Xp securityCenter

bonsoir il est arrivé la meme chose sur mon ordinateur et donc j'ai suivi tous les instructions je voulais vous poser mon rapport apres le dernier rapport de malwarebytes si vous pouvez m'aider ???? merci

Malwarebytes' Anti-Malware 1.21
Version de la base de données: 971
Windows 5.1.2600 Service Pack 2

18:43:43 20/07/2008
mbam-log-7-20-2008 (18-43-43).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Eléments examinés: 154893
Temps écoulé: 1 hour(s), 17 minute(s), 22 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 17

Processus mémoire infecté(s):
C:\Program Files\XPSecurityCenter\XPSecurityCenter.exe (Rogue.Installer) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Program Files\XPSecurityCenter\XPSECURITYCENTER.DLL (Rogue.Multiple) -> Unloaded module successfully.
C:\Program Files\XPSecurityCenter\HTMLAYOUT.DLL (Rogue.XPSecurityCenter) -> Unloaded module successfully.
C:\Program Files\XPSecurityCenter\pthreadVC2.dll (Rogue.XPSecurityCenter) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xp securitycenter (Rogue.Installer) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\XPSecurityCenter (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\data (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\XPSecurityCenter\XPSecurityCenter.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\XPSECURITYCENTER.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\natacha\Local Settings\Application Data\yaweosi_navps.dat (Adware.Navipromo) -> Quarantined and deleted successfully.
D:\Documents and Settings\natacha\Local Settings\Application Data\yaweosi_nav.dat (Adware.Navipromo) -> Quarantined and deleted successfully.
D:\Documents and Settings\natacha\Local Settings\Application Data\yaweosi.dat (Adware.Navipromo) -> Quarantined and deleted successfully.
D:\Documents and Settings\natacha\Local Settings\Application Data\yaweosi.exe (Adware.Navipromo) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\htmlayout.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\install.exe (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\pthreadVC2.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\un.ico (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\unzip32.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\XP_SecurityCenter.cfg (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\data\daily.cvd (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcm80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcp80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.
C:\Program Files\XPSecurityCenter\Microsoft.VC80.CRT\msvcr80.dll (Rogue.XPSecurityCenter) -> Quarantined and deleted successfully.

@venzettiet voici l'analyse de antivir

Avira AntiVir Personal
Report file date: dimanche 20 juillet 2008 19:21

Scanning for 1476109 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: 112736340319

Version information:
BUILD.DAT : 8.1.0.326 16933 Bytes 11/07/2008 12:57:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
ANTIVIR2.VDF : 7.0.5.119 1264128 Bytes 15/07/2008 17:05:22
ANTIVIR3.VDF : 7.0.5.140 325632 Bytes 20/07/2008 17:05:23
Engineversion : 8.1.1.11
AEVDF.DLL : 8.1.0.5 102772 Bytes 09/07/2008 08:46:50
AESCRIPT.DLL : 8.1.0.59 307579 Bytes 20/07/2008 17:05:27
AESCN.DLL : 8.1.0.23 119156 Bytes 20/07/2008 17:05:27
AERDL.DLL : 8.1.0.20 418165 Bytes 09/07/2008 08:46:50
AEPACK.DLL : 8.1.2.1 364917 Bytes 20/07/2008 17:05:26
AEOFFICE.DLL : 8.1.0.21 192891 Bytes 20/07/2008 17:05:25
AEHEUR.DLL : 8.1.0.43 1339767 Bytes 20/07/2008 17:05:25
AEHELP.DLL : 8.1.0.15 115063 Bytes 09/07/2008 08:46:50
AEGEN.DLL : 8.1.0.29 307573 Bytes 09/07/2008 08:46:50
AEEMU.DLL : 8.1.0.6 430451 Bytes 09/07/2008 08:46:50
AECORE.DLL : 8.1.1.6 172405 Bytes 20/07/2008 17:05:24
AEBB.DLL : 8.1.0.1 53617 Bytes 24/04/2008 08:50:42
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 7.0.0.1 155688 Bytes 30/06/2008 14:35:20
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: dimanche 20 juillet 2008 19:21

