWS\Driver Cache\i386 toskrnl.exe + 2010-02-25 22:41:11 . 2009-02-09 11:50:17 2017792 C:\WINDOWS\Driver Cache\i386 tkrpamp.exe + 2010-02-25 22:41:21 . 2009-02-09 11:50:13 2059776 C:\WINDOWS\Driver Cache\i386 tkrnlpa.exe + 2010-02-25 22:40:31 . 2009-02-09 11:50:09 2138112 C:\WINDOWS\Driver Cache\i386 tkrnlmp.exe . -- Instantané actualisé -- . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 16:45:00 1052672] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-10 11:22:39 98304] "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2008-03-14 04:00:00 136512] "HotKeysCmds"="C:\Windows\System32\hkcmd.exe" [2007-09-02 23:39:02 135168] "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [N/A] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09:52 15360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoFileURL"= 0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk /r \??\f:\0autocheck autochk * [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\McAfee\Common Framework\FrameworkService.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R2 McAfeeEngineService;McAfee Engine Service;C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe [x] R2 mfevtp;McAfee Validation Trust Protection Service;C:\WINDOWS\system32\mfevtps.exe [x] R3 ids00026;ids00026;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys [x] R3 klstm;klstm;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\klstm.sys [x] R3 mferkdet;McAfee Inc. mferkdet;C:\WINDOWS\system32\drivers\mferkdet.sys [x] R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 12:33:12 89256] R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 12:33:14 15016] R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 12:33:12 120744] R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 12:33:12 114216] R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 12:33:14 25512] R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 12:33:12 110632] R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 12:33:14 115752] S3 seehcri;Sony Ericsson seehcri Device Driver;C:\WINDOWS\system32\DRIVERS\seehcri.sys [2008-01-09 11:28:34 27632] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Tâches planifiées' 2010-02-28 C:\WINDOWS\Tasks\Maintenance en 1 clic.job - C:\Program Files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-12 15:04:34 . 2008-12-12 15:04:34] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.webshots.com/r/internal/start/client/RAND uInternet Connection Wizard,ShellNext = iexplore IE: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 DPF: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab . - - - - ORPHELINS SUPPRIMES - - - - AddRemove-KB923789 - C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe AddRemove-McAfee Anti-Spyware Enterprise Module - C:\Program Files\McAfee\VirusScan Enterprise\scan32.exe

moussadelemouzie · Answer

truecode voici les differents lien :

voici le lien  du log .txt (  http://www.cijoint.fr/cjlink.php?file=cj201002/cij5puySZG.txt)
voici le lien de info.txt (  http://www.cijoint.fr/cjlink.php?file=cj201002/cijh68tuJT.txt)

truecode · Answer

Il y a un soucis avec les liens que tu as donnés je n'y ai pas accès sinon dans un premier message sur le forum poste le fichier log.txt et dans un deuxième info.txt

moussadelemouzie · Answer

voici le fichier log.txt

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2010-02-28 17:52:09
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 10 GB (55%) free of 18 GB
Total RAM: 247 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:52:10, on 28/02/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
F:\rsit\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrateur.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webshots.com/r/internal/start/client/RAND
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [20198] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rjvjlsvw.exe
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: ihaupd32.exe
O4 - Startup: sysfgs32.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
O23 - Service: Service McAfee Framework (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

moussadelemouzie · Answer

voivi le fichier info.txt

info.txt logfile of random's system information tool 1.06 2010-02-28 17:52:15

======Uninstall list======

-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ABBYY FineReader 6.0 Sprint-->MsiExec.exe /I{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
Adobe Reader 7.0.8 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70800000002}
ArcSoft PhotoImpression 2000-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{68CF04B1-A3B4-472D-BF4C-1B562EE2BE17}\Setup.exe" -l0x40c 
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Concord 5040 Camera Drivers-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1B7AA282-90DF-47F2-B14D-68E387B5F2BA}\setup.exe" 
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Converter-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
EPSON Attach To Email-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
EPSON Copy Utility 3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{67EDD823-135A-4D59-87BD-950616D6E857}\SETUP.EXE" -l0x40c -UnInstall
EPSON Easy Photo Print-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BC69DDB8-4840-4D9B-BB31-0D4DB2BA1312}\SETUP.EXE" -l0x40c UNINST
EPSON File Manager-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E86BC406-944E-41F6-ADE6-2C136734C96B}\Setup.exe" -l0x40c UNINST
EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
EPSON Scan Assistant-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}\Setup.exe" -l0x40c -u
EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r
ESDX5000_CX4900 Guide d’utilisation-->C:\Program Files\EPSON\TPMANUAL\ESDX5000_CX4900\USE_G\DOCUNINS.EXE
Formation Microsoft Interactive-->D:\Program Files\MSPress\Training\lunins32_s.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Intel(R) 845G Chipset Graphics Driver Software-->RUNDLL32.EXE C:\Windows\System32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2562
Intel(R) PRO Ethernet Adapter and Software-->Prounstl.exe
Lecteur Windows Media 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
McAfee Agent-->MsiExec.exe /X{A638557B-1F13-40A0-9627-C892FBCA6960}
McAfee VirusScan Enterprise-->MsiExec.exe /I{147BCE03-C0F1-4C9F-8157-6A89B6D2D973}
Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A4040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Speech Recognition Engine 4.0 (English)-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\mscsrgpc.inf, Uninstall.NT
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Opera 9.10-->MsiExec.exe /X{750B9AD1-4C63-4143-94C5-6FB304199BAD}
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
PIF DESIGNER-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B90450DF-E781-46FD-B1F1-0C86DA40E443}\SETUP.EXE" -l0x40c anything
RS Somnífero-->"D:\Program Files\Rico Software\RS Somnífero\desinstalar.exe"
Samsung PC Studio II 2.0 Image Editor-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8148F35A-B15C-465B-80C2-DC0E1234EC20}\setup.exe" -l0x40c 
Samsung PC Studio II 2.0 Internet Access-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7754BD1A-71B0-46B5-9560-1BE856E71423}\Setup.exe" -l0x40c 
Samsung PC Studio II 2.0 Sample-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1C27BA8F-0E90-4316-9F71-C0B55362A294}\Setup.exe" -l0x40c 
Samsung USB Driver (MCCI 4.24)-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{77F09242-A107-4CB6-A295-D8656C2C3795} 
Skrabble 7.5-->"C:\Program Files\Skrabble\suppression 7.5.exe"
SmartMovie Converter-->"C:\Program Files\Lonely Cat Games\SmartMovie Converter\IIUninst.exe" C:\Program Files\Lonely Cat Games\SmartMovie Converter\install.log
SmartSound Quicktracks Plugin-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E} 
SuperCopier2-->"C:\Program Files\SuperCopier2\SC2Uninst.exe"
Total Video Converter 3.11 070908-->"C:\Program Files\Total Video Converter\unins000.exe"
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
WiDESYNC 2.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11AEA686-CD61-4C11-B410-330119375147}\setup.exe" -l0x40c 
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
WinZip-->"C:\Program Files\WinZip\WINZIP32.EXE" /uninstall

