A l'aide ( Virus Hostsnake )

Salut

très bien !

fais ce qui est indiqué ici stp :

http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr

++

Voilà le combo :-)

ComboFix 08-04-08.4 - admin 2008-04-08 22:48:58.8 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.71 [GMT 2:00]
Endroit: C:\Documents and Settings\admin\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\admin\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\DOCUME~1\admin\APPLIC~1\AMENJU~1\onenew.exe
C:\WINDOWS\system32\awvtu.dll
C:\WINDOWS\system32\mljhggf.dll
C:\WINDOWS\system32\pmnli.dll
C:\WINDOWS\system32\urqnnnk.dll
.
TimedOut: Windir.dat
TimedOut: progfile.dat

((((((((((((((((((((((((((((( Fichiers créés 2008-03-08 to 2008-04-08 ))))))))))))))))))))))))))))))))))))
.

2008-04-08 22:34 . 2008-04-08 22:34 <REP> d-------- C:\ComboFix(2)
2008-04-07 18:24 . 2008-04-07 18:24 <REP> d-------- C:\Documents and Settings\admin\Application Data\Malwarebytes
2008-04-07 18:23 . 2008-04-07 18:23 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-07 18:23 . 2008-04-07 18:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-06 22:52 . 2008-04-06 22:52 <REP> d-------- C:\_OTMoveIt
2008-04-06 19:40 . 2008-04-06 19:40 <REP> d-------- C:\WINDOWS\ERUNT
2008-04-06 19:34 . 2008-04-06 10:24 <REP> d-------- C:\SDFix
2008-04-06 18:55 . 2008-04-06 18:55 <REP> d-------- C:\VundoFix Backups
2008-04-06 17:51 . 2008-04-06 17:51 <REP> d-------- C:\Program Files\Trend Micro
2008-04-06 13:54 . 2008-04-06 13:54 <REP> d-------- C:\Documents and Settings\admin\Application Data\Grisoft
2008-04-06 13:54 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-06 01:25 . 2008-04-06 12:33 1,744 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-06 00:47 . 2008-04-06 00:47 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-04-06 00:41 . 2008-04-06 00:50 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2008-04-06 00:32 . 2008-04-06 00:32 121 --a------ C:\WINDOWS\bdagent.INI
2008-04-06 00:11 . 2008-04-06 13:28 <REP> d-------- C:\Program Files\Navilog1
2008-04-05 20:41 . 2008-04-05 20:41 <REP> d-------- C:\Program Files\BitDefender
2008-04-05 20:39 . 2008-04-05 20:42 <REP> d-------- C:\Program Files\Fichiers communs\BitDefender
2008-04-05 18:24 . 2008-04-05 18:25 <REP> d-------- C:\Documents and Settings\admin\Application Data\AVG7
2008-04-05 18:23 . 2008-04-05 18:23 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-05 18:22 . 2008-04-05 19:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-04-05 17:10 . 2008-04-05 17:10 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-04-05 17:10 . 2008-04-05 17:10 3,120 --a------ C:\WINDOWS\118294.78
2008-04-05 17:09 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-04-05 17:09 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-04-05 17:09 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-04-05 16:38 . 2008-04-05 16:38 <REP> d-------- C:\WINDOWS\system32\save$$updater
2008-04-05 15:40 . 2008-04-05 20:47 <REP> d-------- C:\Program Files\Fichiers communs\Symantec Shared
2008-04-05 15:28 . 2006-10-05 04:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-04-05 15:28 . 2006-10-05 04:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-04-05 15:27 . 2008-04-05 15:28 <REP> d-------- C:\Program Files\Picasa2
2008-04-05 13:52 . 2008-04-05 20:03 <REP> d-------- C:\Program Files\MSNFix
2008-04-05 02:32 . 2008-04-05 02:38 <REP> d-------- C:\Program Files\Spyware Doctor
2008-04-05 02:32 . 2008-04-05 02:32 <REP> d-------- C:\Documents and Settings\admin\Application Data\PC Tools
2008-04-05 02:32 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-04-05 02:32 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-04-05 02:32 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-04-05 02:32 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-04-04 18:07 . 2005-09-23 07:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-04-04 16:47 . 2008-04-04 16:47 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
2008-04-03 20:19 . 2008-04-05 04:15 <REP> d-------- C:\Program Files\a-squared Free
2008-04-02 14:50 . 2008-04-05 19:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-02 13:28 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-02 13:28 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-02 13:28 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-02 13:28 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-02 13:28 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-02 13:28 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-02 13:28 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-02 13:28 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-02 13:28 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-02 13:28 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-08 17:08 --------- d-----w C:\Documents and Settings\admin\Application Data\OpenOffice.org2
2008-04-05 17:57 --------- d-----w C:\Program Files\Google
2008-04-05 16:08 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-04-05 16:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-05 15:58 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-04-05 14:42 --------- d-----w C:\Program Files\IBM
2008-04-05 00:48 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-02 11:27 --------- d-----w C:\Program Files\Alwil Software
2008-03-22 07:45 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Readme test meow
2008-02-27 08:28 --------- d-----w C:\Program Files\Windows Live
2008-02-23 02:38 43,872 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-02-19 20:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-02-10 20:07 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-02-10 20:07 --------- d-----w C:\Program Files\eMule
2008-02-10 19:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-10 19:44 --------- d-----w C:\Program Files\FranceTelecomUninstall
2008-02-10 19:40 --------- d-----w C:\Program Files\PeerGuardian2
2008-02-10 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-10 17:38 --------- d-----w C:\Program Files\Lavasoft
2008-02-10 17:37 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-02-10 17:28 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-10 17:08 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-02-10 15:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\LICENSE FORD HOPE DRAW
2008-02-10 15:06 --------- d-----w C:\Program Files\Logitech
2008-02-10 13:03 37,888 ----a-w C:\WINDOWS\system32\rar.exe
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
.