Starting search for hidden objects.
'86576' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'mbam.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'vk_planrun.exe' - '1' Module(s) have been scanned
Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'SMPSYS.EXE' - '1' Module(s) have been scanned
Scan process 'VirusKeeper.exe' - '1' Module(s) have been scanned
Scan process 'bdagent.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'AOSD.EXE' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'ABOARD.EXE' - '1' Module(s) have been scanned
Scan process 'PCMService.exe' - '1' Module(s) have been scanned
Scan process 'Monitor.exe' - '1' Module(s) have been scanned
Scan process 'Vaderetro_oe.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'soundman.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '0' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'CLSched.exe' - '1' Module(s) have been scanned
Scan process 'vsserv.exe' - '0' Module(s) have been scanned
Scan process 'livesrv.exe' - '0' Module(s) have been scanned
Scan process 'xcommsvr.exe' - '0' Module(s) have been scanned
Scan process 'vk_service.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'HidService.exe' - '1' Module(s) have been scanned
Scan process 'CLMLService.exe' - '1' Module(s) have been scanned
Scan process 'CLMLServer.exe' - '1' Module(s) have been scanned
Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'AOLacsd.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
56 processes with 56 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '72' files ).

Starting the file scan:

Begin scan in 'C:\' <HDD>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\QooBox\Quarantine\C\WINDOWS\cru629.dat.vir
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] A backup was created as '48f87737.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\cru629.dat.vir
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] A backup was created as '48f87738.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\winivstr.exe.vir
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE] A backup was created as '48f1772f.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\yotsyw.exe.vir
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE] A backup was created as '48f77735.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP458\A0207056.inf
[DETECTION] Contains recognition pattern of the VBS/IETitle.A VBS script virus
[NOTE] A backup was created as '48b57740.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP458\A0207142.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] A backup was created as '48b57743.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP458\A0207143.sys
[DETECTION] Is the TR/Rootkit.Gen Trojan
[NOTE] A backup was created as '491d76ec.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP458\A0207144.sys
[DETECTION] Is the TR/Rootkit.Gen Trojan
[NOTE] A backup was created as '48b57744.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP458\A0207151.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/Agent.mnl back-door program
[NOTE] A backup was created as '491d76ed.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207271.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE] A backup was created as '48b5774d.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207274.exe
[DETECTION] Is the TR/Dldr.Swizzor.Gen Trojan
[NOTE] A backup was created as '48b5774e.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207370.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] A backup was created as '48b5774f.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207371.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] A backup was created as '49077ce0.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207373.dll
[DETECTION] Is the TR/Killav.28714 Trojan
[NOTE] A backup was created as '48b57750.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207374.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] A backup was created as '49077ce1.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207375.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] A backup was created as '48b57752.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207377.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] A backup was created as '49077ce3.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207379.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] A backup was created as '48b57751.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207380.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] A backup was created as '49077ce2.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207381.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] A backup was created as '48b57753.qua' ( QUARANTINE )
[NOTE] The file was deleted!
C:\WINDOWS\system32\braviax.exe.bd.ren
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] A backup was created as '48e47914.qua' ( QUARANTINE )
[NOTE] The file was deleted!
Begin scan in 'D:\' <DATA>
D:\autorun.inf
[DETECTION] Contains recognition pattern of the VBS/IETitle.A VBS script virus
[NOTE] A backup was created as '48f77959.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\Documents and Settings\georgia.112736340319\Bureau\codeczang1016(2).exe
[DETECTION] Contains recognition pattern of the DR/Dldr.DNSChanger.Gen dropper
[NOTE] A backup was created as '48e77a22.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\Documents and Settings\georgia.112736340319\Bureau\codeczang1016.exe
[DETECTION] Contains recognition pattern of the DR/Dldr.DNSChanger.Gen dropper
[NOTE] A backup was created as '49557193.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\Documents and Settings\georgia.112736340319\Mes documents\emule\Incoming\- MIX Dj spooks R&B 2007 RNB HIP HOP MIXTAPE ( Ciara 50 Cent Tamia Snoop Usher finland 2 pac remix P.diddy R kelly Ashanti ja rule by).ace
[0] Archive type: ACE
--> Acceso directo a - MIX Dj spooks R&B 2007 RNB HIP HOP MIXTAPE ( Ciara 50 Cent Tamia Snoop Usher finland 2 pac remix P.diddy R kelly Ashanti ja rule by).lnk
[WARNING] The file could not be opened!
--> 01-atomik_harmonik_-_brizgalna_brizga_(remix_by_dj_rumek)-zzzz.mp3
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\RECYCLER\S-1-5-21-1180267176-2546774152-2753440689-1006\Dd224.0\AttacheMoi.exe
[DETECTION] Contains recognition pattern of the DR/Hotbar.BI dropper
[NOTE] A backup was created as '48f7811f.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP428\A0176638.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE] A backup was created as '48b480ff.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP431\A0178679.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE] A backup was created as '48b48102.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP440\A0199745.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE] A backup was created as '48b4810b.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP459\A0207372.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] A backup was created as '48b58120.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP460\A0207393.inf
[DETECTION] Contains recognition pattern of the VBS/IETitle.A VBS script virus
[NOTE] A backup was created as '49078a91.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP460\A0207394.exe
[DETECTION] Contains recognition pattern of the DR/Dldr.DNSChanger.Gen dropper
[NOTE] A backup was created as '48b58122.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP460\A0207395.exe
[DETECTION] Contains recognition pattern of the DR/Dldr.DNSChanger.Gen dropper
[NOTE] A backup was created as '48b58121.qua' ( QUARANTINE )
[NOTE] The file was deleted!
D:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP460\A0207396.exe
[DETECTION] Contains recognition pattern of the DR/Hotbar.BI dropper
[NOTE] A backup was created as '49078a92.qua' ( QUARANTINE )
[NOTE] The file was deleted!