=====HijackThis Backups=====

O4 - HKLM\..\Run: [XP-CCE4345D] C:\WINDOWS\system32\XP-CCE4345D.EXE [2009-11-19]
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize [2009-11-19]
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE [2009-11-19]
O4 - HKLM\..\Run: [EPSON Stylus DX5000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE /FU "C:\WINDOWS\TEMP\E_S93.tmp" /EF "HKLM" [2009-11-19]
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe [2009-11-19]
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe [2009-11-19]
O4 - Startup: ¡¡¡¡¡¡.lnk = C:\WINDOWS\system32\XP-CCE4345D.EXE [2009-11-19]
O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\olhrwef.exe [2009-11-19]
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe [2009-11-19]
O18 - Protocol: msebe - {B94D1601-4929-11D3-99FF-00104B2D62CC} - (no file) [2009-11-19]
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe [2009-11-19]
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe [2009-11-19]
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll [2009-11-19]
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file) [2009-11-19]

======Security center information======

AV: McAfee VirusScan Enterprise (outdated)

======System event log======

Computer Name: NIBON
Event Code: 7036
Message: Le service Services Terminal Server est entré dans l'état : en cours d'exécution.

Record Number: 77355
Source Name: Service Control Manager
Time Written: 20091217184539.000000+000
Event Type: Informations
User: 

Computer Name: NIBON
Event Code: 7036
Message: Le service NLA (Network Location Awareness) est entré dans l'état : en cours d'exécution.

Record Number: 77354
Source Name: Service Control Manager
Time Written: 20091217184539.000000+000
Event Type: Informations
User: 

Computer Name: NIBON
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Services Terminal Server.

Record Number: 77353
Source Name: Service Control Manager
Time Written: 20091217184539.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: NIBON
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service NLA (Network Location Awareness).

Record Number: 77352
Source Name: Service Control Manager
Time Written: 20091217184539.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: NIBON
Event Code: 17
Message: 
Record Number: 77351
Source Name: avgntflt
Time Written: 20091217184531.000000+000
Event Type: Informations
User: 

=====Application event log=====

Computer Name: NIBON
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 6579
Source Name: SecurityCenter
Time Written: 20090402030533.000000+000
Event Type: Informations
User: 

Computer Name: NIBON
Event Code: 102
Message: wuaueng.dll (2724) SUS20ClientDataStore: Le moteur de base de données a démarré une nouvelle instance (0).

Record Number: 6578
Source Name: ESENT
Time Written: 20090401220145.000000+000
Event Type: Informations
User: 

Computer Name: NIBON
Event Code: 100
Message: wuauclt (2724) Le moteur de base de données 5.01.2600.2180 est démarré.

Record Number: 6577
Source Name: ESENT
Time Written: 20090401220145.000000+000
Event Type: Informations
User: 

Computer Name: NIBON
Event Code: 101
Message: wuauclt (1576) Le moteur de base de données est arrêté.

Record Number: 6576
Source Name: ESENT
Time Written: 20090401215535.000000+000
Event Type: Informations
User: 

Computer Name: NIBON
Event Code: 103
Message: wuaueng.dll (1576) SUS20ClientDataStore: Le moteur de base de données a arrêté une instance (0).

Record Number: 6575
Source Name: ESENT
Time Written: 20090401215535.000000+000
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;C:\Program Files\Fichiers communs\Ulead Systems\MPEG
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=0207
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SMS_LOCAL_DIR"=C:\WINDOWS
"FP_NO_HOST_CHECK"=NO
"DEFLOGDIR"=C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection
"VSEDEFLOGDIR"=C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection
"SAFEBOOT_OPTION"=NETWORK

-----------------EOF-----------------

truecode · Answer

Merci c'est parfait tu as une infection viens d'un disque amovibles:

Alors on commence par cela ! 

• Télécharge UsbFix http://www.commentcamarche.net/telecharger/telecharger-34066197-usbfix (de Chiquitine29 & C_XX) sur ton Bureau.
•  Lance l'installation avec les paramètres par défaut.
• Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.
•  Double-clique sur le raccourci UsbFix sur ton Bureau.
•  Choisis l'option 2 (Suppression).
•  Ton Bureau disparaîtra et le PC redémarrera.
•  Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.
•  Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau. 


Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).   
 

Puis : (le scan est long mais efficace ) 


 Télécharge Malwarebytes' Anti-Malware (MBAM) http://www.malwarebytes.org/mbam-download.php

Avant tous il faut brancher tous les supports amovibles que tu possède avant de faire ce scan ( disque dur externes , clé usb ... )

   1. Double clique sur le fichier téléchargé
   2. Dans l'onglet "Mise à jour", clique sur "Recherche de mise à jour": si ton parefeu te demande de d'autoriser MBAM accepte
   3. Quand la mise à jour est terminé va dans l'onglet
   4. Tu sélectionne "Exécuter un examen complet"
   5. Puis tu clique sur"Rechercher"

      L'analyse démarre, le scan est relativement long, c'est normal.