((((((((((((((((((((((((((((( snapshot@2008-04-06_18.30.36.68 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-06 08:18:57 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-04-06 17:41:03 7,995,392 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat
+ 2008-04-06 17:41:03 262,144 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-06 08:18:57 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-04-06 17:40:51 7,995,392 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat
+ 2008-04-06 17:40:51 262,144 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-08 18:01:00 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_650.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"RayV"="C:\Program Files\RayV\RayV\RayV.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="irprops.cpl" [2004-08-20 01:10 380928 C:\WINDOWS\system32\irprops.cpl]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-07-10 14:25 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-07-10 14:13 114688]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 18:24 86016]
"BigDogPath"="C:\WINDOWS\VM_STI.exe" [2004-06-09 09:37 40960]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 15:49 1121280]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-07-12 12:59 24576]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-07-12 14:14 311350]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-04 03:01 28739]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Rappels du Calendrier Microsoft Works.lnk - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [2000-07-12 14:14:38 24633]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lqu40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Sxd15.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
S0 Lqu40;Lqu40;C:\WINDOWS\system32\Drivers\Lqu40.sys []
S0 Sxd15;Sxd15;C:\WINDOWS\system32\Drivers\Sxd15.sys []
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 19:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 19:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 19:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 19:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 19:15]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-01 19:54]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 06:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f092bd8-cdcf-11dc-8939-000d6027301a}]
\Shell\AutoRun\command - E:\InstallTomTomHOME.exe

.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-08 22:52:27
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-08 22:55:11
ComboFix-quarantined-files.txt 2008-04-08 20:55:07
ComboFix2.txt 2008-04-08 20:44:44
ComboFix3.txt 2008-04-07 21:43:31
ComboFix4.txt 2008-04-06 21:59:23
ComboFix5.txt 2008-04-06 20:12:45
Pre-Run: 18,175,541,248 octets libres
Post-Run: 18,163,757,056 octets libres
.
2008-04-06 10:24:28 --- E O F ---

re

supprime le et retélécharge le !

