Impossible de refuser modif Spybot

Bonjour,

Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
Procèdes comme ceci :
http://perso.orange.fr/rginformatique/section%20virus/demofairesontmessage.htm
A bientôt

Bonjour, je rencontre depuis ce matin le même problème évoqué sur ce post à savoir : alerte spybot, modif du registre, Browser helper obect.
J'ai suivi les premières étapes du sujet et voici le rapport via RSIT :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:43:39, on 06/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\SpeedRam2\Speedram.exe
C:\WINDOWS\vspc1000.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\VPro1000.exe
C:\Program Files\Hercules\WiFi Station N\WiFiN.exe
C:\Documents and Settings\berthier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\berthier\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\berthier\Bureau\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\berthier.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SpeedRam2] C:\Program Files\SpeedRam2\Speedram.exe
O4 - HKLM\..\Run: [spc1000] C:\WINDOWS\vspc1000.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\berthier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\berthier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\berthier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: VPro1000.lnk = ?
O4 - Global Startup: WiFi Station N.lnk = C:\Program Files\Hercules\WiFi Station N\WiFiN.exe
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h30155.www3.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: HerculesWiFi - Unknown owner - C:\WINDOWS\system32\HerculesWiFiService.exe (file missing)
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

Bonjour,

de rien pour l'aide.

Bon surf à toi.

Au plaisir de te recroiser ailleurs.

Bah je te remercie énormément pour ton aide et pour partager ton expérience.
Bonne continuation

Re,

très bien on en a terminé.

L'expérience sert, comme partout. Mais la désinfection sur forum s'apprend. Il y a des écoles" (des forums spécialisés avec un cursus de formation. Jai plus appris sur le tas, avec l'aide des anciens. Maintenant, formation continue, échange avec les autres, recherches personnelles.

Il pète la forme ! Je sais pas combien de fois je t'ai dit merci mais là, je te le redit encore une fois.
Comment connais-tu tous ça ? L'expérience ou un stage ou une formation ?

Re,

supprime (clic droit et supprimer), Combofix.exe, RSIT et toolsCleaner sur ton Bureau et C:\TCleaner.txt.

L'ordi va toujours aussi bien ?

Le fichier TCCleaner.txt n'a pas été créé mais je t'envoie ce que j'avais dans la fenêtre (je pense que c'est ça que tu voulais) :

[ Rapport ToolsCleaner version 2.2.5 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\Combofix.txt: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\Jonas\Mes documents\Téléchargements\ComboFix.exe: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\Jonas\Mes documents\Téléchargements\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\Qoobox: supprimé !

Sauvegarde du registre crée !
Point de restauration crée !
Fichiers temporaires nettoyés !

Re,

C'est la restauration système.

Fais ça :

Ouvre ce lien :

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924

dans un premier temps tu le suis pour désactiver la restauration système.

Tu fermes la fenêtre.

Dans un deuxième temps, tu le suis pour réactiver la restauration.

On élimine les outils :

* Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau.

http://pc-system.fr/
hxxp://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
hxxp://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe

* Clique sur Recherche et laisse le scan se terminer.

* Clique, sur Suppression pour finaliser.

* Tu peux, si tu le souhaites, te servir des Options facultatives.

* Clique sur Quitter, pour que le rapport puisse se créer.

* Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

J'ai fait un scan de malwarebyte et il a trouvé des fichiers inféctés dans les dossiers de quarantaine de combofix ce qui est logique mais aussi dans système volume information et ça je sais pas ce que c'est.
En tout cas, il a tout viré sans difficulté. Je te joins le rapport :

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1366
Windows 5.1.2600 Service Pack 3

04/11/2008 23:57:25
mbam-log-2008-11-04 (23-57-25).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 110511
Temps écoulé: 1 hour(s), 26 minute(s), 55 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 36

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\system32\awidsvan.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\bwmluhvq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kxpffpxb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\lesfaxee.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\lpghqnob.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\pumbawkn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\puuovvai.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\qhtwwynd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\qrchxamq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\rkxnbikk.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\rnsynisk.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\rtpqpqdv.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\vkzrfh.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\yjavordq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\yjctam.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\znmkvg.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP133\A0023207.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP133\A0024131.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP133\A0024132.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP133\A0024141.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024170.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024172.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024175.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024176.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024177.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024178.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024179.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024180.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024182.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024183.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024185.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024188.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024189.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024190.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024191.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{DB6CF2DD-4F7B-4172-AA01-EBDAADAF47B4}\RP134\A0024184.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Bah l'ordi il va bien et il te passe le bonjour :)
Merci beaucoup. Tu m'as vraiment sauvé ma partition Windows

Bonjour,

tout s'est bien passé.