      A la fin de l'analyse, un message s'affiche :

   6. L'examen s'est terminé normalement. Il te reste a cliquer sur"Afficher les résultats" pour afficher tous les objets trouvés.

   7. Maintenant tu clique sur "Ok" pour poursuivre.
   8.Ferme tes navigateurs ( firefox , internet explorer , chrome , opéra...)
   9. Si MBAM à détecter des malwares, clique sur "Afficher les résultats".
  10.Sélectionne tout et clique sur"Supprimer la sélection",MBAM va supprimer tous les fichiers infectés.
  11. Le Bloc-notes va s'ouvrir avec le rapport d'analyse
  12. Fais un copier coller de ce rapport etposte-le dans ton prochain message.

moussadelemouzie · Answer

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3811
Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 6.0.2900.2180

02/03/2010 00:20:30
mbam-log-2010-03-02 (00-20-30).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|)
Eléments examinés: 274644
Temps écoulé: 2 hour(s), 11 minute(s), 55 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 7
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 84

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\_VOID (Rootkit.TDSS) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\adtools, inc. (Adware.AdTools) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Dr. Guard (Rogue.DrGuard) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell (Worm.AutoRun) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
ofolderoptions (Hijack.FolderOptions) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	askman (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (C:\RECYCLER\S-1-5-21-6632556949-2036514835-157605608-2275
issan.exe,explorer.exe,C:\RECYCLER\S-1-5-21-9181420850-6924922956-130027392-9873\wnzip32.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Dr. Guard (Rogue.DrGuard) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\Administrateureader_s.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Bureau\LOGO\SmartMovie.Converter.KeyGen.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Bureau\Nouveau dossier\Total Video Converter 3.11 + 100% Working Crack & Serial\Crack.exe (Trojan.WGAPatch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\319bcf94.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\7ccc68d4.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\asd15.tmp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\asd1B.tmp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\asd25.tmp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\asd37.tmp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\asd3A.tmp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\elika.exe (Trojan.Sasfis) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\f8ad6d06.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\fjuxal.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\fkdvfge.exe (Trojan.Sasfis) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\jnnpkn.exe (Trojan.Sasfis) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\SPAM.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\TMP1.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\TMP2.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\TMP3.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\TMP4.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\TMP7.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\wioxoup.exe (Trojan.Sasfis) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM11.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM12.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM16.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM21.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM22.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM29.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM32.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM34.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM3C.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM5.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TM7.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\~TMA.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2PSVS7WJ\arzuoz[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2PSVS7WJ\arzuoz[2].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\2PSVS7WJ\ycpxe[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\39EZOTU3\loaderadv563[1].exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\39EZOTU364winnt[1].exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LXV0SD9P\ysautnmg[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LXV0SD9P\zqksqlje[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\SV2XUHSF\ycpxe[2].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\SV2XUHSF\ysautnmg[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\SV2XUHSF\zqksqlje[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage\ihaupd32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Documents\Total Video Converter 3.11 + 100% Working Crack & Serial\Crack.exe (Trojan.WGAPatch) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe (Worm.Autorun.B) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-6632556949-2036514835-157605608-2275
issan.exe (Worm.Autorun.B) -> Delete on reboot.
C:\RECYCLER\S-1-5-21-9181420850-6924922956-130027392-9873\wnzip32.exe (Worm.Autorun.B) -> Delete on reboot.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0450072.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0450073.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0450076.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0450152.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0450153.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0450155.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0453291.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0453292.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0453295.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\system32eader_s.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\system32egedit.exe (Trojan.Sasfis) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\jkqvj.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
D:\Dossiers Web\Total Video Converter 3.11 + 100% Working Crack & Serial\Crack.exe (Trojan.WGAPatch) -> Quarantined and deleted successfully.
D:\Nicko Doc
ero7\Keygen\Nero.Burning.ROM.6.6.0.16.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
D:\Nicko Doc
ero7\Keygen\Nero.Burning.ROM.7.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Nicko Doc
ero7\Keygen\Nero.Media.Player.1.4.0.32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
D:\Nicko Doc
ero7\Keygen\NeroMix.1.4.0.32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
D:\Nicko Doc
ero7\Keygen\NeroVision.Express.3.1.0.7.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
D:\Nouveau Porte-documents\Fouo Adama à Nibon\3gp convertor\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Nouveau Porte-documents\Fouo Adama à Nibon\Total Video Converter 3.11 + 100% Working Crack & Serial\Crack.exe (Trojan.WGAPatch) -> Quarantined and deleted successfully.
F:\moussa.doc                                                                                           .exe (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
F:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx (Worm.Conficker) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Dr. Guard\drg.db (Rogue.DrGuard) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	empjvjlsvw.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\_VOID429e.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\wiaservg.log (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Bureau
udetube.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Bureau\pornotube.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Bureau\youporn.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\og.dll (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ul.dll (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings	emp\asr64_ldm.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

moussadelemouzie · Answer

excuse moi excuse moi pour le retard il y a des coupure d electricite ici

############################## | UsbFix V6.097 |

User : Administrateur (Administrateurs) # NIBON
Update on 20/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 18:26:01 | 01/03/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

              Intel(R) Pentium(R) 4 CPU 2.40GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled
AV : McAfee VirusScan Enterprise 8.7.0.570 [ Enabled | (!) Outdated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 17,2 Go (9,26 Go free) [ ] # NTFS
D:\ -> Disque fixe local # 20,07 Go (4,14 Go free) # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 988,48 Mo (633,98 Mo free) [MUSS] # FAT32
G:\ -> Disque amovible # 1007,77 Mo (713,38 Mo free) [HOLLISSAGA] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Elements infectieux |

