Virus résistant

je te remercie beaucoup pour tout le temps et la patience que tu m'as consacré :) c'est très gentil à toi ! bonne continuation !

- C:\Qoobox\Quarantine\C\WINDOWS\System32\Drivers\i8042prt.sys.vir
- C:\System Volume Information\_restore{BAADBF63-A8B9-4FD1-926A-BA71FFD5292A}\RP374\A0208237.sys

mais j'ai refait un scan ce matin et iln'a rien trouvé... peut-être que la mise en quarantaine a marché et que tout est bon, non ?

bonjour ! un scan avec avast, il a trouvé 2 virus du même nom, windows 32... je les ai mis en quarantaine et j'ai relancé un scan et cette fois ils n'ont pas été à nouveau détecté...penses tu que ce soit fini pour de bon, qu'ils soient partis ?

il s'appelle Win32:alureon-FZ et il a infecté 2 fichiers.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4131

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

22/05/2010 20:05:16
mbam-log-2010-05-22 (20-05-16).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|)
Elément(s) analysé(s): 195891
Temps écoulé: 33 minute(s), 21 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\Sukoku (Adware.Zwangi) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\Sukoku\sukoku119.exe (Adware.Ziniky) -> Quarantined and deleted successfully.
C:\Kill'em\Quarantine\Sukoku.Kill'em\sukoku.exe (Adware.Ziniky) -> Quarantined and deleted successfully.
C:\Kill'em\Quarantine\Sukoku.Kill'em\uninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

est-ce que c'est bon ?

ça n'a pas dû suffire parce que je viens de lancer un scan qui n'est pas achevé et qui a déjà détecté 2 virus...

c'est ça ? :

¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.0.0.4 ¤¤¤¤¤¤¤¤¤¤

User : Utilisateur (Administrateurs)
Update on 22/05/2010 by g3n-h@ckm@n ::::: 10.50
Start at: 18:57:52 | 22/05/2010

Genuine Intel(R) CPU T2080 @ 1.73GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Norton Internet Security 2007 [ Enabled | Updated ]
FW : Norton Internet Security[ (!) Disabled ]2007

C:\ -> Disque fixe local | 32,01 Go (18,07 Go free) [WinXP] | NTFS
D:\ -> Disque fixe local | 101,73 Mo (99,31 Mo free) [BOOT] | FAT
E:\ -> Disque fixe local | 31,98 Go (9,01 Go free) [DONNEES] | FAT32
F:\ -> Disque CD-ROM | 0 Mo (0 Mo free) [Audio CD] | CDFS

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Program Files\Sukoku
Quarantined & Deleted !! : C:\Program Files\WindowsUpdate
Quarantined & Deleted !! : C:\WINDOWS\002755_.tmp

Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4C6.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4C8.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4CD.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4D4.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4DD.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4DF.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4E2.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Utilisateur\Local Settings\Application Data\segsmqw.exe
Quarantined & Deleted !! : C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\SuggestedSites.dat

=======
Hosts :
=======

127.0.0.1 localhost

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {5617eca9-488d-4ba2-8562-9710b9ab78d2}
Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2}
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)

========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
================

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.0.0.4 ¤¤¤¤¤¤¤¤¤¤

User : Utilisateur (Administrateurs)
Update on 22/05/2010 by g3n-h@ckm@n ::::: 10.50
Start at: 18:22:35 | 22/05/2010

Genuine Intel(R) CPU T2080 @ 1.73GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Norton Internet Security 2007 [ Enabled | Updated ]
FW : Norton Internet Security[ (!) Disabled ]2007

C:\ -> Disque fixe local | 32,01 Go (18,1 Go free) [WinXP] | NTFS
D:\ -> Disque fixe local | 101,73 Mo (99,31 Mo free) [BOOT] | FAT
E:\ -> Disque fixe local | 31,98 Go (9,03 Go free) [DONNEES] | FAT32
F:\ -> Disque CD-ROM | 0 Mo (0 Mo free) [Audio CD] | CDFS
H:\ -> Disque amovible | 941,92 Mo (870,77 Mo free) | FAT32