Il doit rester des finitions.

J eregarde un peu plus tard dans la journée et je te dis.

Comment va l'ordi ?

Je sais pas pourquoi mais le serveur ne veut pas enregistrer mon dernier post à propos du rapport de HijackThis.
Je te l'envoie en MP

Il n'y a pas eu d'histoire 1 ou 2 pr combofix (peut etre faut-il mettre .txt après CFScript ?)
Voici le rapport :

ComboFix 08-11-02.01 - Jonas 2008-11-03 23:02:27.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.610 [GMT 1:00]
Lancé depuis: C:\Documents and Settings\Jonas\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Jonas\Bureau\CFScript
* Un nouveau point de restauration a été créé

FILE ::
C:\WINDOWS\system32\djyldl.VIR
C:\WINDOWS\system32\dryawc.VIR
C:\WINDOWS\system32\iavvouup.ini
C:\WINDOWS\system32\ksinysnr.ini
C:\WINDOWS\system32\wodejpau.ini
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-10-03 au 2008-11-03 ))))))))))))))))))))))))))))))))))))
.

2008-11-02 19:01 . 2008-11-02 19:01 <REP> d-------- C:\Program Files\MSXML 4.0
2008-11-02 11:50 . 2008-11-02 12:00 <REP> d-------- C:\rsit
2008-11-02 11:50 . 2008-11-02 17:11 <REP> d-------- C:\Program Files\trend micro
2008-11-02 10:43 . 2008-11-02 10:43 <REP> d-------- C:\Program Files\Avira
2008-11-02 10:43 . 2008-11-02 10:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-11-01 12:01 . 2008-11-01 12:01 <REP> d-------- C:\Program Files\Maxis
2008-10-30 10:33 . 2008-10-30 10:36 <REP> d-------- C:\Program Files\QuickTime
2008-10-30 10:33 . 2008-10-30 10:33 <REP> d-------- C:\Program Files\Fichiers communs\Apple
2008-10-30 10:33 . 2008-10-30 10:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-10-30 10:32 . 2008-10-30 10:32 <REP> d-------- C:\Program Files\Apple Software Update
2008-10-30 10:32 . 2008-10-30 10:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-10-28 16:32 . 2008-10-28 17:02 <REP> d-------- C:\Documents and Settings\Jonas\Application Data\Nero
2008-10-28 16:00 . 2008-10-28 16:00 4,767 --a------ C:\WINDOWS\Irremote.ini
2008-10-28 15:54 . 2008-10-28 15:54 <REP> d-------- C:\Program Files\Windows Sidebar
2008-10-28 15:25 . 2008-10-28 15:58 <REP> d-------- C:\Program Files\Nero
2008-10-28 15:24 . 2008-10-28 16:25 <REP> d-------- C:\Program Files\Fichiers communs\Nero
2008-10-28 15:24 . 2008-10-28 15:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-10-24 12:51 . 2008-10-15 17:35 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-24 08:40 . 2008-10-24 08:40 <REP> d-------- C:\WINDOWS\system32\fr
2008-10-24 08:40 . 2008-10-24 08:40 <REP> d-------- C:\WINDOWS\system32\bits
2008-10-24 08:40 . 2008-10-24 08:40 <REP> d-------- C:\WINDOWS\l2schemas
2008-10-22 18:55 . 2008-04-14 03:33 712,704 --------- C:\WINDOWS\system32\windowscodecs.dll
2008-10-22 18:55 . 2008-04-14 03:33 346,112 --------- C:\WINDOWS\system32\windowscodecsext.dll
2008-10-22 18:55 . 2008-04-14 03:33 276,992 --------- C:\WINDOWS\system32\wmphoto.dll
2008-10-22 18:55 . 2008-04-14 03:33 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-10-22 18:55 . 2008-04-14 03:34 28,672 --------- C:\WINDOWS\system32\verclsid.exe
2008-10-22 18:54 . 2008-04-14 03:33 290,304 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-10-22 18:54 . 2008-04-14 03:33 76,800 --------- C:\WINDOWS\system32\qutil.dll
2008-10-22 18:54 . 2008-04-14 03:33 62,464 --------- C:\WINDOWS\system32\qcliprov.dll
2008-10-22 18:54 . 2008-04-14 03:33 61,952 --------- C:\WINDOWS\system32\rasqec.dll
2008-10-22 18:54 . 2008-04-14 03:33 53,248 --------- C:\WINDOWS\system32\tsgqec.dll
2008-10-22 18:54 . 2008-04-14 03:33 50,688 --------- C:\WINDOWS\system32\tspkg.dll
2008-10-22 18:54 . 2008-04-14 03:34 32,768 --------- C:\WINDOWS\system32\setupn.exe
2008-10-22 18:54 . 2008-04-13 19:40 10,240 --------- C:\WINDOWS\system32\drivers\sffp_mmc.sys
2008-10-22 18:52 . 2008-04-14 03:33 651,264 --------- C:\WINDOWS\system32\dot3ui.dll
2008-10-21 21:21 . 2008-10-21 21:22 <REP> d-------- C:\Program Files\Ogame
2008-10-20 19:24 . 2003-08-01 12:08 569,246 --a------ C:\WINDOWS\Dressing Room 1.scr
2008-10-20 19:24 . 2005-04-28 18:08 532,070 --a------ C:\WINDOWS\Dressing Room 2.scr
2008-10-20 19:01 . 2008-10-18 22:56 23,600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS
2008-10-19 11:40 . 2008-10-23 16:34 <REP> d-------- C:\Program Files\ma-config.com