C:\Documents and Settings\Administrateureader_s.exe  
C:\WINDOWS\autorun.ini  
C:\WINDOWS\System32\Christina.jpg  
C:\WINDOWS\System32\og.dll  
C:\WINDOWS\System32\ul.dll  
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\010.exe  
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\411.exe  
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\620.exe  
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\780.exe  
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\938.exe  
C:\Anti_copy_V0.1.bat   
C:\lsass.exe  
C:\Recycler\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe   
C:\Recycler\S-1-5-21-0243936033-3052116371-381863308-1811\Desktop.ini  
C:\Recycler\S-1-5-21-0243936033-3052116371-381863308-1811  
C:\Recycler\S-1-5-21-6632556949-2036514835-157605608-2275
issan.exe  
C:\Recycler\S-1-5-21-6632556949-2036514835-157605608-2275\Desktop.ini  
C:\Recycler\S-1-5-21-6632556949-2036514835-157605608-2275  
C:\Recycler\S-1-5-21-9181420850-6924922956-130027392-9873\wnzip32.exe  
C:\Recycler\S-1-5-21-9181420850-6924922956-130027392-9873\Desktop.ini  
C:\Recycler\S-1-5-21-9181420850-6924922956-130027392-9873  
D:\Anti_copy_V0.1.bat   
F:\autorun.inf -> fichier appelé : "F:\RECYCLER\autorun.exe" ( Présent ! )  
F:\autorun.inf  
F:\zPharaoh.exe  
F:\.\RECYCLER\autorun.exe  
F:\Recycled.exe  
F:\RECYCLER\autorun.exe   
F:\SLATKO\Desktop.ini  
F:\SLATKO  
F:\1.taz  
F:\zPharaoh.exe  
F:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx   
F:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665  
G:\autorun.inf -> fichier appelé : "G:\RECYCLER\autorun.exe" ( Présent ! )  
G:\autorun.inf  
G:\.\RECYCLER\autorun.exe  
G:\log.txt  
G:\RECYCLER\autorun.exe   

################## | MD5 |

F:\Recycled.exe  

################## | Mabezat |

F:\fran-ang.exe  
F:\zPharaoh.exe  
F:\drweb-500-win-space.exe  
F:\drweb-500-win98-ru.exe  
F:\moussa.doc                                                                                           .exe  
F:\Recycled.exe  
F:\TREBALJO\TREBALJO                                                                                             .exe  
F:\TREBALJO\NokiaN73Tools.exe  
F:\SLATKO\SLATKO                                                                                               .exe  
F:\Le clavier_fichiers\Le clavier_fichiers .exe  
F:\Le clavier_fichiers\Make Windows Original.exe  
F:\RECYCLER\RECYCLER                                                                                             .exe  
F:\RECYCLER\NokiaN73Tools.exe  
F:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\S-1-6-21-2434476501-1644491937-600003330-1213 .exe  
F:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Office2003 CD-Key.doc.exe  
F:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\S-5-3-42-2819952290-8240758988-879315005-3665 .exe  
F:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\Office2007 Serial.txt.exe  
F:\Clavier d'ordinateur - Wikip‚dia_fichiers\Clavier d'ordinateur - Wikip‚dia_fichiers .exe  
F:\Clavier d'ordinateur - Wikip‚dia_fichiers\Office2003 CD-Key.doc.exe  
F:\WordArt_fichiers\WordArt_fichiers                                                                                     .exe  
F:\WordArt_fichiers\Office2007 Serial.txt.exe  
F:\Rihanna & Beyonce - The Don Divas\Rihanna & Beyonce - The Don Divas .exe  
F:\Rihanna & Beyonce - The Don Divas\Make Windows Original.exe  
F:\TREBALJO\NokiaN73Tools.exe  
F:\SLATKO\WinrRarSerialInstall.exe  
F:\Le clavier_fichiers\Make Windows Original.exe  
F:\RECYCLER\NokiaN73Tools.exe  
F:\Rihanna & Beyonce - The Don Divas\Make Windows Original.exe  

################## | Registre |

[HKLM\software\microsoft\shared tools\msconfig\startupreg\Yahoo Messengger]  
[HKLM\SYSTEM\CurrentControlSet\Services\AVPsys]  
[HKLM\SYSTEM\ControlSet002\Services\AVPsys]  
[HKLM\SYSTEM\ControlSet003\Services\AVPsys]  
[HKLM\SYSTEM\ControlSet004\Services\AVPsys]  
[HKLM\software\microsoft\windows nt\currentversion\winlogon] "Taskman"  
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	askmgr.exe]  
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoClose"  
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"  
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoFolderOptions"  
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoWinKeys"  

################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{43c5b70d-a214-11da-9727-000802e4bcff}
Shell\AutoRun\command =gbha.bat 
Shell\open\Command =gbha.bat 

HKCU\..\..\Explorer\MountPoints2\{584e2972-8d4c-11dd-94e3-000802e4bcff}
Shell\AutoRun\command =F:\DRIVER///vozacka.exe 
Shell\explore\command =F:\DRIVER//vozacka.exe 
Shell\open\command =F:\DRIVER//vozacka.exe 

HKCU\..\..\Explorer\MountPoints2\{5cdd8678-d9f0-11de-97a6-000802e4bcff}
Shell\AutoRun\command =F:\DRIVER///vozacka.exe 
Shell\explore\command =F:\DRIVER//vozacka.exe 
Shell\open\command =F:\DRIVER//vozacka.exe 

HKCU\..\..\Explorer\MountPoints2\{726702f6-b741-11dd-9560-000802e4bcff}
Shell\AutoRun\command =bpu.exe 
Shell\explore\Command =bpu.exe 
Shell\open\Command =bpu.exe 

HKCU\..\..\Explorer\MountPoints2\{74827c3e-70a8-11de-96cb-000802e4bcff}
Shell\AutoRun\command =F:\aphqg.exe 
Shell\open\Command =F:\aphqg.exe 

HKCU\..\..\Explorer\MountPoints2\{761998ae-67d8-11dd-9458-000802e4bcff}
Shell\AutoRun\command =yltt8jpm.bat 
Shell\explore\Command =yltt8jpm.bat 
Shell\open\Command =yltt8jpm.bat 

HKCU\..\..\Explorer\MountPoints2\{8ad3ccc8-7f3d-11de-96f2-000802e4bcff}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Wscript.exe /e:vbs winfile.jpg

################## | Vaccin |


################## | ! Fin du rapport # UsbFix V6.097 ! |

truecode · Answer

Bonjour , 

J'ai pas l'impression que tu as supprimer les menaces avec USBFIX :


• Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.
• Double-clique sur le raccourci UsbFix présent sur ton Bureau pour le lancer.
•  Choisis l'option 2 (Suppression).
•  Ton Bureau disparaîtra et le PC redémarrera.
•  Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.
•  Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau. 


Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).   

Ensuite fais un nouveau scan avec RSIT et poste le rapport log.txt

moussadelemouzie · Answer

############################## | UsbFix V6.097 |

User : Administrateur (Administrateurs) # NIBON
Update on 20/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 22:30:27 | 03/03/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

              Intel(R) Pentium(R) 4 CPU 2.40GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled
AV : McAfee VirusScan Enterprise 8.7.0.570 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 17,2 Go (8,92 Go free) [ ] # NTFS
D:\ -> Disque fixe local # 20,07 Go (4,14 Go free) # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 988,48 Mo (748,65 Mo free) [MUSS] # FAT32
G:\ -> Disque amovible # 1007,77 Mo (1007,76 Mo free) [HOLLISSAGA] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\mfevtps.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\McAfee\Common Framework
aPrdMgr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\MS\SMS\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe

################## | Elements infectieux |


################## | Registre |

Supprimé ! [HKLM\software\microsoft\shared tools\msconfig\startupreg\Mswinword]  
Supprimé ! [HKLM\SYSTEM\CurrentControlSet\Services\AVPsys]  
Supprimé ! [HKLM\SYSTEM\ControlSet002\Services\AVPsys]  
Supprimé ! [HKLM\SYSTEM\ControlSet004\Services\AVPsys]  
Supprimé ! [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	askmgr.exe]  
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoClose"  
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"  
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoFolderOptions"  
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoWinKeys"  

################## | Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{43c5b70d-a214-11da-9727-000802e4bcff}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{584e2972-8d4c-11dd-94e3-000802e4bcff}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{5cdd8678-d9f0-11de-97a6-000802e4bcff}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{726702f6-b741-11dd-9560-000802e4bcff}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{74827c3e-70a8-11de-96cb-000802e4bcff}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{761998ae-67d8-11dd-9458-000802e4bcff}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{8ad3ccc8-7f3d-11de-96f2-000802e4bcff}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[05/05/2004 09:29|--a------|0] C:\AUTOEXEC.BAT 
[20/07/2008 14:13|--a--c---|212] C:\Boot.bak 
[20/07/2008 14:13|---hsc---|212] C:\boot.ini 
[28/09/2001 11:00|-rahsc---|4952] C:\Bootfont.bin 
[11/11/2003 16:46|--a------|346112] C:\ClnPoza.com 
[11/05/2004 12:21|--a------|366080] C:\ClnSasser.com 
[03/08/2004 23:00|--a--c---|263488] C:\cmldr 
[03/03/2010 23:05|--a--c---|358] C:\Collections.html 
[05/05/2004 09:29|--a------|0] C:\CONFIG.SYS 
[19/05/2005 09:23|--a------|1] C:\excel.ini 
[02/06/2005 22:23|--a------|24] C:\excelxp.ini 
[24/04/2008 20:43|--a--c---|5] C:\FavoriteDirs.txt 
[?|?|?] C:\hiberfil.sys 
[05/05/2004 09:29|-rahs----|0] C:\IO.SYS 
[05/05/2004 09:29|-rahs----|0] C:\MSDOS.SYS 
[03/08/2004 22:38|-rahsc---|47564] C:\NTDETECT.COM 
[03/08/2004 22:59|-rahs----|251712] C:
tldr 
[?|?|?] C:\pagefile.sys 
[14/11/2006 14:34|--a--c---|900] C:\PlayList.txt 
[10/12/2006 10:13|--a--c---|19387] C:\sig3D6.dat 
[06/01/2007 10:07|--a--c---|19387] C:\sigF.dat 
[10/12/2006 09:52|--a--c---|10] C:\site.ini 
[03/03/2010 23:10|--a--c---|4741] C:\UsbFix.txt 
[10/12/2006 10:13|--a--c---|414] C:\vir3D5.log 
[06/01/2007 10:07|--a--c---|414] C:\virE.log 
[27/11/2008 09:58|--a------|45078] D:\10.jpg 
[25/09/2008 20:08|--a------|23552] D:\a lire.doc 
[30/09/2009 16:14|--a------|91648] D:\ABONNEMENT CANAL HORIZON.doc 
[30/03/2008 22:59|--a------|16384] D:\adp1.adp 
[30/03/2008 22:59|--a------|11776] D:\adp2.adp 
[29/08/2006 11:29|--a------|239104] D:\Aide scolaire Ulrich.doc 
[12/02/2007 22:26|--a------|21504] D:\AMITIE.doc 
[15/05/2006 12:14|--a------|61952] D:\Apprentissage.xls 
[30/09/2009 14:49|--a------|265216] D:\ATTESTATION Lionel.doc 
[30/09/2009 17:01|--a------|354304] D:\ATTESTATION PROVISOIRE CESAR.doc 
[30/09/2009 17:01|--a------|265728] D:\ATTESTATTION Alida.doc 
[13/10/2008 20:34|--a------|159232] D:\Au cas ou nous aurions oublier.ppt 
[07/12/2008 23:38|--a------|0] D:\av-i386-cumul.zip 
[21/08/2008 11:08|--a------|19079749] D:\AVSEQ01.flv 
[04/07/2006 11:59|--a------|20480] D:\BABA.doc 
[07/10/2008 16:44|--a------|63488] D:\BCEAO.doc 
[23/01/2009 14:32|--a------|23552] D:\BIAO-Avance SAPH.doc 
[26/01/2009 19:07|--a------|24064] D:\BIAO-Avance.doc 
[16/04/2008 17:01|--a------|15727416] D:\brico-pack-crystal-xp-crystalxp.net-fr-117.zip 
[22/09/2009 13:19|--a------|465920] D:\BULLETIN CESAR.doc 
[11/02/2009 00:05|--a------|532480] D:\Carte visite Ciss‚.doc 
[02/08/2008 17:02|--a------|3363] D:\cc_20080802_1701.reg 
[06/07/2006 09:51|--a------|28160] D:\CE QUE JE CROIS  B‚chir Ben Yahmed.doc 
[13/10/2008 22:05|--a------|202752] D:\CEPE.doc 
[03/07/2009 17:26|--a------|20480] D:\CERTIFICAT DE TRAVAIL.doc 
[18/02/2010 09:38|--a------|27136] D:\chapitre 4 eco 2bt.doc 
[21/09/2008 15:51|--a------|19456] D:\Classeur1 AJEEM.xls 
[15/05/2006 23:15|--a------|20992] D:\Classeur1.xls 
[02/11/2006 08:05|--a------|1333] D:\Collecti.htm 
[10/12/2007 00:14|--a------|20480] D:\CONCLUSION.doc 
[27/03/2009 17:35|--a------|41984] D:\CONTRAT DE BAIL.doc 
[12/09/2006 09:25|--a------|92630] D:\Copie de Conf‚rence de Paris.pdf 
[08/04/2004 18:00|--a------|6634] D:\copymode7_n1.bmp 
[06/12/2006 11:33|--a------|23040] D:\Cotisatø-ouverture-centre de sant‚.xls 
[04/10/2008 18:30|--a------|51200] D:\Crise financiere mondiale.doc 
[29/09/2008 12:39|--a------|28160] D:\CULTURES DU MONDE.doc 
[29/10/2007 14:57|--a------|35328] D:\CV & Letre motiv‚e Nibon.doc 
[14/05/2008 10:32|--a------|49152] D:\CV AMI.doc 
[25/08/2009 22:07|--a------|74240] D:\CV.doc 
[02/10/2006 14:22|--a------|25088] D:\DECHETS TOXIQUES.doc 
[11/03/2007 09:15|--a------|21504] D:\DECORATION.doc 
[30/11/2008 10:14|--a------|21504] D:\Demande de convention.doc 
[17/08/2009 00:05|--a------|26624] D:\DEPARTMENT OF STATE.doc 
[17/08/2009 00:15|--a------|24576] D:\DEPARTMENT OF STATES TRADUIT.doc 
[20/07/2008 14:41|--ahs----|86] D:\desktop.ini 
[13/04/2008 11:24|--a------|27648] D:\DEVOIR d'ECONOMIE GENERALE 1AG1 BT.doc 
[31/05/2005 13:26|--a------|1709568] D:\DIAGRAMME.doc 
[09/11/2008 20:44|--a------|143273] D:\Diversity Visa Lottery 2009 (DV-2009) Results.htm 
[09/11/2008 20:44|--a------|20827] D:\Diversity Visa Program.htm 
[01/03/2007 22:43|--a------|33792] D:\Dj‚n‚ba.doc 
[09/11/2008 20:41|--a------|13360] D:\DoS Electronic Diversity Lottery System (EDV) 2010.htm 
[13/10/2008 20:44|--a------|7951] D:\Dromadaire_com  5000 cartes de voeux virtuelles sur tous les thŠmes  anniversaire, amour, humour, amour, travail, mariages, carte de voeux, ‚v‚nements__.htm 
[21/05/2007 01:08|--a------|43008] D:\D‚co'In.doc 
[06/11/2008 12:46|--a------|40448] D:\E-Mail.doc 
[11/02/2009 11:39|--a------|499200] D:\Entˆte CISSE.doc 
[26/01/2009 18:51|--a------|19968] D:\Etiquette.doc 
[02/11/2006 07:54|--a------|47] D:\Favorite.txt 
[11/05/2004 15:07|--a------|188] D:\FONT95.GIF 
[11/05/2004 15:07|--a------|163] D:\FONTH.GIF 
[29/10/2007 13:33|--a------|1795584] D:\Forum Photo.doc 
[26/01/2009 16:56|--a------|22016] D:\Forˆt d‚class‚e.doc 