End of the scan: dimanche 20 juillet 2008 20:16
Used time: 54:20 Minute(s)

The scan has been done completely.

11420 Scanning directories
225328 Files were scanned
33 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
33 files were deleted
0 files were repaired
33 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
225293 Files not concerned
8605 Archives were scanned
8 Warnings
33 Notes
86576 Objects were scanned with rootkit scan
0 Hidden objects were found

Bonjour à toi G!rly

c'est aimable à toi de t'inquieter de mes soucis.

je suis désolé de répondre si tard mais j'ai eu d'énormes problèmes que je n'ai pas pu résoudre complètement suite à ce "spyware" ? ou virus ?

je vais mettre en application ce que tu viens de me demander.
Saches simplement que le pc a ralenti de manière incroyable : faire appel au poste de travail = 100% des ressources pendant 120 sec avant d'afficher les disques, cd...
j'ai trouvé une parade ( raccourcis de chaque sur bureau) mais c'est galère.
je ne te parle pas des navigateurs : ils plantent les uns après les autres...
bref ce n'est pas gagné.

-:)

je télécharge tout ce que tu as demandé et je te rejoins ici

excellent samedi à toi et merci encore

@anonymusRE- bonjour

voili voilà
voici le rapport que tu attendais :

Malwarebytes' Anti-Malware 1.18
Version de la base de données: 875

19:14:35 21/06/2008
mbam-log-6-21-2008 (19-14-26).txt

Type de recherche: Examen complet (C:\|E:\|F:\|G:\|)
Eléments examinés: 87198
Temps écoulé: 14 minute(s), 5 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{D2FFB75B-DEC9-4A61-AC5B-E69446AFA309}\RP73\A0032230.exe (Rogue.Installer) -> No action taken.
C:\System Volume Information\_restore{D2FFB75B-DEC9-4A61-AC5B-E69446AFA309}\RP74\A0033298.exe (Rogue.Installer) -> No action taken.

Cela répond il à tes interrogations ?

