Your computer is infected

malou -  
Bonjour,
j'ai un virus ds mon pc ( your computer is infected)
j'ai fait la procedure smitfraudfix
mais le pb persiste
voici le rapport
SmitFraudFix v2.347

Rapport fait à 17:17:11.75, 09-09-2008
Executé à partir de C:\Documents and Settings\user\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\windows\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\WinCtrl32.dll détecté, utilisez un scanner de Rootkit

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\user\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="c:\\windows\\system32\\userinit.exe"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

salutations
Configuration: Windows XP
Internet Explorer 6.0

10 réponses

  1.  ludsfa
    salut malou,

    Sélectionne l'intégralité du texte en gras ci-dessous.


    file::
    C:\FOUND.000
    C:\FOUND.001
    C:\FOUND.002
    C:\WINDOWS\gmer.ini
    C:\WINDOWS\system32\BlockedCookies
    C:\WINDOWS\system32\10004.sks
    C:\WINDOWS\system32\10001.sks
    C:\WINDOWS\system32\10002.sks

    folder::
    C:\Documents and Settings\user\S87ekhV.exe
    C:\Documents and Settings\All Users\Application Data\kfulyrgv
    C:\Program Files\SpyRemover Pro C:\WINDOWS\system32\10003.sks
    C:\Documents and Settings\user\Application Data\Simply Super Software
    C:\Program Files\Trojan Remover

    registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
    "LTXA09sMbw"=-
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winag27.sys]
    @=-
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj38.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj84.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windl84.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk16.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl16.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl40.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingm05.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winio30.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq27.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq84.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms05.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms38.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms40.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winnt62.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winov05.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvc62.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwd30.sys]
    @=-

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxe63.sys]
    @=-

    * Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
    * Enregistre le sous sur ton bureau sous le nom de CFScript.txt
    * Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :

    http://i266.photobucket.com/albums/ii277/sUBs_/CFScript.gif

    * Cela va relancer Combofix.

    Un rapport va être créer envois le moi.
    1. malou
      ComboFix 08-09-12.09 - user 2008-09-13 16:23:10.1 - [color=red][b]FAT32[/b][/color]x86
      Microsoft Windows XP Professionnel 5.1.2600.2.1256.213.1036.18.75 [GMT 2:00]
      Lancé depuis: C:\Documents and Settings\user\Bureau\ComboFix.exe
      * Un nouveau point de restauration a été créé

      [color=red][b]AVERTISSEMENT - LA CONSOLE DE RةCUPةRATION N'EST PAS INSTALLةE SUR CETTE MACHINE !![/b][/color]
      .

      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
      C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
      C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
      C:\WINDOWS\system32\~.exe
      C:\WINDOWS\system32\braviax.exe
      C:\WINDOWS\system32\DelSelf.bat
      C:\WINDOWS\system32\drivers\atmapi.sys
      C:\WINDOWS\system32\drivers\npf.sys
      C:\WINDOWS\system32\packet.dll
      C:\WINDOWS\system32\pla.ax
      C:\WINDOWS\system32\pthreadVC.dll
      C:\WINDOWS\system32\shell31.dll
      C:\WINDOWS\system32\wanpacket.dll
      C:\WINDOWS\system32\WinCtrl32.dl_
      C:\WINDOWS\system32\WinCtrl32.dll
      C:\WINDOWS\system32\winivstr.exe
      C:\WINDOWS\system32\wpcap.dll
      C:\WINDOWS\system32\wpx63.cpx
      C:\WINDOWS\wiaservb.log
      F:\CNAS TARIF.pif

      ----- BITS: Il y a peut-ˆtre des sites infect‚s -----

      http://ygsondheks.info
      .
      ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      -------\Legacy_NPF
      -------\Service_NPF
      -------\Service_poof

      ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-13 au 2008-09-13 ))))))))))))))))))))))))))))))))))))
      .