Boot: Normal
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\aMSN\bin\wish.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
LtMoh REG_SZ C:\Program Files\ltmoh\Ltmoh.exe
TOSCDSPD REG_SZ C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
BitTorrent DNA REG_SZ "C:\Program Files\DNA\btdna.exe"
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
Veoh REG_SZ "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
Skype REG_SZ "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
igfxtray REG_SZ C:\WINDOWS\system32\igfxtray.exe
igfxhkcmd REG_SZ C:\WINDOWS\system32\hkcmd.exe
igfxpers REG_SZ C:\WINDOWS\system32\igfxpers.exe
RTHDCPL REG_SZ RTHDCPL.EXE
CeEKEY REG_SZ C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
HWSetup REG_SZ C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
SVPWUTIL REG_SZ C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
TPNF REG_SZ C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
TCtryIOHook REG_SZ TCtrlIOHook.exe
TDispVol REG_SZ TDispVol.exe
TPSMain REG_SZ TPSMain.exe
Zooming REG_SZ ZoomingHook.exe
SmoothView REG_SZ C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
NDSTray.exe REG_SZ NDSTray.exe
DDWMon REG_SZ C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
Apoint REG_SZ C:\Program Files\Apoint2K\Apoint.exe
Camera Assistant Software REG_SZ "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
Lexmark X1100 Series REG_SZ "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
CFSServ.exe REG_SZ CFSServ.exe -NoClient
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
DisableRegistryTools REG_DWORD 0 (0x0)

===============

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
HonorAutoRunSetting REG_DWORD 0 (0x0)
NoDrives REG_DWORD 0 (0x0)

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDrives REG_DWORD 0 (0x0)

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultUserName REG_SZ Utilisateur
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Utilisateur
AltDefaultDomainName REG_SZ CRC_97129919K
DefaultDomainName REG_SZ CRC_97129919K
ChangePasswordUseKerberos REG_DWORD 1 (0x1)

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Program Files\DNA\btdna.exe REG_SZ C:\Program Files\DNA\btdna.exe:*:Enabled:DNA
C:\Program Files\BitTorrent\bittorrent.exe REG_SZ C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\eMule\emule.exe REG_SZ C:\Program Files\eMule\emule.exe:*:Enabled:eMule
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe REG_SZ C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\aMSN\bin\wish.exe REG_SZ C:\Program Files\aMSN\bin\wish.exe:*:Enabled:Wish Application
C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Messenger\livecall.exe REG_SZ C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)

===============
ActivX controls
===============

[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

==============
BHO :
======

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{D75DED1A-1A3E-4A33-8B9B-167CBE23E114}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{D75DED1A-1A3E-4A33-8B9B-167CBE23E114}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{D75DED1A-1A3E-4A33-8B9B-167CBE23E114}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

================
Internet Explorer :
================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

========
Services
========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

========
Safemode
========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

=========
Atapi.sys
=========

C:\WINDOWS\$NtServicePackUninstall$\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]

C:\WINDOWS\ERDNT\cache\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

C:\WINDOWS\ServicePackFiles\i386\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

C:\WINDOWS\system32\drivers\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

=======
Drive :
=======

Défragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
32,01 Go total, 18,10 Go libre (56%), 9% fragmenté (fragmentation du fichier 18%)

Il ne vous est pas nécessaire de défragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Program Files\Sukoku
Present !! : C:\Program Files\WindowsUpdate
Present !! : C:\WINDOWS\002755_.tmp
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\SET4C6.tmp
Present !! : C:\WINDOWS\System32\SET4C8.tmp
Present !! : C:\WINDOWS\System32\SET4CD.tmp
Present !! : C:\WINDOWS\System32\SET4D4.tmp
Present !! : C:\WINDOWS\System32\SET4DD.tmp
Present !! : C:\WINDOWS\System32\SET4DF.tmp
Present !! : C:\WINDOWS\System32\SET4E2.tmp
Present !! : C:\Documents and Settings\Utilisateur\Local Settings\Application Data\segsmqw.exe
Present !! : C:\Documents and Settings\Utilisateur\Local Settings\Temporary Internet Files\SuggestedSites.dat

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {5617eca9-488d-4ba2-8562-9710b9ab78d2}
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : HKEY_USERS\S-1-5-21-3568718806-3098808365-2456558613-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2}

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-22 18:30:39
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 0 (0x0)
FirewallOverride REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 18:30:40,09

est-ce que je peux remettre en fonction mes antivirus et spywares ?