Bon, comme la dernière fois tu m'as "tiré" les oreilles, je ne fais rien j'attends

merci à toi

BONSOIR

excuses moi du retard.
Tout d'abord si j'ai été si long c'est que cela n'a pas du tout fonctionné comme je l'espérai. Au moment du rebootage, les fichiers sont revenus.
En désespoir de cause j'ai utilisé une version linux pour éradiquer le problème.

je n'ai pas pu lancer quoi que cela soit avant maintenant
mon système a énormément ralenti et j'ai du mal à lancer quelquechose rapidement
j'ai énormément réduit le nombre de logiciels au lancement mais je ne comprends pourquoi le système est si long alors que le noyau et systèmes sont à moins de 30% d'usage.

Bref, Savant sorcier que tu es voici donc le log en question

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:11:03, on 18/06/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
E:\securit\ClamWin\bin\ClamTray.exe
E:\REZO\tenda\Mrv8000x.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\WgaTray.exe
E:\securit\VNC4\vncviewer.exe
E:\telephonie\framakey\Apps\PortableFirefox\firefox\firefox.exe
E:\securit\Hijack\eden.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1400W STD] C:\\WINDOWS\\System32\\MSTMON_Y.EXE STARTUP
O4 - HKLM\..\Run: [ClamWin] E:\\securit\\ClamWin\\bin\\ClamTray.exe
O4 - HKCU\..\Run: [Tenda TWL541u] N/A
O4 - HKCU\..\Run: [Desktop] N/A
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: TWL541U.lnk = E:\REZO\tenda\Mrv8000x.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://E:\FDM\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://E:\FDM\dllink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - E:\securit\maconfig\maconfservice.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

petit à petit me revoici :)
re-bonjour

oui toutes les protections se sont remises en service dès le rebootage de combofix

j'ai été obligé de le renommer A8ER.exe pour qu'il fonctionne. Mais il a refusé la console de restauration

et pour avoir la paix j'ai supprimé tous les progs du démarrage
si bien que maintenant je réinstalle point par point certaines choses.

cette cochonnerie
s'installe en 5 points
combo fix en a supprimé 17 braviax.exe et j'en ai toujours 2 mais cette fois déclaré comme virus.

mon problème n'est donc pas résolu en direct
j'ai remarqué que toutes les restaurations avaient sauté. physiquement présentes mais inopérantes

je te liste les éléments car je n'ai pas de log :
mis en extension virus (nom extension.vir)
en WINDOWS braviax.exe.vir
cru629.dat.vir
g32.txt.vir
s32.txt.vir
ws386.ini.vir
en SYSTEM32
braviax
cru629
deself.bat.vir
en DRIVERS
beep.sys.vir
en DLLCACHE
beep

Question : maintenant qu'ils ont été bloqués par combofix comment dois-je m'y prendre pour les supprimer de mon pc ?

a ta réponse j'aurai une autre question à poser

merci en tous cas

bonjour à toi

navré d'avoir été si long mais cette cochonnerie a planté mes connexions internet hier

voici le rapport que tu as demandé et qui a été généré

j'avoue qu'à part 1 ou 2 éléments, je ne compreends pas grand chose.
Au fait j'ai supprimé braviax par dos résultat ce matin de nouveau là idem pour l'autre prog qui s'installe avec

merci pour ton aide

pour lecture plus compréhensible : j'ai changé hi.. pour eden.exe : impossible de le lancer sinon.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:43:33, on 18/06/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
E:\securit\ClamWin\bin\ClamTray.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\System32\MSTMON_Y.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
E:\REZO\tenda\Mrv8000x.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WgaTray.exe
E:\TELEPH~1\FRAMAKEY\APPS\PORTAB~2\firefox\firefox.exe
E:\securit\Hijack\eden.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [ClamWin] "E:\securit\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1400W STD] C:\WINDOWS\System32\MSTMON_Y.EXE STARTUP
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKCU\..\Run: [updateMgr] E:\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [ccleaner] "E:\securit\cleanCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Tenda TWL541U.lnk = ?
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://E:\FDM\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://E:\FDM\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://E:\FDM\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://E:\FDM\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\cru629.dat
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe