Virus Security Pro

Bonjour,
Voilà les 2 liens des rapports du 5 dec
https://www.cjoint.com/c/CLgr0FCV9Av

https://www.cjoint.com/c/CLgr3I1wRLC

et celui du dernier rapport suite à la 2eme analyse avec RogueK
https://www.cjoint.com/c/CLgmy0n6zxN

j'ai envoyer le rapport via "cjoint" dans ma réponse mail. Pour ce qui est des rapports présents sur mon bureau que dois-je en faire? les mettre à la corbeille ou les garder
Merci encore de l'aide

Cà fait 4 fois le même rapport et ce n'est pas bon.
On va faire comme ça. Suis mes instructions ci-dessous :

1) Télécharge Roguekiller ici : https://www.luanagames.com/index.fr.html

Choisis la version adaptée à ton pc : 32 bits.

---> Enregistre Roguekiller directement sur le Bureau et pas ailleurs.
[NB : Les outils de désinfection doivent obligatoirement être placés sur le bureau]
Si tu l'as enregistré ailleurs, clique sur l'enregistrement et choisis "COUPER", puis clique sur un endroit vide du bureau et choisis "coller"

--> Exceptée cette page web, ferme tout.

2) Pour l'examen :

- Lance RogueKiller.exe par clic-droit sur l'icône et choisis "Exécuter en tant qu'administrateur"
- Attends la fin du Prescan ...
- Une fois le pré scan terminé, clique sur "Scan".
Durant le scan, l'outil peut s'attarder longuement sur une ligne puis repartir, c'est normal. Ne le relance pas.
- A la fin du scan, clique sur "Rapport".
---> Attention : L'outil va te demander de supprimer ce qui a été trouvé, ne supprime surtout pas. Le contenu doit être vérifié. Ferme le logiciel par le X (et non pas en cliquant sur ok).

3) Pour le rapport : --> Il se trouve sur le <gras>bureau. </gras>

Rends-toi sur https://www.cjoint.com/
Clique sur "Parcourir".
Indique comme emplacement où se trouve le rapport : bureau.
Une fois le fichier trouvé, clique sur "Ouvrir"
Puis clique sur "Créér le lien cjoint".
Un lien sera créé.
Copie-le et colle-le dans ta réponse.
@+

Voilà les 2 rapport que j'ai trouvé
RogueKiller V8.7.11 [Dec 3 2013] par Tigzy
mail : tigzyRK<at>gmail<dot>com
Remontees : http://www.adlice.com/forum/
Site Web : https://www.luanagames.com/index.fr.html
Blog : http://tigzyrk.blogspot.com/

Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Demarrage : Mode normal
Utilisateur : nanou [Droits d'admin]
Mode : Suppression -- Date : 12/05/2013 14:03:02
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 1 ¤¤¤
[SUSP PATH] 37nlpnrX.exe -- C:\ProgramData\37nlpnrX\37nlpnrX.exe [-] -> TUÉ [TermProc]

¤¤¤ Entrees de registre : 4 ¤¤¤
[RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> SUPPRIMÉ
[RUN][SUSP PATH] HKCU\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> SUPPRIMÉ
[RUN][ZeroAccess] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> [0xc0000034] Unknown error
[RUN][SUSP PATH] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> [0x2] Le fichier spécifié est introuvable.

¤¤¤ Tâches planifiées : 0 ¤¤¤

¤¤¤ Entrées Startup : 0 ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
[ZeroAccess][Repertoire] Install : C:\Users\nanou\AppData\Local\Google\Desktop\Install [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] @ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] GoogleUpdate.exe : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] L : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\L [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 00000001.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\00000001.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 00000002.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\00000002.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 80000000.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\80000000.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 80000001.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\80000001.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 800000cb.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\800000cb.@ [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] U : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] {ff24043d-55f8-5ce9-a20a-8337d9b4b888} : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888} [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] ????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\????? [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] ????????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\????????? [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] ????????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\????????? [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] {ff24043d-55f8-5ce9-a20a-8337d9b4b888} : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888} [-] --> SUPPRIMÉ