2008-10-19 11:40 . 2008-10-23 16:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ma-config.com
2008-10-19 08:14 . 2008-10-19 18:18 161 --a------ C:\WINDOWS\MyDrivers.ini
2008-10-18 22:53 . 2008-10-18 22:53 <REP> d-------- C:\Program Files\Lavalys
2008-10-18 22:45 . 2008-10-18 22:45 <REP> d-------- C:\Program Files\Fichiers communs\InstallShield
2008-10-18 22:44 . 2008-10-18 22:44 <REP> d-------- C:\ATI
2008-10-15 20:23 . 2008-09-08 11:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-15 19:39 . 2008-09-15 16:26 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 19:36 . 2008-08-14 14:23 2,191,232 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 19:36 . 2008-08-14 14:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 19:36 . 2008-08-14 14:23 2,068,096 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 19:36 . 2008-08-14 14:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-13 18:29 . 2008-10-13 18:30 <REP> d-------- C:\Program Files\Free Watch
2008-10-12 14:11 . 2008-10-12 14:11 <REP> d-------- C:\Documents and Settings\Jonas\AbiSuite
2008-10-12 10:47 . 2008-10-12 10:47 <REP> d-------- C:\Program Files\Desktop 2
2008-10-12 09:47 . 2008-10-13 20:57 <REP> d-------- C:\Program Files\JazzJackRabbit2
2008-10-10 08:13 . 2008-10-10 08:13 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-10-10 08:11 . 2008-10-10 08:12 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-10-08 08:58 . 2008-10-08 08:58 <REP> d-------- C:\Program Files\The FLy
2008-10-04 21:30 . 2001-08-17 20:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2008-10-04 21:30 . 2001-08-17 20:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys
2008-10-04 15:38 . 2008-10-24 08:40 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-10-04 15:38 . 2008-10-03 18:12 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-04 15:38 . 2007-04-17 10:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-10-04 15:38 . 2007-03-08 06:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-10-04 15:38 . 2008-08-26 09:11 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-10-04 15:38 . 2008-08-26 09:11 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-10-04 15:38 . 2008-08-26 09:11 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-10-04 15:38 . 2008-08-26 09:11 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-10-04 15:38 . 2008-08-26 09:11 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-10-04 15:38 . 2008-08-25 09:38 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-10-04 15:34 . 2007-08-13 17:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-02 18:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-11-02 14:30 --------- d-----w C:\Program Files\DAEMON Tools Pro
2008-11-02 14:25 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-11-02 14:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-01 20:16 --------- d-----w C:\Documents and Settings\Jonas\Application Data\codeblocks
2008-11-01 12:07 --------- d-----w C:\Program Files\CodeBlocks
2008-10-26 19:05 --------- d-----w C:\Documents and Settings\Jonas\Application Data\Hamachi
2008-10-25 17:53 --------- d-----w C:\Documents and Settings\Jonas\Application Data\uTorrent
2008-10-12 13:12 --------- d-----w C:\Program Files\AbiSuite2
2008-09-27 20:12 --------- d-----w C:\Program Files\Guide
2008-09-17 20:58 --------- d-----w C:\Documents and Settings\Jonas\Application Data\InfraRecorder
2008-09-17 20:56 --------- d-----w C:\Documents and Settings\Jonas\Application Data\FileZilla
2008-09-17 20:55 --------- d-----w C:\Program Files\FileZilla FTP Client
2008-09-17 20:52 --------- d-----w C:\Program Files\CDex_170b2
2008-09-17 20:51 --------- d-----w C:\Program Files\Juice
2008-09-17 20:51 --------- d-----w C:\Documents and Settings\Jonas\Application Data\iPodder
2008-09-17 20:49 --------- d-----w C:\Documents and Settings\Jonas\Application Data\gtk-2.0
2008-09-17 18:59 --------- d-----w C:\Documents and Settings\Jonas\Application Data\Notepad++
2008-09-15 15:26 1,846,528 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-14 14:28 --------- d-----w C:\Program Files\Microsoft Games
2008-09-14 14:25 --------- d-----w C:\Program Files\Alcohol Soft
2008-09-14 14:23 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-09-14 14:21 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-09-14 14:21 --------- d-----w C:\Program Files\Hamachi
2008-09-13 19:12 --------- d-----w C:\Program Files\uTorrent
2008-09-13 15:35 --------- d-----w C:\Documents and Settings\Jonas\Application Data\vghd
2008-09-11 16:27 --------- d-----w C:\Documents and Settings\Jonas\Application Data\DAEMON Tools Pro
2008-09-09 21:38 --------- d-----w C:\Documents and Settings\Jonas\Application Data\SumatraPDF
2008-09-09 16:40 --------- d-----w C:\Documents and Settings\Jonas\Application Data\Watchtower
2008-09-08 20:55 --------- d-----w C:\Documents and Settings\Jonas\Application Data\vlc
2008-09-08 16:00 --------- d-----w C:\Program Files\Windows Live
2008-09-08 14:57 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-09-08 14:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-08 11:29 --------- d-----w C:\Program Files\EA GAMES
2008-09-08 11:25 --------- d-----w C:\Program Files\Notepad++
2008-09-08 11:25 --------- d-----w C:\Program Files\Kitsune
2008-09-08 11:24 --------- d-----w C:\Program Files\Gnumeric
2008-09-08 11:23 --------- d-----w C:\Program Files\InfraRecorder
2008-09-08 11:22 --------- d-----w C:\Program Files\tuxguitar-1.0-rc3
2008-09-08 11:21 --------- d-----w C:\Program Files\Audacity 1.3 Beta (Unicode)
2008-09-08 11:20 --------- d-----w C:\Program Files\Dia
2008-09-08 11:19 --------- d-----w C:\Program Files\XviD
2008-09-08 11:19 --------- d-----w C:\Program Files\VirtualDub-MPEG2
2008-09-08 11:19 --------- d-----w C:\Program Files\GNU Solfege
2008-09-08 11:18 --------- d-----w C:\Program Files\Stellarium
2008-09-08 11:17 --------- d-----w C:\Program Files\FreeMind
2008-09-08 11:16 --------- d-----w C:\Program Files\Java
2008-09-08 11:15 --------- d-----w C:\Program Files\Scribus 1.3.3.11
2008-09-08 11:14 --------- d-----w C:\Program Files\gs
2008-09-08 11:13 --------- d-----w C:\Program Files\smartision
2008-09-08 11:12 --------- d-----w C:\Program Files\GIMP-2.0
2008-09-08 11:11 253,116 ----a-w C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_796.exe
2008-09-08 11:11 --------- d-----w C:\Program Files\PDFCreator Toolbar
2008-09-08 11:11 --------- d-----w C:\Program Files\PDFCreator
2008-09-08 11:11 --------- d-----w C:\Program Files\Fichiers communs\GTK
2008-09-08 11:10 --------- d-----w C:\Program Files\KompoZer
2008-09-08 11:09 --------- d-----w C:\Program Files\WinHTTrack
2008-09-08 11:09 --------- d-----w C:\Documents and Settings\Jonas\Application Data\KompoZer
2008-09-08 11:07 --------- d-----w C:\Program Files\SumatraPDF
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-08 09:15 --------- d-----w C:\Program Files\Alice
2008-08-26 08:11 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-14 13:23 2,191,232 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:23 2,068,096 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((( snapshot@2008-11-02_13.30.39.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-08-28 21:22:36 579,008 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACACEDAO.DLL
+ 2007-08-24 03:17:04 165,256 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACCWIZ.DLL
+ 2007-08-28 21:22:30 1,754,536 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACECORE.DLL
+ 2007-08-28 21:22:36 579,008 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEDAO.DLL
+ 2007-08-28 21:22:38 50,616 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEERR.DLL
+ 2007-08-28 21:22:40 193,992 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEES.DLL
+ 2007-08-24 01:46:10 341,440 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEEXCH.DLL
+ 2007-08-24 01:46:14 632,248 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEEXCL.DLL
+ 2007-08-24 01:46:16 210,368 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACELTS.DLL
+ 2007-08-24 01:46:18 281,992 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEODBC.DLL
+ 2007-08-24 01:46:20 17,800 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEODDBS.DLL
+ 2007-08-24 01:46:22 17,800 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEODEXL.DLL
+ 2007-08-24 01:46:22 17,800 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEODPDX.DLL
+ 2007-08-24 01:46:22 17,800 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEODTXT.DLL