ComboFix 10-05-21.06 - Utilisateur 22/05/2010 17:56:56.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.502.258 [GMT 2:00]
Lancé depuis: e:\mes documents\Téléchargements\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

Une copie infectée de c:\windows\system32\drivers\i8042prt.sys a été trouvée et désinfectée
Copie restaurée à partir de - Kitty had a snack :p
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-22 au 2010-05-22 ))))))))))))))))))))))))))))))))))))
.

2010-05-22 11:44 . 2010-05-22 14:41 1132306 ----a-w- C:\UsbFix_Upload_Me_CRC_97129919K.zip
2010-05-22 10:17 . 2010-05-22 14:41 -------- d-----w- C:\UsbFix
2010-05-18 18:06 . 2010-05-18 18:06 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2010-05-18 18:05 . 2010-05-18 18:17 4212 ---h--w- c:\windows\system32\zllictbl.dat
2010-05-18 18:05 . 2004-04-27 02:40 11264 ----a-w- c:\windows\system32\SpOrder.dll
2010-05-18 17:58 . 2010-05-22 15:24 -------- d-----w- c:\windows\Internet Logs
2010-05-06 11:16 . 2010-05-06 11:16 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-22 15:54 . 2009-01-10 10:42 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\DNA
2010-05-22 15:26 . 2009-09-25 17:11 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\skypePM
2010-05-22 15:25 . 2009-01-10 10:42 -------- d-----w- c:\program files\DNA
2010-05-22 15:21 . 2009-11-21 12:24 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-05-22 15:21 . 2009-01-09 16:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-17 11:26 . 2009-02-19 02:07 -------- d-----w- c:\program files\eMule
2010-05-12 18:01 . 2010-03-19 19:39 443912 ----a-w- c:\documents and settings\Utilisateur\Application Data\Real\Update\setup3.10\setup.exe
2010-05-01 10:17 . 2009-01-10 10:42 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\BitTorrent
2010-04-14 05:01 . 2007-07-24 08:09 -------- d-----w- c:\program files\Java
2010-04-14 04:54 . 2010-04-14 04:54 152576 ----a-w- c:\documents and settings\Utilisateur\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-04-14 04:54 . 2010-04-14 04:54 79488 ----a-w- c:\documents and settings\Utilisateur\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-10 06:16 . 2007-07-24 07:24 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:17 . 2007-07-24 07:24 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2007-07-24 07:24 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2007-01-09 191552]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2005-04-11 65536]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392]

c'est bien ça ?

et maintenant je peux remettre avast et spybot ?

ComboFix 10-05-21.06 - Utilisateur 22/05/2010 17:56:56.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.502.258 [GMT 2:00]
Lancé depuis: e:\mes documents\Téléchargements\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

Une copie infectée de c:\windows\system32\drivers\i8042prt.sys a été trouvée et désinfectée
Copie restaurée à partir de - Kitty had a snack :p
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-22 au 2010-05-22 ))))))))))))))))))))))))))))))))))))
.

2010-05-22 11:44 . 2010-05-22 14:41 1132306 ----a-w- C:\UsbFix_Upload_Me_CRC_97129919K.zip
2010-05-22 10:17 . 2010-05-22 14:41 -------- d-----w- C:\UsbFix
2010-05-18 18:06 . 2010-05-18 18:06 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2010-05-18 18:05 . 2010-05-18 18:17 4212 ---h--w- c:\windows\system32\zllictbl.dat
2010-05-18 18:05 . 2004-04-27 02:40 11264 ----a-w- c:\windows\system32\SpOrder.dll
2010-05-18 17:58 . 2010-05-22 15:24 -------- d-----w- c:\windows\Internet Logs
2010-05-06 11:16 . 2010-05-06 11:16 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-22 15:54 . 2009-01-10 10:42 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\DNA
2010-05-22 15:26 . 2009-09-25 17:11 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\skypePM
2010-05-22 15:25 . 2009-01-10 10:42 -------- d-----w- c:\program files\DNA
2010-05-22 15:21 . 2009-11-21 12:24 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-05-22 15:21 . 2009-01-09 16:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-17 11:26 . 2009-02-19 02:07 -------- d-----w- c:\program files\eMule
2010-05-12 18:01 . 2010-03-19 19:39 443912 ----a-w- c:\documents and settings\Utilisateur\Application Data\Real\Update\setup3.10\setup.exe
2010-05-01 10:17 . 2009-01-10 10:42 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\BitTorrent
2010-04-14 05:01 . 2007-07-24 08:09 -------- d-----w- c:\program files\Java
2010-04-14 04:54 . 2010-04-14 04:54 152576 ----a-w- c:\documents and settings\Utilisateur\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-04-14 04:54 . 2010-04-14 04:54 79488 ----a-w- c:\documents and settings\Utilisateur\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-10 06:16 . 2007-07-24 07:24 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:17 . 2007-07-24 07:24 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2007-07-24 07:24 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2007-01-09 191552]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2005-04-11 65536]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-03-24 3587120]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-09-02 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-02-07 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 16377344]
"CeEKEY"="c:\program files\TOSHIBA\E-KEY\CeEKey.exe" [2006-04-12 638976]
"HWSetup"="c:\program files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-05-01 28672]
"SVPWUTIL"="c:\program files\Toshiba\Windows Utilities\SVPWUTIL.exe" [2006-05-25 65536]
"TPNF"="c:\program files\TOSHIBA\TouchPad\TPTray.exe" [2007-06-01 53248]
"TCtryIOHook"="TCtrlIOHook.exe" [2007-06-30 28672]
"TDispVol"="TDispVol.exe" [2005-12-27 73728]
"TPSMain"="TPSMain.exe" [2005-08-12 266240]
"Zooming"="ZoomingHook.exe" [2005-06-06 24576]
"SmoothView"="c:\program files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2007-05-11 143360]
"NDSTray.exe"="NDSTray.exe" [BU]
"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-26 495616]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-03-24 196608]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-05-22 413696]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-08-05 185896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\aMSN\\bin\\wish.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [26/03/2007 12:22 105856]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [19/02/2007 12:15 134016]
S2 Sukoku Service;Sukoku Service;c:\documents and settings\All Users\Application Data\Sukoku\sukoku119.exe [29/09/2009 11:56 54760]
S3 TpChoice;Touch Pad Detection Filter driver;c:\windows\system32\DRIVERS\TpChoice.sys --> c:\windows\system32\DRIVERS\TpChoice.sys [?]
.
Contenu du dossier 'Tâches planifiées'

2010-05-22 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]

2007-08-03 c:\windows\Tasks\Rappel d'enregistrement 1.job
- c:\windows\system32\OOBE\oobebaln.exe [2007-07-24 02:34]

2007-08-17 c:\windows\Tasks\Rappel d'enregistrement 2.job
- c:\windows\system32\OOBE\oobebaln.exe [2007-07-24 02:34]

2007-08-03 c:\windows\Tasks\Rappel d'enregistrement 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2007-07-24 02:34]

2010-05-22 c:\windows\Tasks\User_Feed_Synchronization-{521789C9-E846-4481-82D2-BED60DC05BB1}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?10d3be3e675f42919084ce8f451b6224
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?10d3be3e675f42919084ce8f451b6224
FF - ProfilePath - c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\73eieb4s.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|https://www.msn.com/fr-fr/?ocid=iehp|https://www.msn.com/fr-fr/?ocid=iehp
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
MSConfigStartUp-TFncKy - TFncKy.exe
AddRemove-eMule - c:\program files\eMule\Uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-22 18:02
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2010-05-22 18:05:11
ComboFix-quarantined-files.txt 2010-05-22 16:05

Avant-CF: 19 348 480 000 octets libres
Après-CF: 19 429 318 656 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

- - End Of File - - 0420D3CB2C71862B654E766CA60D3C74

on est bon cette fois?

euh...moi j'ai jamais fait d'informatique,ça veut rien dire pour moi charge réseau et mode sans échec... :( et quand je fais "arrêter la protection résidente" on me demande un mot de passe...

j'ai besoin d'une précision : comment désactiver mon antivirus et mon antispiware ?je ne les désinstalle pas ?
parce que si je fais avast arrêter le service on me demande quel service :courrier etc et si veux tous les arrêter on me demande une clé que je n'ai pas...alors y a t-il un autre moyen? et pour spybot ?
merci

:'( waouh !
serait-ce ça ?