      2008-09-13 13:24 . 2008-09-13 13:24 <REP> d--hs---- C:\FOUND.002
      2008-09-13 13:05 . 2008-09-13 13:05 <REP> d--hs---- C:\FOUND.001
      2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\user\Application Data\Grisoft
      2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
      2008-09-11 17:35 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
      2008-09-11 16:41 . 2008-09-11 16:41 <REP> d-------- C:\Program Files\Trend Micro
      2008-09-10 18:06 . 2008-09-11 16:50 250 --a------ C:\WINDOWS\gmer.ini
      2008-09-09 17:16 . 2008-09-09 17:16 73,728 --a------ C:\WINDOWS\system32\drivers\796.exe
      2008-09-09 16:46 . 2008-09-09 16:46 73,728 --a------ C:\WINDOWS\system32\drivers\203.exe
      2008-09-09 15:59 . 2008-09-09 17:17 2,640 --a------ C:\WINDOWS\system32\tmp.reg
      2008-09-09 14:48 . 2008-09-09 14:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\xqzaryhe
      2008-09-09 13:57 . 2008-09-09 13:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
      2008-09-09 13:57 . 2008-09-09 14:00 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
      2008-09-09 13:56 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
      2008-09-09 13:56 . 2008-07-09 09:05 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
      2008-09-09 13:56 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
      2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
      2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\Program Files\Zone Labs
      2008-09-09 13:54 . 2008-09-09 13:54 <REP> d-------- C:\WINDOWS\Internet Logs
      2008-09-09 12:21 . 2008-09-09 12:21 73,728 --a------ C:\WINDOWS\system32\drivers\968.exe
      2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Program Files\Trojan Remover
      2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Documents and Settings\user\Application Data\Simply Super Software
      2008-09-08 14:42 . 2008-09-08 14:42 <REP> d-------- C:\Program Files\a-squared Free
      2008-09-08 14:08 . 2008-09-08 14:08 130 --a------ C:\Documents and Settings\user\delself.bat
      2008-09-08 13:53 . 2008-09-08 13:53 249,856 --a------ C:\WINDOWS\system32\nvrsol32.dll.vir
      2008-09-08 13:15 . 2008-09-08 13:15 2,840,059 --a------ C:\WINDOWS\system32\SRPSig.zip
      2008-09-08 13:15 . 2008-09-08 13:15 870,601 --a------ C:\WINDOWS\system32\SRPExe.zip
      2008-09-08 13:12 . 2008-09-08 13:12 421 --a------ C:\WINDOWS\system32\10002.sks
      2008-09-08 13:12 . 2008-09-08 13:12 97 --a------ C:\WINDOWS\system32\10001.sks
      2008-09-08 13:12 . 2008-09-08 13:15 72 --a------ C:\WINDOWS\system32\SRPVer.ini
      2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10004.sks
      2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10003.sks
      2008-09-08 13:11 . 2008-09-08 13:17 2,380 --a------ C:\WINDOWS\system32\BlockedCookies
      2008-09-08 13:10 . 2008-09-08 13:10 <REP> d-------- C:\Program Files\SpyRemover Pro
      2008-09-08 12:26 . 2008-09-08 12:27 313,474 --a------ C:\WINDOWS\system32\winivstr.exe.vir
      2008-09-08 12:25 . 2008-09-08 12:25 <REP> d--hs---- C:\FOUND.000
      2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\srv
      2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\{e0e899ab-f487-11d5-8d29-0050ba6940e3}
      2008-09-07 16:26 . 2008-09-07 16:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\kfulyrgv
      2008-09-07 16:26 . 2008-09-07 16:26 98,816 --a------ C:\WINDOWS\system32\r4h.e33
      2008-09-07 16:26 . 2008-09-07 16:26 64,000 --a------ C:\WINDOWS\system32\fds.i386
      2008-09-07 16:26 . 2008-09-07 16:26 42,496 --a------ C:\WINDOWS\system32\drivers\656.exe
      2008-09-07 16:26 . 2008-09-07 16:26 29,184 --a------ C:\WINDOWS\iexplorer.exe.vir
      2008-09-07 16:26 . 2008-09-07 16:26 21,504 --a------ C:\WINDOWS\system32\sof.586
      2008-09-07 16:26 . 2008-09-07 16:28 32 --a-s---- C:\WINDOWS\system32\2633133696.dat
      2008-09-07 16:25 . 2008-09-07 16:25 55,063 --a------ C:\Documents and Settings\user\S87ekhV.exe
      2008-08-31 13:54 . 2008-08-31 13:54 <REP> d-------- C:\Program Files\Fichiers communs\Adobe

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\user32.DLL
      2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
      2008-08-25 17:13 26 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
      2008-06-21 12:10 8,813,777 ----a-w C:\WINDOWS\system32\SRPRSig.dll
      2008-06-21 12:09 6,538,067 ----a-w C:\WINDOWS\system32\SRPFSig.dll
      2008-06-21 12:08 623,157 ----a-w C:\WINDOWS\system32\SRPESig.dll
      2004-09-03 08:32 3,488 ----a-w C:\WINDOWS\inf\OTHER\CMIAINFO.SYS
      2007-01-01 13:28 220 --sha-w C:\WINDOWS\dwin.sys
      .
      [color=red] C:\WINDOWS\system32\user32.dll ... is infected !! (additional data below) [/color]
      578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\user32.DLL
      578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\dllcache\user32.dll