+ 2007-08-28 21:22:44 390,600 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEOLEDB.DLL
+ 2007-08-24 01:46:28 394,688 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEPDE.DLL
+ 2007-08-24 01:46:30 263,616 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACER2X.DLL
+ 2007-08-24 01:46:32 292,288 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACER3X.DLL
+ 2007-08-24 01:46:34 58,760 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACERCLR.DLL
+ 2007-08-24 01:46:38 554,440 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEREP.DLL
+ 2007-08-24 01:46:40 226,744 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACETXT.DLL
+ 2007-08-28 22:52:12 201,664 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEWSS.DLL
+ 2007-08-24 01:46:44 374,200 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ACEXBE.DLL
+ 2007-08-28 22:53:12 402,784 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\CDLMSO.DLL
+ 2007-08-24 01:45:50 208,256 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\CLVIEW.EXE
+ 2007-08-24 03:38:36 67,952 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\COLLIMP.DLL
+ 2007-08-24 01:36:26 192,400 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\CONTACTPICKER.DLL
+ 2007-08-24 01:18:14 442,208 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\DWDCW20.DLL
+ 2007-08-24 01:18:18 437,160 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\DWTRIG20.EXE
+ 2007-08-22 23:03:38 1,195,888 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\FM20.DLL
+ 2007-08-25 17:11:44 1,685,896 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\FPSRVUTL.DLL
+ 2007-08-28 21:45:00 985,496 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\FPWEC.DLL
+ 2007-10-02 17:45:34 2,530,864 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\GRAPH.EXE
+ 2007-08-24 01:36:58 175,968 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\IEAWSDC.DLL
+ 2007-10-05 18:30:22 1,443,880 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\INFOPATH.EXE
+ 2007-10-05 18:30:40 5,460,528 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\IPDESIGN.DLL
+ 2007-10-05 18:31:06 5,287,984 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\IPEDITOR.DLL
+ 2007-08-24 03:43:06 179,616 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\IPOLK.DLL
+ 2007-08-28 22:45:54 831,856 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MEDCAT.DLL
+ 2007-08-28 21:13:52 10,367,352 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSACCESS.EXE
+ 2007-08-24 03:17:48 69,520 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSAEXP30.DLL
+ 2007-08-28 22:52:02 120,704 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSCONV97.DLL
+ 2007-08-28 21:20:06 163,712 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSOCF.DLL
+ 2007-08-28 21:20:12 17,304 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSOCFU.DLL
+ 2007-09-06 15:55:08 431,456 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSODCW.DLL
+ 2007-08-24 03:50:10 29,576 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSOEURO.DLL
+ 2007-08-27 18:20:14 6,637,960 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSORES.DLL
+ 2007-08-28 22:18:20 439,160 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSORUN.DLL
+ 2007-08-24 01:40:16 674,664 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSQRY32.EXE
+ 2007-08-22 23:12:20 507,768 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSSOAP30.DLL
+ 2007-08-28 22:45:58 835,952 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSTORDB.EXE
+ 2007-08-28 22:46:06 542,568 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\MSTORES.DLL
+ 2007-08-24 01:37:50 68,464 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\NAME.DLL
+ 2007-10-05 18:44:24 14,168,600 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\OART.DLL
+ 2007-10-02 17:51:22 8,436,776 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\OARTCONV.DLL
+ 2007-09-01 23:55:16 235,456 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\ODEPLOY.EXE
+ 2007-08-28 22:37:40 7,039,888 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\OFFOWC.DLL
+ 2007-08-24 02:06:28 277,384 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\OIS.EXE
+ 2007-08-24 02:06:32 1,000,848 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\OISAPP.DLL
