Pc infecté

ccleaner est important
le reste ces pas graves

jsuis pas membre du site j'arrive pas a faire que la discussion soit "resolue"

c vraiment necessaire ccleaner jariv pa a le telecharger?

g pas obtenu le rapor toolcleaner
apres ca je peux effacé c logiciel?

la console de recup permet en cas de très gros plantage de windows de réparer depuis celle-ci

pour terminer

Télécharge ToolsCleaner sur ton bureau.
-->
http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner

# Clique sur "Recherche" et laisse le scan agir ...
# Clique sur "Suppression" pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

ensuite

Télécharges : - CCleaner (n'installe pas la barre d'outil Yahoo)
https://www.pcastuces.com/logitheque/ccleaner.htm
Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corrigé ton registre .Lors de l'installation, avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 première.
Une fois le prg instalé et lancé, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures"( Par la suite, laisse-le avec ses réglages par défaut. C'est tout ).

Un tuto ( aide ):
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

---> Utilisation:
! déconnectes toi et fermes toutes applications en cours !
* vas dans "nettoyeur" : fait analyse puis nettoyage
* vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) .

( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

***très important***

Suppression des points de restauration :
1.Ouvre le Menu Démarrer
2.Clique-droit sur Poste de travail
3.Clique sur Propriétés
4.Positionne-toi dans l'onglet Restauration du système
5.Coche "Désactiver la restauration système"
6.Valide par Ok
7.Redémarre ton pc
8.Reproduis les manipulations 1 à 3
9.Décoche "Désactiver la restauration système"
10.Valide par Ok

Ne pas oublier de créer un nouveau point de restauration en procédant comme indiqué sur le lien ci dessous

https://www.vulgarisation-informatique.com/creer-point-restauration.php

si tu n as pas d autres soucis change le statut du sujet en resolu stp

ca ve dire koi ca "LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE "??

b g come page d'accueil google, jvais navigué é jv voir si g d pub merci bocoup pour ton aide c tro vraiment trop sympa merci, je pe desinstaller tout les logiciel que j'ai utilisé?, voici le rapor:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
c:\windows\system32\h323msp32.dll unregistered successfully.
c:\windows\system32\h323msp32.dll moved successfully.
c:\windows\system32\h323msp32.dll_manifest moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\~DF3760.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\~DF379D.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\~DF5562.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\~DF556E.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\Perflib_Perfdata_2e4.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\Perflib_Perfdata_7f4.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\Perflib_Perfdata_b0.dat scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_628.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_1b0.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_c14.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11232008_183514

Files moved on Reboot...
File C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\~DF3760.tmp not found!
File C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\~DF379D.tmp not found!
File C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\~DF5562.tmp not found!
File C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\~DF556E.tmp not found!
File C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\Perflib_Perfdata_2e4.dat not found!
File C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\Perflib_Perfdata_7f4.dat not found!
File C:\DOCUME~1\DJOUDI\LOCALS~1\Temp\Perflib_Perfdata_b0.dat not found!
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.
File C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
File C:\WINDOWS\temp\Perflib_Perfdata_628.dat not found!
C:\WINDOWS\temp\Perflib_Perfdata_1b0.dat moved successfully.
C:\WINDOWS\temp\Perflib_Perfdata_c14.dat moved successfully.

on arrive à la fin

Télécharge OTMoveIt3( de Old Timer )
http://oldtimer.geekstogo.com/OTMoveIt3.exe
Une fois téléchargé double-clique sur OTMoveIt3.exe pour le lancer.
Assure toi que la case "Unregister Dll's and Ocx's" est cochée
Copie les lignes en gras qui se trouvent en dessous :

:Processes
explorer.exe

:Files
c:\windows\system32\h323msp32.dll
c:\windows\system32\h323msp32.dll_manifest

:Commands
[emptytemp]
[start explorer]
[Reboot]

et colle-les dans le cadre de gauche de OTMoveIt : "Paste List Of Files/Folders to Move."
Clique sur "MoveIt!" pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur Exit pour fermer.
Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
-Il te sera peut-être demander de redémarrer le pc pour achever la suppression -> Accepte ( si il ne fait pas automatiquement , fait-le toi même )

/!\ Note : Au démarrage ton bureau RISQUE de ne plus apparaître, dans ce cas fait --> CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi sur l'onglet "Processus". Clique en haut à gauche sur "Fichiers" et choisis "Exécuter"
Tape "explorer.exe"(sans les guillemèts) et valide. Cela fera réapparaître le Bureau.