++

Bonjour,

Je fais comme tu m'as dit mais voilà le combo s'ouvre pas, c'est normal où pas ?

Salut

Crée un nouveau document texte et nomme le CFScript.txt ( attention très important ! ) : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes en gras :

File::

C:\WINDOWS\system32\awvtu.dll
C:\DOCUME~1\admin\APPLIC~1\AMENJU~1\onenew.exe
C:\WINDOWS\system32\pmnli.dll
C:\WINDOWS\system32\mljhggf.dll
C:\WINDOWS\system32\urqnnnk.dll

registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{68CB3332-B0F5-4DD4-B213-7E423BE033F0}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7BB21C6E-3DEB-7C31-F9CC-CD09BBB3AC6A}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9E7A65D5-AD83-42E9-A906-6ACE19B3816F}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljhggf]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnnnk]


ensuite fais glisser le fichier texte sur combo.exe comme sur l'animation :
http://img.bleepingcomputer.com/combofix/usage/rc.gif

Dans la fenêtre qui suit, choisie l'option 1 puis valide
Patiente un peu, si le bureau disparait parfois durant le scan : c'est normal !
A la fin du scan, un rapport va s'afficher : poste le stp ( sinon il se situe dans ici : C:\ComboFix.txt )

@+

;-))

ComboFix 08-04-04.1 - admin 2008-04-07 23:36:25.6 - NTFSx86
Endroit: C:\Documents and Settings\admin\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-03-07 to 2008-04-07 ))))))))))))))))))))))))))))))))))))
.