¤¤¤ Driver : [CHARGE] ¤¤¤
[Address] SSDT[13] : NtAlertResumeThread @ 0x82E94823 -> HOOKED (Unknown @ 0x8ADDF018)
[Address] SSDT[14] : NtAlertThread @ 0x82E0D34F -> HOOKED (Unknown @ 0x8A7F3B08)
[Address] SSDT[18] : NtAllocateVirtualMemory @ 0x82E4969D -> HOOKED (Unknown @ 0x8A9F3D98)
[Address] SSDT[21] : NtAlpcConnectPort @ 0x82DEB8A7 -> HOOKED (Unknown @ 0x8A1891B8)
[Address] SSDT[42] : NtAssignProcessToJobObject @ 0x82DBEB32 -> HOOKED (Unknown @ 0x8A5F0110)
[Address] SSDT[67] : NtCreateMutant @ 0x82E21993 -> HOOKED (Unknown @ 0x8A9EF068)
[Address] SSDT[77] : NtCreateSymbolicLinkObject @ 0x82DC1349 -> HOOKED (Unknown @ 0x8A50A1F0)
[Address] SSDT[78] : NtCreateThread @ 0x82E92E40 -> HOOKED (Unknown @ 0x8A50A470)
[Address] SSDT[116] : NtDebugActiveProcess @ 0x82E65ED4 -> HOOKED (Unknown @ 0x8A5EF110)
[Address] SSDT[129] : NtDuplicateObject @ 0x82DF9579 -> HOOKED (Unknown @ 0x8A9F2410)
[Address] SSDT[147] : NtFreeVirtualMemory @ 0x82C85E75 -> HOOKED (Unknown @ 0x8A9F9880)
[Address] SSDT[156] : NtImpersonateAnonymousToken @ 0x82DBBF3F -> HOOKED (Unknown @ 0x8A5232D0)
[Address] SSDT[158] : NtImpersonateThread @ 0x82DD1589 -> HOOKED (Unknown @ 0x8A523EC8)
[Address] SSDT[165] : NtLoadDriver @ 0x82D6CE12 -> HOOKED (Unknown @ 0x8A170008)
[Address] SSDT[177] : NtMapViewOfSection @ 0x82E11994 -> HOOKED (Unknown @ 0x8A523900)
[Address] SSDT[184] : NtOpenEvent @ 0x82DFADF7 -> HOOKED (Unknown @ 0x8A5EA110)
[Address] SSDT[194] : NtOpenProcess @ 0x82E2212F -> HOOKED (Unknown @ 0x8A800DF8)
[Address] SSDT[195] : NtOpenProcessToken @ 0x82E02A58 -> HOOKED (Unknown @ 0x8A751918)
[Address] SSDT[197] : NtOpenSection @ 0x82E1278C -> HOOKED (Unknown @ 0x8A52D110)
[Address] SSDT[201] : NtOpenThread @ 0x82E1D62B -> HOOKED (Unknown @ 0x8A9EE888)
[Address] SSDT[210] : NtProtectVirtualMemory @ 0x82E1B3E2 -> HOOKED (Unknown @ 0x8A3EC660)
[Address] SSDT[282] : NtResumeThread @ 0x82E1CC4A -> HOOKED (Unknown @ 0x925820D0)
[Address] SSDT[289] : NtSetContextThread @ 0x82E942CF -> HOOKED (Unknown @ 0x8A561460)
[Address] SSDT[305] : NtSetInformationProcess @ 0x82E159E6 -> HOOKED (Unknown @ 0x8A9F4980)
[Address] SSDT[317] : NtSetSystemInformation @ 0x82DE7F1E -> HOOKED (Unknown @ 0x8A5EC110)
[Address] SSDT[330] : NtSuspendProcess @ 0x82E9475F -> HOOKED (Unknown @ 0x8A50B110)
[Address] SSDT[331] : NtSuspendThread @ 0x82D9B945 -> HOOKED (Unknown @ 0x8A3F4D80)
[Address] SSDT[334] : NtTerminateProcess @ 0x82DF216B -> HOOKED (Unknown @ 0x8A3F2150)
[Address] SSDT[335] : NtTerminateThread @ 0x82E1D660 -> HOOKED (Unknown @ 0x8A736350)
[Address] SSDT[348] : NtUnmapViewOfSection @ 0x82E11C57 -> HOOKED (Unknown @ 0x92101038)
[Address] SSDT[358] : NtWriteVirtualMemory @ 0x82E0EA27 -> HOOKED (Unknown @ 0x8A9F9F60)
[Address] SSDT[382] : NtCreateThreadEx @ 0x82E1D115 -> HOOKED (Unknown @ 0x8A520110)
[Address] Shadow SSDT[317] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x92937950)
[Address] Shadow SSDT[397] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x929239D0)
[Address] Shadow SSDT[428] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x92948910)
[Address] Shadow SSDT[430] : NtUserGetKeyState -> HOOKED (Unknown @ 0x929F72B8)
[Address] Shadow SSDT[442] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x92FF1360)
[Address] Shadow SSDT[479] : NtUserMessageCall -> HOOKED (Unknown @ 0x940821D0)
[Address] Shadow SSDT[497] : NtUserPostMessage -> HOOKED (Unknown @ 0x879A2648)
[Address] Shadow SSDT[498] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x879A2578)
[Address] Shadow SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x92FC4B08)
[Address] Shadow SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x92FE96F8)
[Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : C:\Windows\system32\drivers\iastorv.sys -> HOOKED (C:\Windows\System32\drivers\sfsync03.sys @ 0x8323395C)
[Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST9500325AS ATA Device +++++
--- User ---
[MBR] ccdf17d7e9e510c30e34c616b246449f
[BSP] 64e337131f490ad902cc12c1a0c940ba : Toshiba MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 466095 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 954564608 | Size: 10841 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[0]_D_12052013_140302.txt >>
RKreport[0]_S_12052013_140214.txt;RKreport[1]_S_25052013_103706.txt;RKreport[2]_D_25052013_120941.txt

le second

RogueKiller V8.7.11 [Dec 3 2013] par Tigzy
mail : tigzyRK<at>gmail<dot>com
Remontees : http://www.adlice.com/forum/
Site Web : https://www.luanagames.com/index.fr.html
Blog : http://tigzyrk.blogspot.com/

Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Demarrage : Mode normal
Utilisateur : nanou [Droits d'admin]
Mode : Recherche -- Date : 12/05/2013 14:02:14
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 1 ¤¤¤
[SUSP PATH] 37nlpnrX.exe -- C:\ProgramData\37nlpnrX\37nlpnrX.exe [-] -> TUÉ [TermProc]

¤¤¤ Entrees de registre : 6 ¤¤¤
[RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> TROUVÉ
[RUN][SUSP PATH] HKCU\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> TROUVÉ
[RUN][ZeroAccess] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> TROUVÉ
[RUN][SUSP PATH] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> TROUVÉ
[PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyServer (hxxp=127.0.0.1:56847 [Country: (Private Address) (XX), City: (Private Address)]) -> TROUVÉ
[PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyEnable (1) -> TROUVÉ

¤¤¤ Tâches planifiées : 0 ¤¤¤

¤¤¤ Entrées Startup : 0 ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
[ZeroAccess][Repertoire] Install : C:\Users\nanou\AppData\Local\Google\Desktop\Install [-] --> TROUVÉ

¤¤¤ Driver : [CHARGE] ¤¤¤
[Address] SSDT[13] : NtAlertResumeThread @ 0x82E94823 -> HOOKED (Unknown @ 0x8ADDF018)
[Address] SSDT[14] : NtAlertThread @ 0x82E0D34F -> HOOKED (Unknown @ 0x8A7F3B08)
[Address] SSDT[18] : NtAllocateVirtualMemory @ 0x82E4969D -> HOOKED (Unknown @ 0x8A9F3D98)
[Address] SSDT[21] : NtAlpcConnectPort @ 0x82DEB8A7 -> HOOKED (Unknown @ 0x8A1891B8)
[Address] SSDT[42] : NtAssignProcessToJobObject @ 0x82DBEB32 -> HOOKED (Unknown @ 0x8A5F0110)
[Address] SSDT[67] : NtCreateMutant @ 0x82E21993 -> HOOKED (Unknown @ 0x8A9EF068)
[Address] SSDT[77] : NtCreateSymbolicLinkObject @ 0x82DC1349 -> HOOKED (Unknown @ 0x8A50A1F0)
[Address] SSDT[78] : NtCreateThread @ 0x82E92E40 -> HOOKED (Unknown @ 0x8A50A470)
[Address] SSDT[116] : NtDebugActiveProcess @ 0x82E65ED4 -> HOOKED (Unknown @ 0x8A5EF110)
[Address] SSDT[129] : NtDuplicateObject @ 0x82DF9579 -> HOOKED (Unknown @ 0x8A9F2410)
[Address] SSDT[147] : NtFreeVirtualMemory @ 0x82C85E75 -> HOOKED (Unknown @ 0x8A9F9880)
[Address] SSDT[156] : NtImpersonateAnonymousToken @ 0x82DBBF3F -> HOOKED (Unknown @ 0x8A5232D0)
[Address] SSDT[158] : NtImpersonateThread @ 0x82DD1589 -> HOOKED (Unknown @ 0x8A523EC8)
[Address] SSDT[165] : NtLoadDriver @ 0x82D6CE12 -> HOOKED (Unknown @ 0x8A170008)
[Address] SSDT[177] : NtMapViewOfSection @ 0x82E11994 -> HOOKED (Unknown @ 0x8A523900)
[Address] SSDT[184] : NtOpenEvent @ 0x82DFADF7 -> HOOKED (Unknown @ 0x8A5EA110)
[Address] SSDT[194] : NtOpenProcess @ 0x82E2212F -> HOOKED (Unknown @ 0x8A800DF8)
[Address] SSDT[195] : NtOpenProcessToken @ 0x82E02A58 -> HOOKED (Unknown @ 0x8A751918)
[Address] SSDT[197] : NtOpenSection @ 0x82E1278C -> HOOKED (Unknown @ 0x8A52D110)
[Address] SSDT[201] : NtOpenThread @ 0x82E1D62B -> HOOKED (Unknown @ 0x8A9EE888)
[Address] SSDT[210] : NtProtectVirtualMemory @ 0x82E1B3E2 -> HOOKED (Unknown @ 0x8A3EC660)
[Address] SSDT[282] : NtResumeThread @ 0x82E1CC4A -> HOOKED (Unknown @ 0x925820D0)
[Address] SSDT[289] : NtSetContextThread @ 0x82E942CF -> HOOKED (Unknown @ 0x8A561460)
[Address] SSDT[305] : NtSetInformationProcess @ 0x82E159E6 -> HOOKED (Unknown @ 0x8A9F4980)
[Address] SSDT[317] : NtSetSystemInformation @ 0x82DE7F1E -> HOOKED (Unknown @ 0x8A5EC110)
[Address] SSDT[330] : NtSuspendProcess @ 0x82E9475F -> HOOKED (Unknown @ 0x8A50B110)
[Address] SSDT[331] : NtSuspendThread @ 0x82D9B945 -> HOOKED (Unknown @ 0x8A3F4D80)
[Address] SSDT[334] : NtTerminateProcess @ 0x82DF216B -> HOOKED (Unknown @ 0x8A3F2150)
[Address] SSDT[335] : NtTerminateThread @ 0x82E1D660 -> HOOKED (Unknown @ 0x8A736350)
[Address] SSDT[348] : NtUnmapViewOfSection @ 0x82E11C57 -> HOOKED (Unknown @ 0x92101038)
[Address] SSDT[358] : NtWriteVirtualMemory @ 0x82E0EA27 -> HOOKED (Unknown @ 0x8A9F9F60)
[Address] SSDT[382] : NtCreateThreadEx @ 0x82E1D115 -> HOOKED (Unknown @ 0x8A520110)
[Address] Shadow SSDT[317] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x92937950)
[Address] Shadow SSDT[397] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x929239D0)
[Address] Shadow SSDT[428] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x92948910)
[Address] Shadow SSDT[430] : NtUserGetKeyState -> HOOKED (Unknown @ 0x929F72B8)
[Address] Shadow SSDT[442] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x92FF1360)
[Address] Shadow SSDT[479] : NtUserMessageCall -> HOOKED (Unknown @ 0x940821D0)
[Address] Shadow SSDT[497] : NtUserPostMessage -> HOOKED (Unknown @ 0x879A2648)
[Address] Shadow SSDT[498] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x879A2578)
[Address] Shadow SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x92FC4B08)
[Address] Shadow SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x92FE96F8)
[Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : C:\Windows\system32\drivers\iastorv.sys -> HOOKED (C:\Windows\System32\drivers\sfsync03.sys @ 0x8323395C)
[Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST9500325AS ATA Device +++++
--- User ---
[MBR] ccdf17d7e9e510c30e34c616b246449f
[BSP] 64e337131f490ad902cc12c1a0c940ba : Toshiba MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 466095 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 954564608 | Size: 10841 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[0]_S_12052013_140214.txt >>
RKreport[1]_S_25052013_103706.txt;RKreport[2]_D_25052013_120941.txt

Merci de ton intérêt a mon Pb. Tu me demandes de faire recherche sur mon ordi de" security pro" c'est bien ça ?

Bonjour,

Refais en un en mode recherche et mets-le en entier. Je veux la fin.

Houps j'ai oublié de coller le rapport... le voici
RogueKiller V8.7.11 [Dec 3 2013] par Tigzy
mail : tigzyRK<at>gmail<dot>com
Remontees : http://www.adlice.com/forum/
Site Web : https://www.luanagames.com/index.fr.html
Blog : http://tigzyrk.blogspot.com/

Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Demarrage : Mode normal
Utilisateur : nanou [Droits d'admin]
Mode : Suppression -- Date : 12/05/2013 14:03:02
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 1 ¤¤¤
[SUSP PATH] 37nlpnrX.exe -- C:\ProgramData\37nlpnrX\37nlpnrX.exe [-] -> TUÉ [TermProc]

¤¤¤ Entrees de registre : 4 ¤¤¤
[RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> SUPPRIMÉ
[RUN][SUSP PATH] HKCU\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> SUPPRIMÉ
[RUN][ZeroAccess] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> [0xc0000034] Unknown error
[RUN][SUSP PATH] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> [0x2] Le fichier spécifié est introuvable.

¤¤¤ Tâches planifiées : 0 ¤¤¤

¤¤¤ Entrées Startup : 0 ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
[ZeroAccess][Repertoire] Install : C:\Users\nanou\AppData\Local\Google\Desktop\Install [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] @ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] GoogleUpdate.exe : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] L : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\L [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 00000001.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\00000001.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 00000002.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\00000002.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 80000000.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\80000000.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 80000001.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\80000001.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 800000cb.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\800000cb.@ [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] U : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] {ff24043d-55f8-5ce9-a20a-8337d9b4b888} : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888} [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] ????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\????? [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] ????????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\????????? [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] ????????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\????????? [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] {ff24043d-55f8-5ce9-a20a-8337d9b4b888} : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888} [-] --> SUPPRIMÉ

¤¤¤ Driver : [CHARGE] ¤¤¤
[Address] SSDT[13] : NtAlertResumeThread @ 0x82E94823 -> HOOKED (Unknown @ 0x8ADDF018)
[Address] SSDT[14] : NtAlertThread @ 0x82E0D34F -> HOOKED (Unknown @ 0x8A7F3B08)
[Address] SSDT[18] : NtAllocateVirtualMemory @ 0x82E4969D -> HOOKED (Unknown @ 0x8A9F3D98)
[Address] SSDT[21] : NtAlpcConnectPort @ 0x82DEB8A7 -> HOOKED (Unknown @ 0x8A1891B8)
[Address] SSDT[42] : NtAssignProcessToJobObject @ 0x82DBEB32 -> HOOKED (Unknown @ 0x8A5F0110)
[Address] SSDT[67] : NtCreateMutant @ 0x82E21993 -> HOOKED (Unknown @ 0x8A9EF068)
[Address] SSDT[77] : NtCreateSymbolicLinkObject @ 0x82DC1349 -> HOOKED (Unknown @ 0x8A50A1F0)
[Address] SSDT[78] : NtCreateThread @ 0x82E92E40 -> HOOKED (Unknown @ 0x8A50A470)
[Address] SSDT[116] : NtDebugActiveProcess @ 0x82E65ED4 -> HOOKED (Unknown @ 0x8A5EF110)
[Address] SSDT[129] : NtDuplicateObject @ 0x82DF9579 -> HOOKED (Unknown @ 0x8A9F2410)
[Address] SSDT[147] : NtFreeVirtualMemory @ 0x82C85E75 -> HOOKED (Unknown @ 0x8A9F9880)
[Address] SSDT[156] : NtImpersonateAnonymousToken @ 0x82DBBF3F -> HOOKED (Unknown @ 0x8A5232D0)
[Address] SSDT[158] : NtImpersonateThread @ 0x82DD1589 -> HOOKED (Unknown @ 0x8A523EC8)
[Address] SSDT[165] : NtLoadDriver @ 0x82D6CE12 -> HOOKED (Unknown @ 0x8A170008)
[Address] SSDT[177] : NtMapViewOfSection @ 0x82E11994 -> HOOKED (Unknown @ 0x8A523900)
[Address] SSDT[184] : NtOpenEvent @ 0x82DFADF7 -> HOOKED (Unknown @ 0x8A5EA110)
[Address] SSDT[194] : NtOpenProcess @ 0x82E2212F -> HOOKED (Unknown @ 0x8A800DF8)
[Address] SSDT[195] : NtOpenProcessToken @ 0x82E02A58 -> HOOKED (Unknown @ 0x8A751918)
[Address] SSDT[197] : NtOpenSection @ 0x82E1278C -> HOOKED (Unknown @ 0x8A52D110)
[Address] SSDT[201] : NtOpenThread @ 0x82E1D62B -> HOOKED (Unknown @ 0x8A9EE888)
[Address] SSDT[210] : NtProtectVirtualMemory @ 0x82E1B3E2 -> HOOKED (Unknown @ 0x8A3EC660)
[Address] SSDT[282] : NtResumeThread @ 0x82E1CC4A -> HOOKED (Unknown @ 0x925820D0)
[Address] SSDT[289] : NtSetContextThread @ 0x82E942CF -> HOOKED (Unknown @ 0x8A561460)
[Address] SSDT[305] : NtSetInformationProcess @ 0x82E159E6 -> HOOKED (Unknown @ 0x8A9F4980)
[Address] SSDT[317] : NtSetSystemInformation @ 0x82DE7F1E -> HOOKED (Unknown @ 0x8A5EC110)
[Address] SSDT[330] : NtSuspendProcess @ 0x82E9475F -> HOOKED (Unknown @ 0x8A50B110)
[Address] SSDT[331] : NtSuspendThread @ 0x82D9B945 -> HOOKED (Unknown @ 0x8A3F4D80)
[Address] SSDT[334] : NtTerminateProcess @ 0x82DF216B -> HOOKED (Unknown @ 0x8A3F2150)
[Address] SSDT[335] : NtTerminateThread @ 0x82E1D660 -> HOOKED (Unknown @ 0x8A736350)
[Address] SSDT[348] : NtUnmapViewOfSection @ 0x82E11C57 -> HOOKED (Unknown @ 0x92101038)
[Address] SSDT[358] : NtWriteVirtualMemory @ 0x82E0EA27 -> HOOKED (Unknown @ 0x8A9F9F60)
[Address] SSDT[382] : NtCreateThreadEx @ 0x82E1D115 -> HOOKED (Unknown @ 0x8A520110)
[Address] Shadow SSDT[317] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x92937950)
[Address] Shadow SSDT[397] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x929239D0)
[Address] Shadow SSDT[428] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x92948910)
[Address] Shadow SSDT[430] : NtUserGetKeyState -> HOOKED (Unknown @ 0x929F72B8)
[Address] Shadow SSDT[442] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x92FF1360)
[Address] Shadow SSDT[479] : NtUserMessageCall -> HOOKED (Unknown @ 0x940821D0)
[Address] Shadow SSDT[497] : NtUserPostMessage -> HOOKED (Unknown @ 0x879A2648)
[Address] Shadow SSDT[498] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x879A2578)
[Address] Shadow SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x92FC4B08)
[Address] Shadow SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x92FE96F8)
[Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : C:\Windows\system32\drivers\iastorv.sys -> HOOKED (C:\Windows\System32\drivers\sfsync03.sys @ 0x8323395C)
[Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST9500325AS ATA Device ++++