*************************************

ensuite
dis moi comment tourne ton pc

ou pluto ce rapor:

ComboFix 08-11-22.02 - DJOUDI 2008-11-23 18:03:18.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1616 [GMT 1:00]
Lancé depuis: c:\documents and settings\DJOUDI\Bureau\logi antivirus\ComboFix.exe
* Un nouveau point de restauration a été créé

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\DJOUDI\Local Settings\Temporary Internet Files\EUP3E9.tmp
c:\windows\IE4 Error Log.txt
c:\windows\system32\bvnkfi.dll
c:\windows\system32\camaix.dll
c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
c:\windows\system32\heinxdns.dll
c:\windows\system32\pqsonxrd.dll
c:\windows\system32\rxwlveig.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-23 au 2008-11-23 ))))))))))))))))))))))))))))))))))))
.

2008-11-23 17:03 . 2008-11-23 17:03 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-23 17:03 . 2008-11-23 17:03 <REP> d-------- c:\documents and settings\DJOUDI\Application Data\Malwarebytes
2008-11-23 17:03 . 2008-11-23 17:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-23 17:03 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-23 17:03 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-22 20:37 . 2008-11-22 20:37 <REP> d-------- c:\program files\UsbFix
2008-11-22 16:15 . 2008-11-22 16:15 <REP> d-------- c:\program files\Trend Micro
2008-11-22 15:58 . 2008-11-22 16:24 256 --a------ c:\windows\wininit.ini
2008-11-22 15:32 . 2008-11-22 15:32 <REP> d-------- c:\program files\Spybot - Search & Destroy
2008-11-22 15:32 . 2008-11-22 15:32 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-21 22:15 . 2008-11-21 22:15 <REP> d-------- c:\windows\system32\Kaspersky Lab
2008-11-21 18:56 . 2008-11-21 18:56 <REP> d-------- c:\windows\BDOSCAN8
2008-11-17 12:21 . 2008-11-17 12:21 <REP> d-------- c:\documents and settings\DJOUDI\Application Data\Nvu
2008-11-17 12:20 . 2008-11-17 12:20 <REP> d-------- c:\program files\Nvu
2008-10-30 22:08 . 2008-10-30 22:54 39,424 --a------ c:\windows\system32\h323msp32.dll
2008-10-30 22:08 . 2008-10-30 22:08 38,400 --a------ c:\windows\system32\h323msp32.dll_manifest