2008-04-07 18:24 . 2008-04-07 18:24 <REP> d-------- C:\Documents and Settings\admin\Application Data\Malwarebytes
2008-04-07 18:23 . 2008-04-07 18:23 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-07 18:23 . 2008-04-07 18:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-06 22:52 . 2008-04-06 22:52 <REP> d-------- C:\_OTMoveIt
2008-04-06 19:40 . 2008-04-06 19:40 <REP> d-------- C:\WINDOWS\ERUNT
2008-04-06 19:34 . 2008-04-06 10:24 <REP> d-------- C:\SDFix
2008-04-06 18:55 . 2008-04-06 18:55 <REP> d-------- C:\VundoFix Backups
2008-04-06 17:51 . 2008-04-06 17:51 <REP> d-------- C:\Program Files\Trend Micro
2008-04-06 13:54 . 2008-04-06 13:54 <REP> d-------- C:\Documents and Settings\admin\Application Data\Grisoft
2008-04-06 13:54 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-06 01:25 . 2008-04-06 12:33 1,744 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-06 00:47 . 2008-04-06 00:47 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-04-06 00:41 . 2008-04-06 00:50 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2008-04-06 00:32 . 2008-04-06 00:32 121 --a------ C:\WINDOWS\bdagent.INI
2008-04-06 00:11 . 2008-04-06 13:28 <REP> d-------- C:\Program Files\Navilog1
2008-04-05 20:41 . 2008-04-05 20:41 <REP> d-------- C:\Program Files\BitDefender
2008-04-05 20:39 . 2008-04-05 20:42 <REP> d-------- C:\Program Files\Fichiers communs\BitDefender
2008-04-05 18:24 . 2008-04-05 18:25 <REP> d-------- C:\Documents and Settings\admin\Application Data\AVG7
2008-04-05 18:23 . 2008-04-05 18:23 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-05 18:22 . 2008-04-05 19:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-04-05 17:10 . 2008-04-05 17:10 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-04-05 17:10 . 2008-04-05 17:10 3,120 --a------ C:\WINDOWS\118294.78
2008-04-05 17:09 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-04-05 17:09 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-04-05 17:09 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-04-05 16:38 . 2008-04-05 16:38 <REP> d-------- C:\WINDOWS\system32\save$$updater
2008-04-05 15:40 . 2008-04-05 20:47 <REP> d-------- C:\Program Files\Fichiers communs\Symantec Shared
2008-04-05 15:28 . 2006-10-05 04:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-04-05 15:28 . 2006-10-05 04:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-04-05 15:27 . 2008-04-05 15:28 <REP> d-------- C:\Program Files\Picasa2
2008-04-05 13:52 . 2008-04-05 20:03 <REP> d-------- C:\Program Files\MSNFix
2008-04-05 02:32 . 2008-04-05 02:38 <REP> d-------- C:\Program Files\Spyware Doctor
2008-04-05 02:32 . 2008-04-05 02:32 <REP> d-------- C:\Documents and Settings\admin\Application Data\PC Tools
2008-04-05 02:32 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-04-05 02:32 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-04-05 02:32 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-04-05 02:32 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-04-04 18:07 . 2005-09-23 07:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-04-04 16:47 . 2008-04-04 16:47 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
2008-04-03 20:19 . 2008-04-05 04:15 <REP> d-------- C:\Program Files\a-squared Free
2008-04-02 14:50 . 2008-04-05 19:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-02 13:28 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-02 13:28 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-02 13:28 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-02 13:28 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-02 13:28 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-02 13:28 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-02 13:28 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-02 13:28 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-02 13:28 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-02 13:28 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-06 20:02 --------- d-----w C:\Documents and Settings\admin\Application Data\OpenOffice.org2
2008-04-05 17:57 --------- d-----w C:\Program Files\Google
2008-04-05 16:08 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-04-05 16:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-05 15:58 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-04-05 14:42 --------- d-----w C:\Program Files\IBM
2008-04-05 00:48 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-02 11:27 --------- d-----w C:\Program Files\Alwil Software
2008-03-22 07:45 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Readme test meow
2008-02-27 08:28 --------- d-----w C:\Program Files\Windows Live
2008-02-23 02:38 43,872 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-02-19 20:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-02-10 20:07 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-02-10 20:07 --------- d-----w C:\Program Files\eMule
2008-02-10 19:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-10 19:44 --------- d-----w C:\Program Files\FranceTelecomUninstall
2008-02-10 19:40 --------- d-----w C:\Program Files\PeerGuardian2
2008-02-10 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-10 17:38 --------- d-----w C:\Program Files\Lavasoft
2008-02-10 17:37 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-02-10 17:28 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-10 17:08 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-02-10 15:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\LICENSE FORD HOPE DRAW
2008-02-10 15:06 --------- d-----w C:\Program Files\Logitech
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
.

((((((((((((((((((((((((((((( snapshot@2008-04-06_18.30.36.68 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-06 08:18:57 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-04-06 17:41:03 7,995,392 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat
+ 2008-04-06 17:41:03 262,144 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-06 08:18:57 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-04-06 17:40:51 7,995,392 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat
+ 2008-04-06 17:40:51 262,144 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-07 17:55:38 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_674.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{68CB3332-B0F5-4DD4-B213-7E423BE033F0}]
C:\WINDOWS\system32\awvtu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7BB21C6E-3DEB-7C31-F9CC-CD09BBB3AC6A}]
C:\DOCUME~1\admin\APPLIC~1\AMENJU~1\onenew.exe