      ------- Sigcheck -------

      2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\user32.DLL
      2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\dllcache\user32.dll

      2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\drivers\tcpip.sys
      2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\dllcache\tcpip.sys
      .
      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
      "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-07-16 4670704]
      "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
      "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
      "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-02-24 185896]
      "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
      "vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2007-09-13 77824]
      "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
      "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
      "LTXA09sMbw"="C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe" [2008-09-09 73728]

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winag27.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj38.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj84.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windl84.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk16.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl16.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl40.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingm05.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winio30.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq27.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq84.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms05.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms38.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms40.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winnt62.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winov05.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvc62.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwd30.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxe63.sys]
      @="Driver"

      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
      "UpdatesDisableNotify"=dword:00000001
      "AntiVirusDisableNotify"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "EnableFirewall"= 0 (0x0)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
      "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
      "F:\\eMule\\emule.exe"=
      "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
      "C:\\Program Files\\MSN Messenger\\livecall.exe"=
      "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

      R3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-12-01 117785]
      S0 Winag27;Winag27;C:\WINDOWS\system32\Drivers\Winag27.sys [ ]
      S0 Windj38;Windj38;C:\WINDOWS\system32\Drivers\Windj38.sys [ ]
      S0 Windj84;Windj84;C:\WINDOWS\system32\Drivers\Windj84.sys [ ]
      S0 Windl84;Windl84;C:\WINDOWS\system32\Drivers\Windl84.sys [ ]
      S0 Winfk16;Winfk16;C:\WINDOWS\system32\Drivers\Winfk16.sys [ ]
      S0 Winfl16;Winfl16;C:\WINDOWS\system32\Drivers\Winfl16.sys [ ]
      S0 Winfl40;Winfl40;C:\WINDOWS\system32\Drivers\Winfl40.sys [ ]
      S0 Wingm05;Wingm05;C:\WINDOWS\system32\Drivers\Wingm05.sys [ ]
      S0 Winio30;Winio30;C:\WINDOWS\system32\Drivers\Winio30.sys [ ]
      S0 Winkq27;Winkq27;C:\WINDOWS\system32\Drivers\Winkq27.sys [ ]
      S0 Winkq84;Winkq84;C:\WINDOWS\system32\Drivers\Winkq84.sys [ ]
      S0 Winms05;Winms05;C:\WINDOWS\system32\Drivers\Winms05.sys [ ]
      S0 Winms38;Winms38;C:\WINDOWS\system32\Drivers\Winms38.sys [ ]
      S0 Winms40;Winms40;C:\WINDOWS\system32\Drivers\Winms40.sys [ ]
      S0 Winnt62;Winnt62;C:\WINDOWS\system32\Drivers\Winnt62.sys [ ]
      S0 Winov05;Winov05;C:\WINDOWS\system32\Drivers\Winov05.sys [ ]
      S0 Winvc62;Winvc62;C:\WINDOWS\system32\Drivers\Winvc62.sys [ ]
      S0 Winwd30;Winwd30;C:\WINDOWS\system32\Drivers\Winwd30.sys [ ]
      S0 Winxe63;Winxe63;C:\WINDOWS\system32\Drivers\Winxe63.sys [ ]
      S2 E2ECAP;e2eCap - WDM Video Capture;C:\WINDOWS\system32\DRIVERS\e2ecap.sys [2006-07-10 124416]

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57e52f3c-f9b1-11dc-ac10-007304430c3e}]
      \Shell\AutoRun\command - H:\juok3st.bat
      \Shell\explore\Command - H:\juok3st.bat
      \Shell\open\Command - H:\juok3st.bat

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8eb66220-8fa7-11dc-ab6f-007304430c3e}]
      \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af67f332-2259-11dc-aa72-007304430c3e}]
      \Shell\AutoRun\command - H:\RavMon.exe
      \Shell\explore\Command - H:\RavMon.exe -e
      \Shell\open\Command - H:\RavMon.exe

      *Newly Created Service* - RPCSSVSS
      .
      - - - - ORPHELINS SUPPRIMES - - - -

      HKLM-Run-SpyRemoverPro - C:\PROGRA~1\SPYREM~1\SpyRemoverPro.exe
      HKLM-Run-Cmaudio - cmicnfg.cpl

      .
      ------- Examen suppl‚mentaire -------
      .
      R0 -: HKCU-Main,Start Page = about:blank
      R0 -: HKLM-Main,Start Page = hxxp://www.google.com
      R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
      O8 -: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
      O8 -: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
      O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      .
      .
      ------- File Associations (Beta) -------
      .
      .