############################## | UsbFix V6.114 |

User : Utilisateur (Administrateurs) # CRC_97129919K
Update on 17/05/2010 by El Desaparecido , C_XX & Chimay8
Start at: 16:26:56 | 22/05/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Genuine Intel(R) CPU T2080 @ 1.73GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Norton Internet Security 2007 [ Enabled | Updated ]
AV : avast! antivirus 4.8.1368 [VPS 100522-0] 4.8.1368 [ Enabled | Updated ]
FW : ZoneAlarm Firewall[ Enabled ]7.0.483.000
FW : Norton Internet Security[ (!) Disabled ]2007

C:\ -> Disque fixe local # 32,01 Go (17,78 Go free) [WinXP] # NTFS
D:\ -> Disque fixe local # 101,73 Mo (99,31 Mo free) [BOOT] # FAT
E:\ -> Disque fixe local # 31,98 Go (5,94 Go free) [DONNEES] # FAT32
F:\ -> Disque CD-ROM # 0 Mo (0 Mo free) [Audio CD] # CDFS
H:\ -> Disque amovible # 941,92 Mo (870,77 Mo free) # FAT32

################## | Elements infectieux |

Supprimé ! C:\Recycler\S-1-5-21-3568718806-3098808365-2456558613-1008

################## | Registre |

################## | Mountpoints2 |

################## | Listing des fichiers présent |

[24/07/2007 09:36|--a------|0] C:\AUTOEXEC.BAT
[11/05/2009 21:24|-rahs----|212] C:\boot.ini
[05/08/2004 12:00|-rahs----|4952] C:\Bootfont.bin
[24/07/2007 09:36|--a------|0] C:\CONFIG.SYS
[?|?|?] C:\hiberfil.sys
[24/07/2007 09:36|-rahs----|0] C:\IO.SYS
[24/07/2007 09:36|-rahs----|0] C:\MSDOS.SYS
[05/08/2004 12:00|-rahs----|47564] C:\NTDETECT.COM
[17/01/2009 10:45|-rahs----|252240] C:\ntldr
[?|?|?] C:\pagefile.sys
[27/07/2007 17:17|--ah-----|176] C:\SWSTAMP.TXT
[22/05/2010 16:41|--a------|1784] C:\UsbFix.txt
[22/05/2010 15:05|--a------|1132306] C:\UsbFix_Upload_Me_CRC_97129919K.zip
[15/05/1998 20:01|--a------|222390] D:\IO.SYS
[04/09/2005 19:44|--a------|64] D:\MSDOS.SYS
[15/05/1998 20:01|--a------|95864] D:\COMMAND.COM
[15/05/1998 20:01|--a------|69127] D:\DRVSPACE.BIN
[23/02/2008 18:18|--ah-----|301] D:\BOOTLOG.PRV
[05/08/2004 12:00|-rahs----|4952] D:\Bootfont.bin
[05/08/2004 12:00|-rahs----|251712] D:\ntldr
[05/08/2004 12:00|-rahs----|47564] D:\NTDETECT.COM
[03/08/2007 14:11|---hs----|512] D:\bootsect.dos
[03/08/2007 14:26|---hs----|239] D:\boot.ini
[17/01/2008 15:52|--a------|558] D:\CONFIG.SYS
[20/08/2007 15:02|--a------|573] D:\AUTOEXEC.BAT
[04/08/2007 15:29|--a------|330] D:\GHOSTERR.TXT
[09/01/2009 17:31|--ah-----|301] D:\BOOTLOG.TXT
[01/08/2006 14:18|--a------|1394964] D:\ghost.exe
[13/01/2009 08:38|--a------|33280] E:\Normal.dot
[01/01/1995 02:00|-r-------|44] F:\Track01.cda
[01/01/1995 02:05|-r-------|44] F:\Track02.cda
[01/01/1995 02:12|-r-------|44] F:\Track03.cda
[01/01/1995 02:23|-r-------|44] F:\Track04.cda
[01/01/1995 02:32|-r-------|44] F:\Track05.cda
[01/01/1995 02:41|-r-------|44] F:\Track06.cda
[01/01/1995 02:52|-r-------|44] F:\Track07.cda
[11/01/2010 16:57|--a------|33036] H:\ronsard litt atlande debut.odt
[08/01/2010 20:18|--a------|93337] H:\indicatif
[27/12/2002 18:44|--ah-----|4194304] H:\STDBSTR.DAT
[08/01/2010 20:20|--a------|25600] H:\relev' des subjontifs ds Erec et Enide
[21/02/2010 15:09|--a------|74240] H:\COMMENTAIRE STYLISTIQUE.doc
[27/12/2002 18:44|--ah-----|0] H:\STDBSTR.IDX
[21/02/2010 15:10|--a------|30208] H:\_M'thode
[27/12/2002 18:44|--ah-----|1931264] H:\STDBDATA.DAT
[27/12/2002 18:44|--ah-----|0] H:\STDBDATA.IDX
[02/02/2010 18:03|--a------|89088] H:\po'sie 'pique synthSse atlande
[11/01/2010 16:35|--a------|80384] H:\Lectures de Ronsard.doc
[28/04/2010 09:18|--a------|38400] H:\EugSne IONESCO Le Roi se meurt version wordl.doc
[05/05/2010 11:43|--a------|1375231] H:\socle commun.pdf
[05/05/2010 12:13|--a------|127966] H:\programme_francais_general_collSge.pdf
[27/12/2002 18:44|--ah-----|1192065] H:\RAMLIST.DAT
[27/12/2002 18:44|--ah-----|708] H:\SETTINGS.DAT