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9E7A65D5-AD83-42E9-A906-6ACE19B3816F}]
C:\WINDOWS\system32\pmnli.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"RayV"="C:\Program Files\RayV\RayV\RayV.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="irprops.cpl" [2004-08-20 01:10 380928 C:\WINDOWS\system32\irprops.cpl]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-07-10 14:25 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-07-10 14:13 114688]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 18:24 86016]
"BigDogPath"="C:\WINDOWS\VM_STI.exe" [2004-06-09 09:37 40960]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 15:49 1121280]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-07-12 12:59 24576]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-07-12 14:14 311350]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-04 03:01 28739]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Rappels du Calendrier Microsoft Works.lnk - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [2000-07-12 14:14:38 24633]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljhggf]
mljhggf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnnnk]
urqnnnk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo8"= VfWWDM32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lqu40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Sxd15.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
S0 Lqu40;Lqu40;C:\WINDOWS\system32\Drivers\Lqu40.sys []
S0 Sxd15;Sxd15;C:\WINDOWS\system32\Drivers\Sxd15.sys []
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 19:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 19:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 19:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 19:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 19:15]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-01 19:54]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 06:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f092bd8-cdcf-11dc-8939-000d6027301a}]
\Shell\AutoRun\command - E:\InstallTomTomHOME.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-07 23:40:27
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-07 23:43:29
ComboFix-quarantined-files.txt 2008-04-07 21:43:21
ComboFix2.txt 2008-04-06 21:59:23
ComboFix3.txt 2008-04-06 20:12:45
ComboFix4.txt 2008-04-06 16:31:19
ComboFix5.txt 2008-04-06 16:18:52
Pre-Run: 18,283,319,296 octets libres
Post-Run: 18,270,294,016 octets libres
.
2008-04-06 10:24:28 --- E O F ---

Voici le combo ! Mon pc ne rame plus et je n'ai plus rien apparemment ! Je ne sais pas si c'est bon mais ça a l"ai en tout cas. Merciiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii beaucoup vraiment merci ! Je suis content grave, Merci merci merci il n'y pas assez de mots de remerciement ! ;-)

Salut

ok, poste un nouveau combo suivi d'un nouveau hijack, et dis moi où en sont tes soucis !

@+

Bonsoir Green Day, donc voici le rapport :

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 17

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM6327bf40 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP795\A0138666.exe (Worm.Socks) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP795\A0138667.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP795\A0138680.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP796\A0138694.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP796\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP797\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP798\A0138794.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP798\A0138808.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP798\A0138820.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP798\A0138832.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP798\A0139832.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP798\A0139850.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP798\A0139893.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP798\A0139923.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20956986-F224-4763-B3BB-E766DA4A8D5B}\RP798\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Fichiers communs\System\aux (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\All Users\Menu Démarrer\carlton (Dialer) -> Quarantined and deleted successfully.

Salut

* télécharge ceci :http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware
* Installez le programme sur le bureau :
o S'il manque le fichier COMCTL32.OCX, vous pourrez le télécharger ici
* Faites les mises à jour (clic sur Mises à jour puis Recherche de mises à jour)
* Démarrez en mode sans échec
* Lancez le MalwareByte's Anti-Malware, cliquez sur Exécuter un examen complet puis Rechercher et sélectionnez tous tes disques durs
* Une fois le scan terminé, cliquez sur supprimer (si un message demande à redémarrer le PC, acceptez !)
* Un rapport sera généré, enregistrez le de manière à le retrouver

==> poste le stp !

@+

Ok pas de soucis, un grand merci !!!!!!!!!!!!!!!!!!!!!!!!!
@ demain ;-)

Très bien

je te donne la suite demain !

@+

;-))

ComboFix 08-04-04.1 - admin 2008-04-06 23:51:20.5 - NTFSx86
Endroit: C:\Documents and Settings\admin\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-03-06 to 2008-04-06 ))))))))))))))))))))))))))))))))))))
.

2008-04-06 22:52 . 2008-04-06 22:52 <REP> d-------- C:\_OTMoveIt
2008-04-06 19:40 . 2008-04-06 19:40 <REP> d-------- C:\WINDOWS\ERUNT
2008-04-06 19:34 . 2008-04-06 10:24 <REP> d-------- C:\SDFix
2008-04-06 18:55 . 2008-04-06 18:55 <REP> d-------- C:\VundoFix Backups
2008-04-06 17:51 . 2008-04-06 17:51 <REP> d-------- C:\Program Files\Trend Micro
2008-04-06 13:54 . 2008-04-06 13:54 <REP> d-------- C:\Documents and Settings\admin\Application Data\Grisoft
2008-04-06 13:54 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-06 01:25 . 2008-04-06 12:33 1,744 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-06 00:47 . 2008-04-06 00:47 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-04-06 00:41 . 2008-04-06 00:50 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2008-04-06 00:32 . 2008-04-06 00:32 121 --a------ C:\WINDOWS\bdagent.INI
2008-04-06 00:11 . 2008-04-06 13:28 <REP> d-------- C:\Program Files\Navilog1
2008-04-05 20:41 . 2008-04-05 20:41 <REP> d-------- C:\Program Files\BitDefender
2008-04-05 20:39 . 2008-04-05 20:42 <REP> d-------- C:\Program Files\Fichiers communs\BitDefender
2008-04-05 18:24 . 2008-04-05 18:25 <REP> d-------- C:\Documents and Settings\admin\Application Data\AVG7
2008-04-05 18:23 . 2008-04-05 18:23 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-05 18:22 . 2008-04-05 19:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-04-05 17:10 . 2008-04-05 17:10 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-04-05 17:10 . 2008-04-05 17:10 3,120 --a------ C:\WINDOWS\118294.78
2008-04-05 17:09 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-04-05 17:09 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-04-05 17:09 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-04-05 16:38 . 2008-04-05 16:38 <REP> d-------- C:\WINDOWS\system32\save$$updater
2008-04-05 15:40 . 2008-04-05 20:47 <REP> d-------- C:\Program Files\Fichiers communs\Symantec Shared
2008-04-05 15:28 . 2006-10-05 04:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-04-05 15:28 . 2006-10-05 04:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-04-05 15:27 . 2008-04-05 15:28 <REP> d-------- C:\Program Files\Picasa2
2008-04-05 13:52 . 2008-04-05 20:03 <REP> d-------- C:\Program Files\MSNFix
2008-04-05 02:32 . 2008-04-05 02:38 <REP> d-------- C:\Program Files\Spyware Doctor
2008-04-05 02:32 . 2008-04-05 02:32 <REP> d-------- C:\Documents and Settings\admin\Application Data\PC Tools
2008-04-05 02:32 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-04-05 02:32 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-04-05 02:32 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-04-05 02:32 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-04-04 18:07 . 2005-09-23 07:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-04-04 16:47 . 2008-04-04 16:47 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
2008-04-03 20:19 . 2008-04-05 04:15 <REP> d-------- C:\Program Files\a-squared Free
2008-04-02 14:50 . 2008-04-05 19:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-02 13:28 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-02 13:28 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-02 13:28 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-02 13:28 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-02 13:28 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-02 13:28 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-02 13:28 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-02 13:28 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-02 13:28 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-02 13:28 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-03-06 21:45 . 2008-03-06 21:45 3,114 ---hs---- C:\WINDOWS\system32\canoecgc.ini

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-06 20:02 --------- d-----w C:\Documents and Settings\admin\Application Data\OpenOffice.org2
2008-04-05 17:57 --------- d-----w C:\Program Files\Google
2008-04-05 16:08 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-04-05 16:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-05 15:58 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-04-05 14:42 --------- d-----w C:\Program Files\IBM
2008-04-05 00:48 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-02 11:27 --------- d-----w C:\Program Files\Alwil Software
2008-03-22 07:45 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Readme test meow
2008-02-27 08:28 --------- d-----w C:\Program Files\Windows Live
2008-02-23 02:38 43,872 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-02-19 20:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-02-10 20:07 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-02-10 20:07 --------- d-----w C:\Program Files\eMule
2008-02-10 19:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-10 19:44 --------- d-----w C:\Program Files\FranceTelecomUninstall
2008-02-10 19:40 --------- d-----w C:\Program Files\PeerGuardian2
2008-02-10 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-10 17:38 --------- d-----w C:\Program Files\Lavasoft
2008-02-10 17:37 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-02-10 17:28 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-10 17:08 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-02-10 15:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\LICENSE FORD HOPE DRAW
2008-02-10 15:06 --------- d-----w C:\Program Files\Logitech
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
.

((((((((((((((((((((((((((((( snapshot@2008-04-06_18.30.36.68 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-06 08:18:57 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-04-06 17:41:03 7,995,392 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat
+ 2008-04-06 17:41:03 262,144 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-06 08:18:57 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-04-06 17:40:51 7,995,392 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat
+ 2008-04-06 17:40:51 262,144 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-06 21:18:00 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_640.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{68CB3332-B0F5-4DD4-B213-7E423BE033F0}]
C:\WINDOWS\system32\awvtu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7BB21C6E-3DEB-7C31-F9CC-CD09BBB3AC6A}]
C:\DOCUME~1\admin\APPLIC~1\AMENJU~1\onenew.exe

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9E7A65D5-AD83-42E9-A906-6ACE19B3816F}]
C:\WINDOWS\system32\pmnli.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"RayV"="C:\Program Files\RayV\RayV\RayV.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="irprops.cpl" [2004-08-20 01:10 380928 C:\WINDOWS\system32\irprops.cpl]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-07-10 14:25 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-07-10 14:13 114688]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 18:24 86016]
"BigDogPath"="C:\WINDOWS\VM_STI.exe" [2004-06-09 09:37 40960]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 15:49 1121280]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-07-12 12:59 24576]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-07-12 14:14 311350]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-04 03:01 28739]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"BM6327bf40"="C:\WINDOWS\system32\tmqsiwun.dll" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Rappels du Calendrier Microsoft Works.lnk - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [2000-07-12 14:14:38 24633]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljhggf]
mljhggf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnnnk]
urqnnnk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo8"= VfWWDM32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lqu40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Sxd15.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
S0 Lqu40;Lqu40;C:\WINDOWS\system32\Drivers\Lqu40.sys []
S0 Sxd15;Sxd15;C:\WINDOWS\system32\Drivers\Sxd15.sys []
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 19:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 19:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 19:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 19:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 19:15]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 06:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f092bd8-cdcf-11dc-8939-000d6027301a}]
\Shell\AutoRun\command - E:\InstallTomTomHOME.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-06 23:55:44
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-06 23:59:22
ComboFix-quarantined-files.txt 2008-04-06 21:59:14
ComboFix2.txt 2008-04-06 20:12:45
ComboFix3.txt 2008-04-06 16:31:19
ComboFix4.txt 2008-04-06 16:18:52
Pre-Run: 18,368,385,024 octets libres
Post-Run: 18,355,290,112 octets libres
.
2008-04-06 10:24:28 --- E O F ---

Donc voilà :-)

Excuse moi mais je ne connais pas trop les termes informatiques mdrrr désolé je suis nul je sais lol mais c'est quoi un combo ? Excuse moi et merci à toi de ta patience ! Merci vraiment :-)

Très bien ! ;-)

poste un nouveau combo stp

++

C:\WINDOWS\system32\spolsv.exe moved successfully.
C:\WINDOWS\system32\eguncsfg.ini moved successfully.
C:\WINDOWS\system32\svsiriug.ini moved successfully.
C:\WINDOWS\system32\xtnlgoci.ini moved successfully.
C:\WINDOWS\system32\byyevxc.exe moved successfully.
C:\WINDOWS\system32\uuiotppl.ini moved successfully.
C:\WINDOWS\system32\ebgcyuqc.ini moved successfully.
C:\WINDOWS\system32\lmomujxt.ini moved successfully.
C:\WINDOWS\system32\koxjcext.ini moved successfully.
C:\WINDOWS\system32\kcqfuhub.ini moved successfully.
C:\WINDOWS\system32\caczjfcl.exe moved successfully.
C:\WINDOWS\system32\kiydthcyt.exe moved successfully.
C:\WINDOWS\system32\MRT.INI moved successfully.
C:\WINDOWS\system32\mjcscij.exe moved successfully.
C:\WINDOWS\system32\pherjlnh.ini moved successfully.
C:\WINDOWS\system32\mwegjbkk.ini moved successfully.
C:\WINDOWS\system32\ccnntsoe.ini moved successfully.
C:\WINDOWS\system32\txkxtcir.ini moved successfully.
C:\WINDOWS\system32\mfoyvvwy.ini moved successfully.
C:\WINDOWS\system32\qjhycpnn.ini moved successfully.
C:\WINDOWS\system32\buhdvlqr.ini moved successfully.
C:\WINDOWS\system32\pggldh.exe moved successfully.
File/Folder C:\WINDOWS\system32\canoecgc.in not found.
File/Folder C:\WINDOWS\system32\tmqsiwun.dll" not found.
File/Folder C:\WINDOWS\system32\awvtu.dll not found.
File/Folder C:\DOCUME~1\admin\APPLIC~1\AMENJU~1\onenew.exe not found.
File/Folder C:\WINDOWS\system32\pmnli.dll not found.
File/Folder C:\WINDOWS\system32\mljhggf.dll not found.
File/Folder C:\WINDOWS\system32\urqnnnk.dll not found.

OTMoveIt2 by OldTimer - Version 1.0.4.0 log created on 04062008_225210

Voilà j'ai trouvé lol ;-)

poste son contenu ! ;-)

++

J'ai plusieurs fichiers dans Movedfiles, je le poste dans quoi ?

redemarre le pc : ensuite va dans demarrer < poste de travail < disque locale C:\ < dans le dossier OTMoveIt poste le fichier nommé MovedFiles.

@+

Ca ne me fait rien du tout, je comprends pas trop ! J'ai même pas la demande pour redémarrer le pc et puis dans les résultats ça marque Succelly et no found sur certains fichiers, je suis pas trop doué en anglais désolé :-)

tu as raison, mais le fix n'a pas fonctionnait apparemment ...

tant pie, on va faire autrement :

télécharge OTMoveIt (de Old_Timer) sur ton Bureau :
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

C:\WINDOWS\system32\spolsv.exe
C:\WINDOWS\system32\eguncsfg.ini
C:\WINDOWS\system32\svsiriug.ini
C:\WINDOWS\system32\xtnlgoci.ini
C:\WINDOWS\system32\byyevxc.exe
C:\WINDOWS\system32\uuiotppl.ini
C:\WINDOWS\system32\ebgcyuqc.ini
C:\WINDOWS\system32\lmomujxt.ini
C:\WINDOWS\system32\koxjcext.ini
C:\WINDOWS\system32\kcqfuhub.ini
C:\WINDOWS\system32\caczjfcl.exe
C:\WINDOWS\system32\kiydthcyt.exe
C:\WINDOWS\system32\MRT.INI
C:\WINDOWS\system32\mjcscij.exe
C:\WINDOWS\system32\pherjlnh.ini
C:\WINDOWS\system32\mwegjbkk.ini
C:\WINDOWS\system32\ccnntsoe.ini
C:\WINDOWS\system32\txkxtcir.ini
C:\WINDOWS\system32\mfoyvvwy.ini
C:\WINDOWS\system32\qjhycpnn.ini
C:\WINDOWS\system32\buhdvlqr.ini
C:\WINDOWS\system32\pggldh.exe
C:\WINDOWS\system32\canoecgc.in
C:\WINDOWS\system32\tmqsiwun.dll"
C:\WINDOWS\system32\awvtu.dll
C:\DOCUME~1\admin\APPLIC~1\AMENJU~1\onenew.exe
C:\WINDOWS\system32\pmnli.dll
C:\WINDOWS\system32\mljhggf.dll
C:\WINDOWS\system32\urqnnnk.dll

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre Results.
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.
si c'est le cas accepte par Yes.

++