      **************************************************************************

      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-09-13 16:37:25
      Windows 5.1.2600 Service Pack 2 FAT NTAPI

      Recherche de processus cach‚s ...

      Recherche d'‚l‚ments en d‚marrage automatique cach‚s ...

      Recherche de fichiers cach‚s ...

      Scan termin‚ avec succٹs
      Fichiers cach‚s: 0

      **************************************************************************

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BITSUMWdf]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BrowserLmHosts]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CiSvcAudioSrv]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MDMSchedule]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MessengerProtectedStorage]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDEdsdmwuauserv]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netlogonmnmsrvc]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NlaMcAfeeFramework]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetection]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetectionCOMSysApp]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrdmserver]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsusnjsvc]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsVSS]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonBrowserLmHosts]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonThemes]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TrkWksNetDDE]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\upnphostMessengerProtectedStorage]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UPSTermService]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmdmPmSNWmiApSrvImapiService]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApSrvImapiService]
      "ImagePath"=" srv"

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wuauservRemoteAccess]
      "ImagePath"=" srv"
      .
      --------------------- DLLs charg‚es dans les processus actifs ---------------------

      PROCESSUS: C:\WINDOWS\system32\winlogon.exe
      -> C:\WINDOWS\system32\NavLogon.dll
      .
      ------------------------ Autres processus actifs ------------------------
      .
      C:\PROGRAM FILES\A-SQUARED FREE\A2SERVICE.EXE
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
      C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
      C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
      C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
      C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
      C:\WINDOWS\system32\wscntfy.exe
      .
      **************************************************************************
      .
      Heure de fin: 2008-09-13 16:42:06 - La machine a red‚marr‚ [user]
      ComboFix-quarantined-files.txt 2008-09-13 14:41:54

      Avant-CF: 5,793,849,344 octets libres
      Après-CF: 5,754,134,528 octets libres

      302
      1. malou
        ComboFix 08-09-12.09 - user 2008-09-13 16:23:10.1 - [color=red][b]FAT32[/b][/color]x86
        Microsoft Windows XP Professionnel 5.1.2600.2.1256.213.1036.18.75 [GMT 2:00]
        Lancé depuis: C:\Documents and Settings\user\Bureau\ComboFix.exe
        * Un nouveau point de restauration a été créé

        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RةCUPةRATION N'EST PAS INSTALLةE SUR CETTE MACHINE !![/b][/color]
        .

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
        C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
        C:\WINDOWS\system32\~.exe
        C:\WINDOWS\system32\braviax.exe
        C:\WINDOWS\system32\DelSelf.bat
        C:\WINDOWS\system32\drivers\atmapi.sys
        C:\WINDOWS\system32\drivers\npf.sys
        C:\WINDOWS\system32\packet.dll
        C:\WINDOWS\system32\pla.ax
        C:\WINDOWS\system32\pthreadVC.dll
        C:\WINDOWS\system32\shell31.dll
        C:\WINDOWS\system32\wanpacket.dll
        C:\WINDOWS\system32\WinCtrl32.dl_
        C:\WINDOWS\system32\WinCtrl32.dll
        C:\WINDOWS\system32\winivstr.exe
        C:\WINDOWS\system32\wpcap.dll
        C:\WINDOWS\system32\wpx63.cpx
        C:\WINDOWS\wiaservb.log
        F:\CNAS TARIF.pif

        ----- BITS: Il y a peut-ˆtre des sites infect‚s -----

        http://ygsondheks.info
        .
        ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
        .

        -------\Legacy_NPF
        -------\Service_NPF
        -------\Service_poof

        ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-13 au 2008-09-13 ))))))))))))))))))))))))))))))))))))
        .

        2008-09-13 13:24 . 2008-09-13 13:24 <REP> d--hs---- C:\FOUND.002
        2008-09-13 13:05 . 2008-09-13 13:05 <REP> d--hs---- C:\FOUND.001
        2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\user\Application Data\Grisoft
        2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
        2008-09-11 17:35 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
        2008-09-11 16:41 . 2008-09-11 16:41 <REP> d-------- C:\Program Files\Trend Micro
        2008-09-10 18:06 . 2008-09-11 16:50 250 --a------ C:\WINDOWS\gmer.ini
        2008-09-09 17:16 . 2008-09-09 17:16 73,728 --a------ C:\WINDOWS\system32\drivers\796.exe
        2008-09-09 16:46 . 2008-09-09 16:46 73,728 --a------ C:\WINDOWS\system32\drivers\203.exe
        2008-09-09 15:59 . 2008-09-09 17:17 2,640 --a------ C:\WINDOWS\system32\tmp.reg
        2008-09-09 14:48 . 2008-09-09 14:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\xqzaryhe
        2008-09-09 13:57 . 2008-09-09 13:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
        2008-09-09 13:57 . 2008-09-09 14:00 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
        2008-09-09 13:56 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
        2008-09-09 13:56 . 2008-07-09 09:05 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
        2008-09-09 13:56 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
        2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
        2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\Program Files\Zone Labs
        2008-09-09 13:54 . 2008-09-09 13:54 <REP> d-------- C:\WINDOWS\Internet Logs
        2008-09-09 12:21 . 2008-09-09 12:21 73,728 --a------ C:\WINDOWS\system32\drivers\968.exe
        2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Program Files\Trojan Remover
        2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Documents and Settings\user\Application Data\Simply Super Software
        2008-09-08 14:42 . 2008-09-08 14:42 <REP> d-------- C:\Program Files\a-squared Free
        2008-09-08 14:08 . 2008-09-08 14:08 130 --a------ C:\Documents and Settings\user\delself.bat
        2008-09-08 13:53 . 2008-09-08 13:53 249,856 --a------ C:\WINDOWS\system32\nvrsol32.dll.vir
        2008-09-08 13:15 . 2008-09-08 13:15 2,840,059 --a------ C:\WINDOWS\system32\SRPSig.zip
        2008-09-08 13:15 . 2008-09-08 13:15 870,601 --a------ C:\WINDOWS\system32\SRPExe.zip
        2008-09-08 13:12 . 2008-09-08 13:12 421 --a------ C:\WINDOWS\system32\10002.sks
        2008-09-08 13:12 . 2008-09-08 13:12 97 --a------ C:\WINDOWS\system32\10001.sks
        2008-09-08 13:12 . 2008-09-08 13:15 72 --a------ C:\WINDOWS\system32\SRPVer.ini
        2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10004.sks
        2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10003.sks
        2008-09-08 13:11 . 2008-09-08 13:17 2,380 --a------ C:\WINDOWS\system32\BlockedCookies
        2008-09-08 13:10 . 2008-09-08 13:10 <REP> d-------- C:\Program Files\SpyRemover Pro
        2008-09-08 12:26 . 2008-09-08 12:27 313,474 --a------ C:\WINDOWS\system32\winivstr.exe.vir
        2008-09-08 12:25 . 2008-09-08 12:25 <REP> d--hs---- C:\FOUND.000
        2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\srv
        2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\{e0e899ab-f487-11d5-8d29-0050ba6940e3}
        2008-09-07 16:26 . 2008-09-07 16:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\kfulyrgv
        2008-09-07 16:26 . 2008-09-07 16:26 98,816 --a------ C:\WINDOWS\system32\r4h.e33
        2008-09-07 16:26 . 2008-09-07 16:26 64,000 --a------ C:\WINDOWS\system32\fds.i386
        2008-09-07 16:26 . 2008-09-07 16:26 42,496 --a------ C:\WINDOWS\system32\drivers\656.exe
        2008-09-07 16:26 . 2008-09-07 16:26 29,184 --a------ C:\WINDOWS\iexplorer.exe.vir
        2008-09-07 16:26 . 2008-09-07 16:26 21,504 --a------ C:\WINDOWS\system32\sof.586
        2008-09-07 16:26 . 2008-09-07 16:28 32 --a-s---- C:\WINDOWS\system32\2633133696.dat
        2008-09-07 16:25 . 2008-09-07 16:25 55,063 --a------ C:\Documents and Settings\user\S87ekhV.exe
        2008-08-31 13:54 . 2008-08-31 13:54 <REP> d-------- C:\Program Files\Fichiers communs\Adobe

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\user32.DLL
        2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
        2008-08-25 17:13 26 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
        2008-06-21 12:10 8,813,777 ----a-w C:\WINDOWS\system32\SRPRSig.dll
        2008-06-21 12:09 6,538,067 ----a-w C:\WINDOWS\system32\SRPFSig.dll
        2008-06-21 12:08 623,157 ----a-w C:\WINDOWS\system32\SRPESig.dll
        2004-09-03 08:32 3,488 ----a-w C:\WINDOWS\inf\OTHER\CMIAINFO.SYS
        2007-01-01 13:28 220 --sha-w C:\WINDOWS\dwin.sys
        .
        [color=red] C:\WINDOWS\system32\user32.dll ... is infected !! (additional data below) [/color]
        578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\user32.DLL
        578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\dllcache\user32.dll

        ------- Sigcheck -------

        2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\user32.DLL
        2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\dllcache\user32.dll

        2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\drivers\tcpip.sys
        2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\dllcache\tcpip.sys
        .
        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
        REGEDIT4

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
        "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-07-16 4670704]
        "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
        "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
        "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-02-24 185896]
        "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
        "vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2007-09-13 77824]
        "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
        "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
        "LTXA09sMbw"="C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe" [2008-09-09 73728]

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winag27.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj38.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj84.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windl84.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk16.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl16.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl40.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingm05.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winio30.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq27.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq84.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms05.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms38.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms40.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winnt62.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winov05.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvc62.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwd30.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxe63.sys]
        @="Driver"

        [HKEY_LOCAL_MACHINE\software\microsoft\security center]
        "UpdatesDisableNotify"=dword:00000001
        "AntiVirusDisableNotify"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
        "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
        "F:\\eMule\\emule.exe"=
        "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\MSN Messenger\\livecall.exe"=
        "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

        R3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-12-01 117785]
        S0 Winag27;Winag27;C:\WINDOWS\system32\Drivers\Winag27.sys [ ]
        S0 Windj38;Windj38;C:\WINDOWS\system32\Drivers\Windj38.sys [ ]
        S0 Windj84;Windj84;C:\WINDOWS\system32\Drivers\Windj84.sys [ ]
        S0 Windl84;Windl84;C:\WINDOWS\system32\Drivers\Windl84.sys [ ]
        S0 Winfk16;Winfk16;C:\WINDOWS\system32\Drivers\Winfk16.sys [ ]
        S0 Winfl16;Winfl16;C:\WINDOWS\system32\Drivers\Winfl16.sys [ ]
        S0 Winfl40;Winfl40;C:\WINDOWS\system32\Drivers\Winfl40.sys [ ]
        S0 Wingm05;Wingm05;C:\WINDOWS\system32\Drivers\Wingm05.sys [ ]
        S0 Winio30;Winio30;C:\WINDOWS\system32\Drivers\Winio30.sys [ ]
        S0 Winkq27;Winkq27;C:\WINDOWS\system32\Drivers\Winkq27.sys [ ]
        S0 Winkq84;Winkq84;C:\WINDOWS\system32\Drivers\Winkq84.sys [ ]
        S0 Winms05;Winms05;C:\WINDOWS\system32\Drivers\Winms05.sys [ ]
        S0 Winms38;Winms38;C:\WINDOWS\system32\Drivers\Winms38.sys [ ]
        S0 Winms40;Winms40;C:\WINDOWS\system32\Drivers\Winms40.sys [ ]
        S0 Winnt62;Winnt62;C:\WINDOWS\system32\Drivers\Winnt62.sys [ ]
        S0 Winov05;Winov05;C:\WINDOWS\system32\Drivers\Winov05.sys [ ]
        S0 Winvc62;Winvc62;C:\WINDOWS\system32\Drivers\Winvc62.sys [ ]
        S0 Winwd30;Winwd30;C:\WINDOWS\system32\Drivers\Winwd30.sys [ ]
        S0 Winxe63;Winxe63;C:\WINDOWS\system32\Drivers\Winxe63.sys [ ]
        S2 E2ECAP;e2eCap - WDM Video Capture;C:\WINDOWS\system32\DRIVERS\e2ecap.sys [2006-07-10 124416]

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57e52f3c-f9b1-11dc-ac10-007304430c3e}]
        \Shell\AutoRun\command - H:\juok3st.bat
        \Shell\explore\Command - H:\juok3st.bat
        \Shell\open\Command - H:\juok3st.bat

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8eb66220-8fa7-11dc-ab6f-007304430c3e}]
        \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af67f332-2259-11dc-aa72-007304430c3e}]
        \Shell\AutoRun\command - H:\RavMon.exe
        \Shell\explore\Command - H:\RavMon.exe -e
        \Shell\open\Command - H:\RavMon.exe

        *Newly Created Service* - RPCSSVSS
        .
        - - - - ORPHELINS SUPPRIMES - - - -

        HKLM-Run-SpyRemoverPro - C:\PROGRA~1\SPYREM~1\SpyRemoverPro.exe
        HKLM-Run-Cmaudio - cmicnfg.cpl

        .
        ------- Examen suppl‚mentaire -------
        .
        R0 -: HKCU-Main,Start Page = about:blank
        R0 -: HKLM-Main,Start Page = hxxp://www.google.com
        R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
        O8 -: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
        O8 -: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
        O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        .
        .
        ------- File Associations (Beta) -------
        .
        .