################## | Vaccination |

# H:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).

################## | Upload |

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_CRC_97129919K.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .

j'ai refais 2 recherches sans voir aucun C:\USBFix.txt ni dans mes téléchargements ni sur mon bureau.où pourrais je trouver les dossiers C:\ ?

ben c'est tout ce que ça me sort, je ne vois aucun document texte usbfix...

Extraction de Fich\Kill.cmd
Extraction de Fich\K_Proc
Extraction de Fich\MD5.cmd
Extraction de Fich\Recycle
Extraction de Fich\Root.cmd
Extraction de Fich\Sniff.cmd
Extraction de Fich\Usb
Extraction de Fich\Usb2
Extraction de Fich\Vaccin
Extraction de Reg\Bho
Extraction de Reg\Clsid
Extraction de Reg\Hkcu_Po
Extraction de Reg\Hkcu_Run
Extraction de Reg\Hklm_Ifeo
Extraction de Reg\Hklm_Logon
Extraction de Reg\Hklm_Po
Extraction de Reg\Hklm_Run
Extraction de Reg\Hklm_Serv
Extraction de Reg\Rkt
Extraction de Reg\ShellExecuteHooks
Extraction de Reg\Software
Extraction de Reg\Startup
Extraction de Reg\UsbFix.reg
Extraction de Reg\UsbReg.vbs
Extraction de Tools\DevP.exe
Extraction de Tools\EchoX.exe
Extraction de Tools\EgwReg.com
Extraction de Tools\Erunt\ERDNT.E_E
Extraction de Tools\Erunt\ERDNTDOS.LOC
Extraction de Tools\Erunt\ERDNTWIN.LOC
Extraction de Tools\Erunt\ERUNT.com
Extraction de Tools\Erunt\ERUNT.LOC
Extraction de Tools\fsum.exe
Extraction de Tools\gsar.exe
Extraction de Tools\Kill.exe
Extraction de Tools\KProcess.exe
Extraction de Tools\Langue.cmd
Extraction de Tools\sed.exe
Extraction de Tools\setpath.exe
Extraction de Tools\Strtaz.ref
Extraction de Tools\swreg.exe
Extraction de Tools\swxcacls.com
Impossible de créer Tools\swxcacls.com
Extraction de Tools\UsbFix.vbs
Extraction de Tools\zip.exe
Extraction de Go.exe
Extraction de UsbFix.cmd
Extraction de Tools\Erunt
Extraction de Fich
Extraction de Reg
Extraction de Tools

serait-ce ça ?

ah ben il serait surement à côté de Usbfix et Usbfix2, non ? et je ne le vois nulle part, ni sur mon bureau ni dans mes téléchargements...

écoute je suis coincée...
le truc me marque "envoyez le ficher ...et veuillez appuyer sur une touche pour continuer."
J'ai appuyé sur une touche mais ça n'a rien changé donc je ne vois pas comment envoyer le fichier.
le fichier usbfix est dans mes documents / téléchargements. Il y a usbfix et usbfix2 ; lequel envoyer et comment ?

ça y est, la fenêtre s'est ouverte... j'ai pu envoyer le truc et y marqué maintenant :
L'upload a réussi !

Nous vous remercions pour votre contribution !

mais je ne vois toujours pas de rapport

mais je ne comprends pas ce que tu me demandes...usbfix me demande d'envoyer le fichier usbfix_upload_me_CRC_97129919K.zip mais je ne sais pas où il est.

mais quel fichier ? je ne sais pas où est le fichier infecté ni où il est.