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-19 22:21 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-10-19 22:03 --------- d-----w c:\program files\Windows Live
2008-10-19 22:03 --------- d-----w c:\program files\Messenger Plus! Live
2008-10-18 15:54 --------- d-----w c:\program files\Lopxp
2008-10-12 13:39 --------- d-----w c:\program files\Notepad++
2008-10-12 13:39 --------- d-----w c:\documents and settings\DJOUDI\Application Data\Notepad++
2008-09-15 16:39 1,846,144 ----a-w c:\windows\system32\win32k.sys
2008-09-15 16:39 1,846,144 ----a-w c:\windows\system32\dllcache\win32k.sys
2008-08-28 11:04 333,056 ----a-w c:\windows\system32\dllcache\srv.sys
2007-11-25 12:31 404 ----a-w c:\program files\sosotkt.txt
2007-11-18 12:10 8 ----a-w c:\program files\nomutil.txt
2007-04-25 20:02 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"E07FXLRD_532328"="c:\program files\Microsoft Encarta\Microsoft Encarta 2007 - Collection DVD\EDICT.EXE" [2006-06-13 351000]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-22 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 53248]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 79224]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Utilitaire r‚seau pour SAGEM Wi-Fi 11g USB adapter.lnk - c:\program files\SAGEM WiFi manager\WLANUTL.exe [2008-03-20 925696]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Acer Empowering Technology.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Acer Empowering Technology.lnk
backup=c:\windows\pss\Acer Empowering Technology.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=c:\windows\pss\Outil de mise à jour Google.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePresentation HPD]
--a------ 2006-03-31 16:39 204800 c:\acer\Empowering Technology\ePresentation\ePresentation.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BEWINTERNET-FR-DMGP-V2SessionManager]
--a------ 2008-02-13 10:16 102400 c:\program files\Orange\IEWInternet\SessionManager\SessionManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
--a------ 2006-03-15 22:12 579584 c:\acer\Empowering Technology\ePower\Boot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CardDetectorICON225]
-ra------ 2007-11-14 00:47 278528 c:\program files\CardDetector\ICON225\CardDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-10 20:00 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E07FXLRD_19168375]
--a------ 2006-06-13 18:11 351000 c:\program files\Microsoft Encarta\Microsoft Encarta 2007 - Collection DVD\EDICT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 13:34 64512 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
--a------ 2006-05-30 12:11 421888 c:\acer\Empowering Technology\ePower\ePower_DMC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
--a------ 2006-06-01 14:40 413696 c:\acer\Empowering Technology\eRecovery\eRAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-10 20:00 208952 c:\windows\ime\imjp8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
--a------ 2006-06-23 06:59 602112 c:\progra~1\LAUNCH~1\LManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 18:24 1694208 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]
--a------ 2005-05-11 17:15 45056 c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-11-28 14:12 222720 c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-07-22 23:46 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2006-03-03 13:07 761946 c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-09-19 13:09 180269 c:\program files\Fichiers communs\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2004-11-22 08:18 307200 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp]
--a------ 2006-09-23 13:08 61440 c:\acer\WR_PopUp\WarReg_PopUp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOKIT]
--a------ 2004-08-23 14:50 122880 c:\progra~1\Wanadoo\Shell.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
--------- 2004-10-14 16:55 32768 c:\progra~1\Wanadoo\GestMAJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
--------- 2004-08-23 14:49 20480 c:\progra~1\Wanadoo\Watch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 03:43 69632 c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-06-27 23:54 16248320 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2006-05-16 03:04 2879488 c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\eMule\\eMule.exe"=
"c:\\Program Files\\Orange\\IEWInternet\\Connectivity\\ConnectivityManager.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-13 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-13 20560]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\eLock2BurnerLockDriver.sys []
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\eLock2FSCTLDriver.sys []
S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\DRIVERS\Gt51Ip.sys [2008-09-08 95744]
S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\DRIVERS\gt72ubus.sys [2008-09-08 51968]
S3 GTPTSER;GT PT SER;c:\windows\system32\DRIVERS\gtptser.sys [2008-09-08 8064]
S3 ids00026;ids00026;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys []
S3 ids001b8;ids001b8;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids001b8.sys []
S3 klstm;klstm;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\klstm.sys []
S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\DRIVERS\WlanBZXP.sys [2008-03-20 402432]
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS []

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'

2008-11-23 c:\windows\Tasks\B243F6DF905C6CE7.job
- c:\docume~1\djoudi\applic~1\poketr~1\SiteDrawBase.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -

Notify-pmnlJddE - pmnlJddE.dll
MSConfigStartUp-Base frag grid bows - c:\documents and settings\All Users\Application Data\Cast ping base frag\Great thunk.exe
MSConfigStartUp-Loudwave - c:\docume~1\DJOUDI\APPLIC~1\POKETR~1\Trust Locks.exe

.
------- Examen supplémentaire -------
.
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.google.com/
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: { - c:\program files\Messenger\msmsgs.exe
IE: {c:\program files\Messenger\msmsgs.exe - -

c:\windows\bdoscandellang.ini - c:\windows\bdoscandel.exe
c:\windows\Downloaded Program Files\live.ini
c:\windows\Downloaded Program Files\scanoptions.tsi
c:\windows\Downloaded Program Files\lang.ini
c:\windows\Downloaded Program Files\ipsupd.dll
c:\windows\Downloaded Program Files\bdupd.dll
c:\windows\Downloaded Program Files\libfn.dll
c:\windows\Downloaded Program Files\bdcore.dll
c:\windows\Downloaded Program Files\oscan8.ocx
O16 -: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
c:\windows\Downloaded Program Files\oscan8.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-23 18:05:32
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(616)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\rsaenh.dll

- - - - - - - > 'lsass.exe'(672)
c:\windows\system32\msprivs.dll
c:\windows\system32\rsaenh.dll
.
Heure de fin: 2008-11-23 18:06:44
ComboFix-quarantined-files.txt 2008-11-23 17:06:42

Avant-CF: 28 861 693 952 octets libres
Après-CF: 28,884,238,336 octets libres

216 --- E O F --- 2008-10-15 11:21:29

voici le report:

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1417
Windows 5.1.2600 Service Pack 2

23/11/2008 17:28:18
mbam-log-2008-11-23 (17-28-18).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 115420
Temps écoulé: 19 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 11
Clé(s) du Registre infectée(s): 27
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 25

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\iifFWpNh.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ublkqg.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ovifwl.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\eralhq.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\gzwppi.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\knhwrj.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\qeamqa.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\yyikri.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\cetyxe.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\gymdxb.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\aumoml.dll (Trojan.Vundo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1637aff4-f510-4811-ab01-f88b72401503} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{1637aff4-f510-4811-ab01-f88b72401503} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53b9ae58-1bd5-4988-b911-779b9fc091cf} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{53b9ae58-1bd5-4988-b911-779b9fc091cf} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3b2ae4dc-dd00-4b57-9e85-4a78dd2f0e2d} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{10cc7654-b227-469e-9c19-b1efd3eab28b} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d476732c-08d1-4df5-bf27-3c8ae6e213f1} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2c956994-0183-477b-91b2-b7c0ce48a002} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ce722fdd-01a1-4e63-a48a-bca94ad5f94e} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0130767e-fa2f-4343-b830-3f81010bbfa8} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{75e2a9a3-ca25-4cc7-99ce-10037ac324a5} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{60426656-086f-4d27-8b55-b712fcf772b4} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{43a44fa6-ce22-490a-aa87-f3ea543fff1d} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{53b9ae58-1bd5-4988-b911-779b9fc091cf} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1637aff4-f510-4811-ab01-f88b72401503} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\antiviruspro2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\Fichiers communs\Real\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\iiffwpnh -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\iiffwpnh -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\iifFWpNh.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\hNpWFfii.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hNpWFfii.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\aumoml.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\yhhiidro.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ordiihhy.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ublkqg.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ovifwl.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\eralhq.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\gzwppi.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\knhwrj.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\qeamqa.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\yyikri.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\cetyxe.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\gymdxb.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\Fichiers communs\Real\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.
C:\WINDOWS\c2z.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wwpwktsr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xbwnrw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kkxqmwda.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gxrkma.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wini10791.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\DJOUDI\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

tu n'as que avast a désactiver
regarde ici
pour désactiver les protections résidentes

ok,

va dans la quarantaine de malwarebyte et supprime tout

pour être sur que tout a été retiré
fais ceci

Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

**Désactive les logiciels de protection** (Antivirus, Antispywares) puis :
deconnecte toi d'internet,ferme tout les programmes

Double-clique sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider.
ne touche plus à rien, même pas ta souris!!
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Copie/colle un nouveau rapport HiJackThis avec.

g fait ce que tu m'a dit l'analyse m'a detecté de nombreux fichiers infectés mais a la fin tous n'ont pas pu etre effacé il m'a donc conseillé de redemarré le pc j'ai accepté, a la fin de l'analyse le rapport suivant s'est affiché:

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1417
Windows 5.1.2600 Service Pack 2

23/11/2008 17:28:18
mbam-log-2008-11-23 (17-28-18).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 115420
Temps écoulé: 19 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 11
Clé(s) du Registre infectée(s): 27
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 25