        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-09-13 16:37:25
        Windows 5.1.2600 Service Pack 2 FAT NTAPI

        Recherche de processus cach‚s ...

        Recherche d'‚l‚ments en d‚marrage automatique cach‚s ...

        Recherche de fichiers cach‚s ...

        Scan termin‚ avec succٹs
        Fichiers cach‚s: 0

        **************************************************************************

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BITSUMWdf]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BrowserLmHosts]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CiSvcAudioSrv]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MDMSchedule]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MessengerProtectedStorage]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDEdsdmwuauserv]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netlogonmnmsrvc]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NlaMcAfeeFramework]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetection]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetectionCOMSysApp]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrdmserver]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsusnjsvc]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsVSS]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonBrowserLmHosts]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonThemes]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TrkWksNetDDE]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\upnphostMessengerProtectedStorage]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UPSTermService]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmdmPmSNWmiApSrvImapiService]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApSrvImapiService]
        "ImagePath"=" srv"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wuauservRemoteAccess]
        "ImagePath"=" srv"
        .
        --------------------- DLLs charg‚es dans les processus actifs ---------------------

        PROCESSUS: C:\WINDOWS\system32\winlogon.exe
        -> C:\WINDOWS\system32\NavLogon.dll
        .
        ------------------------ Autres processus actifs ------------------------
        .
        C:\PROGRAM FILES\A-SQUARED FREE\A2SERVICE.EXE
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
        C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
        C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
        C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
        C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
        C:\WINDOWS\system32\wscntfy.exe
        .
        **************************************************************************
        .
        Heure de fin: 2008-09-13 16:42:06 - La machine a red‚marr‚ [user]
        ComboFix-quarantined-files.txt 2008-09-13 14:41:54

        Avant-CF: 5,793,849,344 octets libres
        Après-CF: 5,754,134,528 octets libres

        302
        1. ludsfa
          salut malou,

          peux tu m'envoyer le rapport car il y à certainement des infections que combofix n'à pas supprimé.
          2. ludsfa
            salut,

            Télécharge ComboFix (de sUBs) sur ton Bureau.
            http://download.bleepingcomputer.com/sUBs/ComboFix.exe

            * Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
            * Double clique sur ComboFix.exe.
            * Accepte la licence en cliquant sur Oui.
            * Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

            Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)
            1. malou
              bonjour
              j'ai telechargé combofix
              j'ai fait un scan
              le message" your computer is infected" a disparu
              je pense que tout est reglé
              je te remercie
          5. ludsfa
            Bonjour,

            Télécharge ComboFix (de sUBs) sur ton Bureau.
            http://download.bleepingcomputer.com/sUBs/ComboFix.exe

            * Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
            * Double clique sur ComboFix.exe.
            * Accepte la licence en cliquant sur Oui.
            * Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

            Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

            Aide : Comment utiliser ComboFix.
            https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
            1. malou
              j'ai pas compris le fonctiionnement de combofix
              j'ai fait avec hijack
              voici le rapport
              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 16:41:46, on 11-09-2008
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\spoolsv.exe
              c:\windows\explorer.exe
              C:\Program Files\a-squared Free\a2service.exe
              C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
              C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
              C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
              C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe
              C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
              C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
              C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
              C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
              C:\WINDOWS\system32\braviax.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
              C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
              C:\Program Files\Internet Explorer\iexplore.exe
              C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
              F2 - REG:system.ini: Shell=c:\windows\explorer.exe
              F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
              O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
              O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
              O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
              O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
              O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
              O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
              O4 - HKLM\..\Run: [advap32] "C:\DOCUME~1\user\LOCALS~1\Temp\loader.exe" /r
              O4 - HKLM\..\Run: [SpyRemoverPro] C:\PROGRA~1\SPYREM~1\SpyRemoverPro.exe
              O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
              O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
              O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
              O4 - HKLM\..\Policies\Explorer\Run: [LTXA09sMbw] C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe
              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
              O4 - Global Startup: DSLMON.lnk = ?
              O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
              O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
              O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
              O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
              O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
              O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
              O17 - HKLM\System\CCS\Services\Tcpip\..\{C935A448-A7B1-4F04-885B-12507C6CD6FB}: NameServer = 41.221.20.4 193.251.169.165
              O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
              O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
              O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
              O23 - Service: Service de transfert intelligent en arrière-plan BITSUMWdf (BITSUMWdf) - Unknown owner - .exe (file missing)
              O23 - Service: Explorateur d'ordinateur BrowserLmHosts (BrowserLmHosts) - Unknown owner - .exe (file missing)
              O23 - Service: Service d'indexation CiSvcAudioSrv (CiSvcAudioSrv) - Unknown owner - .exe (file missing)
              O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
              O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
              O23 - Service: Machine Debug Manager (MDM) - Network Associates, Inc. - (no file)
              O23 - Service: Machine Debug Manager MDMSchedule (MDMSchedule) - Unknown owner - .exe (file missing)
              O23 - Service: Affichage des messages MessengerProtectedStorage (MessengerProtectedStorage) - Unknown owner - .exe (file missing)
              O23 - Service: DSDM DDE réseau NetDDEdsdmwuauserv (NetDDEdsdmwuauserv) - Unknown owner - .exe (file missing)
              O23 - Service: Ouverture de session réseau Netlogonmnmsrvc (Netlogonmnmsrvc) - Unknown owner - .exe (file missing)
              O23 - Service: NLA (Network Location Awareness) NlaMcAfeeFramework (NlaMcAfeeFramework) - Unknown owner - .exe (file missing)
              O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
              O23 - Service: Services IPSEC PolicyAgentShellHWDetection (PolicyAgentShellHWDetection) - Unknown owner - .exe (file missing)
              O23 - Service: Services IPSEC PolicyAgentShellHWDetection PolicyAgentShellHWDetectionCOMSysApp (PolicyAgentShellHWDetectionCOMSysApp) - Unknown owner - .exe (file missing)
              O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance RDSessMgrdmserver (RDSessMgrdmserver) - Unknown owner - .exe (file missing)
              O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
              O23 - Service: Appel de procédure distante (RPC) RpcSsusnjsvc (RpcSsusnjsvc) - Unknown owner - .exe (file missing)
              O23 - Service: Connexion secondaire seclogonThemes (seclogonThemes) - Unknown owner - .exe (file missing)
              O23 - Service: Client de suivi de lien distribué TrkWksNetDDE (TrkWksNetDDE) - Unknown owner - .exe (file missing)
              O23 - Service: Hôte de périphérique universel Plug-and-Play upnphostMessengerProtectedStorage (upnphostMessengerProtectedStorage) - Unknown owner - .exe (file missing)
              O23 - Service: Onduleur UPSTermService (UPSTermService) - Unknown owner - .exe (file missing)
              O23 - Service: Carte de performance WMI WmiApSrvImapiService (WmiApSrvImapiService) - Unknown owner - .exe (file missing)
              O23 - Service: Mises à jour automatiques wuauservRemoteAccess (wuauservRemoteAccess) - Unknown owner - .exe (file missing)
          6. malou
            une precision
            j'obtiens ce rapport en cochant toutes les cases
            mais on laissant les cases (services et files) j'obtient rien par le scan
            1. ludsfa
              salut,

              Télécharge Gmer:
              http://www2.gmer.net/gmer.zip
              Dézippe le dans un dossier ou sur ton bureau:
              http://www.7-zip.org/fr/

              Déconnecte toi d'Internet puis et ferme tous les programmes.
              Double-clique sur Gmer.exe.

              IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.

              Clique sur l'onglet rootkit.
              A droite, coche Files et Services.
              Clique maintenant sur Scan.

              Lorsque le scan est terminé, clique sur Copy.

              Ouvre le Bloc-notes puis clique sur le Menu Edition / Coller.
              Le rapport doit alors apparaître.
              Enregistre le fichier sur ton bureau et copie/colle le contenu ici.

              Discussions similaires

              Spam SMS : your messenger vérification code is ***
              Metheor

              1 réponse
              Sms étranges "... is your instagram code"
              Anon_4067

              5 réponses
              TokyVideo : avis, site fiable ou arnaque ?
              timinie

              8 réponses
              Page bleue : your PC ran into a problem and needs to restart
              pitchalou

              2 réponses
              Rtc battery low
              Laeti28

              15 réponses