+ 2007-08-24 02:06:38 288,152 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\OISGRAPH.DLL
+ 2007-09-01 23:55:54 6,540,656 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\OSETUP.DLL
+ 2007-06-07 17:51:00 465,800 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\OUTLFLTR.DLL
+ 2007-09-06 15:50:34 485,232 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\PORTCONN.DLL
+ 2007-08-28 22:38:22 2,016,656 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\PPTVIEW.EXE
+ 2007-08-24 03:50:10 41,832 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\REFEDIT.DLL
+ 2007-08-24 03:43:20 747,448 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\REGFORM.EXE
+ 2007-09-06 15:55:22 505,752 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\SELFCERT.EXE
+ 2007-09-01 23:55:34 442,240 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\SETUP.EXE
+ 2007-08-24 03:17:54 505,240 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\SOA.DLL
+ 2007-06-07 17:51:00 125,320 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\SSGEN.DLL
+ 2007-08-28 21:28:26 2,330,024 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\STSLIST.DLL
+ 2007-06-27 18:58:12 2,585,936 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\VBE6.DLL
+ 2007-08-24 05:10:14 1,846,160 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\VVIEWDWG.DLL
+ 2007-08-24 05:10:28 3,735,424 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u0002109110000000000000000F01FEC\12.0.6215\VVIEWER.DLL
- 2008-10-24 22:13:57 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe
+ 2008-11-02 18:07:44 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe
- 2008-10-24 22:13:57 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe
+ 2008-11-02 18:07:45 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe
- 2008-10-24 22:13:57 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\inficon.exe
+ 2008-11-02 18:07:44 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\inficon.exe
- 2008-10-24 22:13:57 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\misc.exe
+ 2008-11-02 18:07:44 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\misc.exe
- 2008-10-24 22:13:57 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe
+ 2008-11-02 18:07:45 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-10-24 22:13:58 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe
+ 2008-11-02 18:07:45 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-10-24 22:13:57 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\outicon.exe
+ 2008-11-02 18:07:44 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\outicon.exe
- 2008-10-24 22:13:57 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pptico.exe
+ 2008-11-02 18:07:44 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pptico.exe
- 2008-10-24 22:13:57 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pubs.exe
+ 2008-11-02 18:07:45 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pubs.exe
- 2008-10-24 22:13:57 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe
+ 2008-11-02 18:07:45 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe
- 2008-10-24 22:13:57 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe
+ 2008-11-02 18:07:44 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe
- 2008-10-23 21:57:26 217,864 ----a-r C:\WINDOWS\Installer\{90120000-006E-040C-0000-0000000FF1CE}\misc.exe
+ 2008-11-02 18:09:18 217,864 ----a-r C:\WINDOWS\Installer\{90120000-006E-040C-0000-0000000FF1CE}\misc.exe
+ 2008-11-02 18:02:06 32,768 ----a-r C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe
- 2003-04-18 15:46:22 1,233,920 ----a-w C:\WINDOWS\system32\msxml4.dll
+ 2007-05-08 14:03:04 1,275,392 ----a-w C:\WINDOWS\system32\msxml4.dll
+ 2008-11-03 19:37:27 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_440.dat
+ 2007-05-08 14:06:44 1,275,392 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a\msxml4.dll
.
-- Instantané actualisé --
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-03-20 216520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe" [2005-01-05 495616]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-09-08 136600]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"42900:TCP"= 42900:TCP:utorrent
"42900:UDP"= 42900:UDP:utorrent 2

R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2008-09-08 147456]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
.
Contenu du dossier 'Tâches planifiées'

2008-10-30 C:\WINDOWS\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
- C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe [2008-07-07 09:42]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-03 23:03:49
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2008-11-03 23:05:14
ComboFix-quarantined-files.txt 2008-11-03 22:05:09
ComboFix2.txt 2008-11-02 18:03:59
ComboFix3.txt 2008-11-02 12:32:10

Avant-CF: 10 463 272 960 octets libres
Après-CF: 10,454,339,584 octets libres

317 --- E O F --- 2008-11-02 18:09:25

Bonsoir,

des petites choses qui me surprennent. On verra après ça :

Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

File::
C:\WINDOWS\system32\ksinysnr.ini
C:\WINDOWS\system32\wodejpau.ini
C:\WINDOWS\system32\djyldl.VIR
C:\WINDOWS\system32\dryawc.VIR
C:\WINDOWS\system32\iavvouup.ini

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

Et les deux derniers fichiers n'existent plus.

Alors monsieur le docteur, le patient est-il complètement guéri ?

Voila pour dressing room1 (maintenant que j'y pense c'est peut-être un screensaver)

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.1.0 2008.11.03 -
AntiVir 7.9.0.10 2008.11.03 -
Authentium 5.1.0.4 2008.11.03 -
Avast 4.8.1248.0 2008.11.03 -
AVG 8.0.0.161 2008.11.03 -
CAT-QuickHeal 9.50 2008.11.03 -
ClamAV 0.94.1 2008.11.03 -
DrWeb 4.44.0.09170 2008.11.03 -
eSafe 7.0.17.0 2008.11.03 -
eTrust-Vet 31.6.6188 2008.11.03 -
Ewido 4.0 2008.11.03 -
F-Prot 4.4.4.56 2008.11.03 -
F-Secure 8.0.14332.0 2008.11.03 -
Fortinet 3.117.0.0 2008.11.03 -
GData 19 2008.11.03 -
Ikarus T3.1.1.45.0 2008.11.03 -
K7AntiVirus 7.10.515 2008.11.03 -
McAfee 5422 2008.11.02 -
Microsoft 1.4005 2008.11.03 -
NOD32 3579 2008.11.03 -
Norman 5.80.02 2008.11.03 -
Panda 9.0.0.4 2008.11.03 -
PCTools 4.4.2.0 2008.11.03 -
Prevx1 V2 2008.11.03 -
Rising 21.02.02.00 2008.11.03 -
SecureWeb-Gateway 6.7.6 2008.11.03 -
Sophos 4.35.0 2008.11.03 -
Sunbelt 3.1.1777.2 2008.11.03 -
Symantec 10 2008.11.03 -
TheHacker 6.3.1.1.137 2008.11.03 -
TrendMicro 8.700.0.1004 2008.11.03 -
VBA32 3.12.8.9 2008.11.03 -
ViRobot 2008.11.3.1449 2008.11.03 -
VirusBuster 4.5.11.0 2008.11.03 -
Information additionnelle
File size: 569246 bytes
MD5...: 531fe5cb7263006a24e8ab621a4e684f
SHA1..: 9b25df04981a5d72dc402bc44e022c8a5b61ec1a
SHA256: 2a8a760319a51bed496466cc2d7e513e03d98631e0abe87315aebe0004b799c1
SHA512: c41f39515235d9a432791ca7950edf27d3ff1cd5af4fdbd02a3d8412a20ba924
60a50cd247dc984b4ab17f2e5fb56e20195dbe6922d1c19dd8271f0236b313be
PEiD..: ASPack v2.11c
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x470001
timedatestamp.....: 0x3b309b87 (Wed Jun 20 12:48:07 2001)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x4b000 0x25e00 8.00 9c2667d11a0afd283d373cb765cd1636
.rdata 0x4c000 0xc000 0x3c00 7.97 a12b76a5d4d16c6b8b977b5436ea4539
.data 0x58000 0xf000 0x2600 7.93 736dd39c16a9aab8f84410f3d547ad56
.rsrc 0x67000 0x9000 0x3800 7.51 679412ed9f8ddf23575890d74e2ab52e
.aspack 0x70000 0x4000 0x3c00 5.94 bd261c400f1e0f4a29b2d0cbbf30dab0
.data 0x74000 0x1000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

( 15 imports )
> kernel32.dll: GetProcAddress, GetModuleHandleA, LoadLibraryA
> version.dll: GetFileVersionInfoA
> user32.dll: CreateDialogIndirectParamA
> gdi32.dll: DeleteObject
> comdlg32.dll: GetFileTitleA
> winspool.drv: OpenPrinterA
> advapi32.dll: RegOpenKeyA
> shell32.dll: ShellExecuteA
> comctl32.dll: -
> oledlg.dll: -
> ole32.dll: OleUninitialize
> olepro32.dll: -
> oleaut32.dll: -
> msvfw32.dll: DrawDibDraw
> winmm.dll: mixerGetLineInfoA

( 0 exports )

Voila le rapport pour setup.exe (pas setupn.exe : il existe pas)

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.1.0 2008.11.03 -
AntiVir 7.9.0.10 2008.11.03 -
Authentium 5.1.0.4 2008.11.03 -
Avast 4.8.1248.0 2008.11.03 -
AVG 8.0.0.161 2008.11.03 -
BitDefender 7.2 2008.11.03 -
CAT-QuickHeal 9.50 2008.11.03 -
ClamAV 0.94.1 2008.11.03 -
DrWeb 4.44.0.09170 2008.11.03 -
eSafe 7.0.17.0 2008.11.03 -
eTrust-Vet 31.6.6187 2008.11.03 -
Ewido 4.0 2008.11.03 -
F-Prot 4.4.4.56 2008.11.03 -
F-Secure 8.0.14332.0 2008.11.03 -
Fortinet 3.117.0.0 2008.11.03 -
GData 19 2008.11.03 -
Ikarus T3.1.1.45.0 2008.11.03 -
K7AntiVirus 7.10.515 2008.11.03 -
Kaspersky 7.0.0.125 2008.11.03 -
McAfee 5422 2008.11.02 -
Microsoft 1.4005 2008.11.03 -
NOD32 3579 2008.11.03 -
Norman 5.80.02 2008.11.03 -
Panda 9.0.0.4 2008.11.02 -
PCTools 4.4.2.0 2008.11.03 -
Prevx1 V2 2008.11.03 -
Rising 21.02.02.00 2008.11.03 -
SecureWeb-Gateway 6.7.6 2008.11.03 -
Sophos 4.35.0 2008.11.03 -
Sunbelt 3.1.1777.2 2008.11.03 -
Symantec 10 2008.11.03 -
TheHacker 6.3.1.1.137 2008.11.03 -
TrendMicro 8.700.0.1004 2008.11.03 -
VBA32 3.12.8.9 2008.11.03 -
ViRobot 2008.11.3.1449 2008.11.03 -
VirusBuster 4.5.11.0 2008.11.03 -
Information additionnelle
File size: 23040 bytes
MD5...: 0c5431281c6ea2cc588c6a1e55371166
SHA1..: 4509e2e629638772f0074235ec33fc719ee287ae
SHA256: 49d3fb40a20b7afdc42872764c3276446a13bb7d355932fa6b22e4b034cb34b1
SHA512: 196b003f802727b131db3f2e0837e1ea99d65e76d3e2f3af4627eabc1216455b c350b1906b80e8c07a953ff3d7576a2e2b9dc9ee782b6411feef873b263c0c51
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10020e1
timedatestamp.....: 0x48025271 (Sun Apr 13 18:35:29 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x46d4 0x4800 6.48 45cb634a6a37e708c5066417d15ddda5
.data 0x6000 0x838 0x400 2.08 f4be14ccf0a7729f861af17cd3cc27de
.rsrc 0x7000 0x8e8 0xa00 3.41 e093258730df23789310bbb3de97715a

( 1 imports )
> KERNEL32.dll: DisconnectNamedPipe, CloseHandle, FreeLibrary, GetLastError, ReadFile, ConnectNamedPipe, SetEvent, CreateNamedPipeA, OpenEventA, LoadLibraryA, GetProcAddress, GetModuleFileNameA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCommandLineA, GetVersionExA, ExitProcess, GetModuleHandleA, WriteFile, GetStdHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, VirtualFree, HeapFree, HeapAlloc, GetACP, GetOEMCP, GetCPInfo, VirtualAlloc, HeapReAlloc, RtlUnwind, InterlockedExchange, VirtualQuery, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, VirtualProtect, GetSystemInfo

( 0 exports )

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Voici le rapport de FileLook:

FileLook.exe v2.0 by jpshortstuff
Log created at 21:58 on 03/11/2008
==================================
[b][color=blue]FileSearch - "DRYAWC"

[/color][/b][b]C:\Qoobox\Quarantine\C\WINDOWS\system32\dryawc.VIR.vir[/b] (132608 bytes - created on 31/10/2008 at 08:56, modified on 31/10/2008 at 08:56)

==============================

[b][color=blue]=EOF=[/b][/color]

Un gros manque de temps, merci de prendre des nouvelles.
Je m'y met ce soir