[26/09/2005 20:08|--a------|1529344] D:\Gargamel et Azra‰l.ppt 
[27/09/2006 12:19|--a------|24064] D:\Germaine.doc 
[18/11/2005 17:19|--a------|112260] D:\ghost.gst 
[10/12/2007 00:14|--a------|19968] D:\II PRESENTATION DE LECON.doc 
[03/10/2008 16:00|--a------|268823] D:\img Nibon GC017.jpg 
[03/10/2008 15:38|--a------|257208] D:\img016.jpg 
[30/01/2009 20:00|--a------|26624] D:\INDEMNITES.doc 
[24/04/2008 09:52|--a------|105984] D:\inspection 1.doc 
[01/05/2008 12:54|--a------|117248] D:\INSPECTION PEDAGOGIQUE 2.doc 
[02/11/2005 11:22|--a------|578] D:\install.win 
[01/05/2008 13:22|--a------|21504] D:\INTERROGATION ECRITE.doc 
[17/11/2008 10:06|--a------|15699] D:\Kentucky Consular Center Information.htm 
[09/12/2007 19:45|--a------|42496] D:\L' OUTIL D'EVALUATION SOMMATIVE.doc 
[30/12/2008 17:03|--a------|1372160] D:\L'ECONOMIE DE LA CâTE D'IVOIRE.doc 
[11/10/2008 20:11|--a------|42496] D:\Lait Chinois.doc 
[03/04/2008 13:52|--a------|109568] D:\LE CIRCUIT DE DISTRIBUTION DU PRODUIT.doc 
[30/11/2007 19:04|--a------|33280] D:\Le cri de la gargouille.doc 
[08/10/2008 13:54|--a------|51712] D:\Le faux mythe du sauveur.doc 
[09/12/2007 22:11|--a------|113152] D:\LECON PREPAREE ENTIEREMENT nø1.doc 
[09/12/2007 22:14|--a------|73728] D:\LECON SIMPLIFIEE 3.doc 
[09/12/2007 22:19|--a------|75776] D:\LECON SIMPLIFIEE 6.doc 
[09/12/2007 22:19|--a------|64512] D:\LECON SIMPLIFIEE 7.doc 
[14/05/2008 09:34|--a------|22016] D:\Lettre motiv‚e.doc 
[30/08/2009 22:52|--a------|20992] D:\Lettre recommand‚e.doc 
[23/01/2008 10:44|--a------|104448] D:\LISTE DES ELEVES ET ETUDIANTS DE MOUGNINI 2006.doc 
[03/02/2009 17:08|--a------|46080] D:\Liste Retenue.doc 
[18/02/2009 09:25|--a------|24064] D:\MAE.doc 
[22/09/2009 15:50|--a------|42496] D:\MESMIN.doc 
[03/02/2007 11:01|--a------|20480] D:\NANA.doc 
[19/02/2009 09:32|--a------|21504] D:\NIOTE CIRCULAIRE.doc 
[04/12/2006 10:15|--a------|50688] D:\Note au MDPEF.doc 
[23/01/2008 07:53|--a------|0] D:\Nouveau Document texte.txt 
[16/11/2006 11:26|--a------|22016] D:\N‚gritude.doc 
[03/04/2008 14:05|--a------|130560] D:\PAGE DE GARDE2.ppt 
[19/02/2009 09:51|--a------|24064] D:\pannau II.doc 
[02/02/2009 22:59|--a------|20480] D:\Panneau.doc 
[17/12/2007 15:27|--a------|570368] D:\partie 1 dp souley.doc 
[02/11/2006 08:04|--a------|1386] D:\PlayList.txt 
[23/08/2009 16:57|--a------|35840] D:\POLLUTION 2.doc 
[23/08/2009 17:06|--a------|29184] D:\POLLUTION MEMEO.doc 
[23/08/2009 16:48|--a------|22016] D:\POLLUTION QUESTIONNAIRE.doc 
[30/12/2008 21:31|--a------|41472] D:\POLLUTION.doc 
[09/01/2008 20:18|--a------|25088] D:\PRESENTATION DU DOSSIER PEDAGOGIQUE solo.doc 
[20/11/2009 08:09|--a------|22016] D:\PROCURATION DECHETS TOXIQUES.doc 
[04/08/2006 16:32|--a------|21504] D:\PROGRAMME DES FESTIVITES.doc 
[11/12/2006 10:59|--a------|336] D:\Raccourci vers Docs.lnk 
[17/11/2008 12:05|--a------|1154560] D:\Rapport Pyen.doc 
[23/01/2008 10:45|--a------|15360] D:\Recherche emploi.xls 
[18/11/2005 17:19|--a------|169720] D:eplay.rp3 
[30/12/2008 13:56|--a------|120832] D:\RH-ADM.doc 
[22/01/1996 04:59|--a------|47616] D:\SETUP.EXE 
[22/05/2000 20:02|--a------|36] D:\SETUP.INI 
[16/02/1996 02:41|---------|144778] D:\SETUP.INS 
[22/05/2000 20:02|--a------|498] D:\SETUP.ISS 
[22/05/2000 20:02|--a------|457] D:\SETUP.PKG 
[18/11/2006 16:28|--a------|123392] D:\Soci‚t‚ Plexi I.ppt 
[14/11/2007 12:42|--a------|25088] D:\Soins m‚dicaux de S. Excellence.xls 
[25/02/2007 10:05|--a------|82944] D:\solo entreprise.doc 
[03/01/2009 00:21|--a------|589824] D:\SOUM BILL (africa).mp3 
[24/04/2008 09:21|--a------|26112] D:\STRUCTURE DE LA CONSOMMATION.doc 
[15/02/2010 19:48|--a------|26624] D:\sujet eco-gle BT3.doc 
[30/01/2009 19:59|--a------|34304] D:\Tableau Indemnit‚s.doc 
[17/12/2007 21:45|--a------|77312] D:\Tableau OP.doc 
[16/07/2008 17:43|--a------|32256] D:\Traor‚ Ngoui.doc 
[24/07/2005 22:24|--a------|35328] D:\Whily.doc 
[22/01/1996 05:08|--a------|306666] D:\_INST32I.EX_ 
[22/05/2000 20:02|--a------|745190] D:\_SETUP.1 
[22/05/2000 20:02|--a------|912654] D:\_SETUP.2 
[06/10/1995 09:35|--a------|10240] D:\_SETUP.DLL 
[22/05/2000 20:02|--a------|190290] D:\_SETUP.LIB 
[22/11/2006 16:28|--ah-----|162] D:\~$ cri de la gargouille.doc 
[12/03/2005 23:49|--ah-----|162] D:\~$NS PEJ.doc 
[27/08/2005 22:39|--ah-----|162] D:\~$R RAPPORT 2.doc 
[10/03/2005 17:24|--ah-----|162] D:\~$SIR.doc 
[30/09/2009 11:29|--ah-----|162] D:\~$TESTATION Lionel.doc 
[12/03/2005 23:46|--ah-----|162] D:\~$URNISSEUR.doc 
[22/11/2006 16:44|---h-----|25600] D:\~WRL0167.tmp 
[17/11/2006 14:07|---h-----|25088] D:\~WRL0215.tmp 
[22/11/2006 16:58|---h-----|26112] D:\~WRL1235.tmp 
[22/11/2006 16:49|---h-----|25600] D:\~WRL3027.tmp 
[28/08/2005 00:24|---h-----|460800] D:\~WRL3053.tmp 
[27/08/2005 22:37|---h-----|460288] D:\~WRL3591.tmp 
[01/03/2010 21:36|--a------|7211] F:\UsbFix.txt 
[02/03/2010 00:21|--a------|15305] F:\mbam-log-2010-03-02 (00-20-30).txt 
[28/02/2010 20:03|--a------|5115824] F:\mbam-setup.exe 
[01/03/2010 19:01|--a------|1775008] F:\UsbFix.exe 
[28/02/2010 16:38|--a------|1614] F:\BOOTEX.LOG 
[06/10/2009 00:10|--a------|41] F:\CLE TUNE UP 2009.txt 
[28/02/2010 09:47|--a------|18869] F:\ComboFix.txt 
[27/02/2010 15:50|--a------|11975680] F:\fran-ang.exe 
[28/02/2010 17:49|--a------|3477] F:\hijackthis.log 
[28/02/2010 17:55|--a------|11388] F:\info.txt 
[27/02/2010 13:27|--a------|40] F:etablir le service framework.txt 
[27/02/2010 14:42|--a------|125595089] F:\sdat5904.exe 
[28/02/2010 18:37|--a------|6809] F:\SuperDAT.log 
[27/02/2010 15:33|--a------|21321544] F:\Trial-9.0.2010.15_fr-FR_10403.exe 
[06/09/2008 15:46|--a------|387418] F:\cours UML.pdf 

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 
# F:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 

################## | Upload | 

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_NIBON.zip : https://www.ionos.fr/?affiliate_id=77097 
Merci pour votre contribution .  

################## | ! Fin du rapport # UsbFix V6.097 ! |

moussadelemouzie · Answer

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3811
Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 6.0.2900.2180

04/03/2010 08:39:49
mbam-log-2010-03-04 (08-39-49).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|)
Eléments examinés: 274472
Temps écoulé: 8 hour(s), 28 minute(s), 0 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell (Worm.AutoRun) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (C:\RECYCLER\S-1-5-21-9181420850-6924922956-130027392-9873\wnzip32.exe,explorer.exe,C:\RECYCLER\S-1-5-21-6632556949-2036514835-157605608-2275
issan.exe,Explorer.exen) Good: (Explorer.exe) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0453369.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0453370.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0453371.exe (Trojan.WGAPatch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0453372.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0453374.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0453375.exe (Trojan.Sasfis) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46FE49C8-9ACE-4956-9BFE-DBB6BBCB68E7}\RP284\A0453376.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

truecode · Answer

Bonjour moussadelemouzie , 

Lance une nouvelle analyse avec RSIT et poste moi le nouveau rapport log.txt

moussadelemouzie · Answer

bonjour , truecode j'ai compris  mais avant je te signale que mon antivirus mcafee 8.7i n'arrive pas  à suprimer un virus du nom de lsass.exe

truecode · Answer

Poste moi quand même le rapport , petite question il te le détecte ici C:\lsass.exe?

moussadelemouzie · Answer

oui il affiche c:\lsass.exe

truecode · Answer

Alors on va le supprimer : 

OTMoveIT
Télécharger [url=http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/]OTMoveIt3 par OldTimer[/url]
Enregistrer ce fichier sur le Bureau.
Faire un double clic sur OTMoveIt3.exe pour lancer l'exécution de l'outil. (Note: Si vous utilisez Vista, faire un clic droit sur le fichier puis choisir Exécuter en tant qu'administrateur).
Copier les lignes de la zone "Code" ci-dessous dans le Presse-papiers en les sélectionnant TOUTES puis en appuyant simultanément sur les touches CTRL et C (ou, après les avoir sélectionnées, en faisant un clic droit puis en choisissant Copier):

Code:


:processes

explorer.exe

:files
c:\lsass.exe

:reg

:commands

[emptytemp]

[start explorer]

[reboot]


Retourner dans la fenêtre de OTMoveIt3, faire un clic droit dans la zone "Paste List Instruction for Items to be Moved" (sous la barre bleu clair) puis choisir Coller.
Cliquer sur le bouton rouge Moveit!.
Fermer OTMoveIt3
Reviens sur le forum, et poste le rapport généré. Celui-ci se trouve ici : C:\_OTMoveIt\MovedFiles, poster le rapport le plus récent.
Note: Si un fichier ou un dossier ne peut pas être déplacé immédiatement, un redémarrage sera peut-être nécessaire afin de terminer le processus de déplacement. Si le redémarrage de la machine vous est demandé, choisir Oui/Yes.

moussadelemouzie · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2010-03-05 18:07:49
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 10 GB (55%) free of 18 GB
Total RAM: 247 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:07:58, on 05/03/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
C:\WINDOWS\Explorer.EXE
F:\rsit\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrateur.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [16630] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iqgfypvt.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
O23 - Service: Service McAfee Framework (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

truecode · Answer

Je voulais le rapport de suppression de OTMOVEIT

moussadelemouzie · Answer

All processes killed
Error: Unable to interpret <Code: > in the current context!
========== PROCESSES ==========
Process explorer.exe killed successfully!
========== FILES ==========
File/Folder c:\lsass.exe not found.
========== REGISTRY ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 305173 bytes
->Temporary Internet Files folder emptied: 427551 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: fkouassi
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 934979 bytes
 
User: kinan
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 482064 bytes
 
User: mariama
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 147388664 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: patricia
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: sauve
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: SMSCCMBootAcct&.PREST-02
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: SMSCliSvcAcct&
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: SMSCliSvcAcct&.PREST-02
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: SMSCliToknAcct&
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: SMSCliToknLocalAcct&
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 4520564 bytes
%systemroot%\System32 .tmp files removed: 5528576 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 53422107 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 67 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 203,00 mb
 
 
OTM by OldTimer - Version 3.1.10.0 log created on 03052010_221520

Files moved on Reboot...
File C:\Documents and Settings\Administrateur\Local Settings\Temp	mp17.tmp not found!
File C:\Documents and Settings\Administrateur\Local Settings\Temp	mp1E.tmp not found!

Registry entries deleted on Reboot...

truecode · Answer

Lorsque ton antivirus le détecte il ne peut le supprimer ? 
Car la le fix ne le trouve pas

michou · Answer

je travail dans un cyber et l'un des ordinateurs est très lent de telle sorte que nous ne pouvions ouvrire un page

Mon poste est très lent

25 réponses

Discussions similaires

Newsletters