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\iifFWpNh.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ublkqg.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ovifwl.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\eralhq.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\gzwppi.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\knhwrj.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\qeamqa.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\yyikri.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\cetyxe.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\gymdxb.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\aumoml.dll (Trojan.Vundo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1637aff4-f510-4811-ab01-f88b72401503} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{1637aff4-f510-4811-ab01-f88b72401503} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53b9ae58-1bd5-4988-b911-779b9fc091cf} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{53b9ae58-1bd5-4988-b911-779b9fc091cf} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3b2ae4dc-dd00-4b57-9e85-4a78dd2f0e2d} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{10cc7654-b227-469e-9c19-b1efd3eab28b} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d476732c-08d1-4df5-bf27-3c8ae6e213f1} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2c956994-0183-477b-91b2-b7c0ce48a002} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ce722fdd-01a1-4e63-a48a-bca94ad5f94e} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0130767e-fa2f-4343-b830-3f81010bbfa8} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{75e2a9a3-ca25-4cc7-99ce-10037ac324a5} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{60426656-086f-4d27-8b55-b712fcf772b4} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{43a44fa6-ce22-490a-aa87-f3ea543fff1d} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{53b9ae58-1bd5-4988-b911-779b9fc091cf} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1637aff4-f510-4811-ab01-f88b72401503} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\antiviruspro2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\Fichiers communs\Real\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\iiffwpnh -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\iiffwpnh -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\iifFWpNh.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\hNpWFfii.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hNpWFfii.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\aumoml.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\yhhiidro.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ordiihhy.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ublkqg.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ovifwl.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\eralhq.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\gzwppi.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\knhwrj.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\qeamqa.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\yyikri.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\cetyxe.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\gymdxb.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\Fichiers communs\Real\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.
C:\WINDOWS\c2z.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wwpwktsr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xbwnrw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kkxqmwda.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gxrkma.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\_scui.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wini10791.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\DJOUDI\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

essaye de poster a la suite de mes messages stp
sinon on va jamais s'y retrouver

Télécharge Malwarebytes' Anti-Malware et enregistre le sur ton Bureau.
https://www.malwarebytes.com/

(NB : Si il te manque "COMCTL32.OCX" lors de l'installe, alors télécharges le ici : https://www.malekal.com/tutorial-aboutbuster/ )

A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.
Double-clique sur l'icône "Download_mbam-setup.exe" sur ton bureau pour démarrer le programme d'installation.

Pendant l'installation, suis les indications n'apporte aucune modification aux réglages par défaut et en fin d'installation, vérifie que les options "Update Malwarebytes' Anti-Malware" et "Launch Malwarebytes' Anti-Malware" soit cochées.
MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue.
La fenêtre principale de MBAM s'affiche :
Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.
MBAM analyse ton ordinateur.
L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.
A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.
Si des malwares sont détectés, leur liste s'affiche.
***EN CLIQUANT SUR SUPPRESSION(?)FAIT LE*** , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)
Ferme MBAM en cliquant sur Quitter.
Poste le rapport dans ta réponse

ok,

relance hijack (scan only) et coche cette ligne

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system3­2\wscript.exe C:\WINDOWS\system32\antinul.vbe

clic sur fix checked

redémarre ton pc et reposte un nouveau log HIjack stp

reposte un nouveau rapport Hijack stp

donc,

tu télécharge usbfix
http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

tu lances l'installation(par défaut ,il va se trouver dans program files)

puis tu le lances en Double cliquant sur le raccourci UsbFix(la nouvelle icone) qui est sur ton bureau

laisse travailler le programme
Le pc va redémarer...c'est normal

Après redémarrage poste le rapport UsbFix.txt

le rapport UsbFix.txt est sauvegardé ici C:\Usbfix.txt

et il ne va supprimer que les autoruns qui sont néfastes

ouais mais ca c'est pas grave...
fais tourner usbfix sans tes clés et autres

suis bien le tuto,c'est très simple d'utilisation

il va supprimer les autoruns qui se relancent à chaque démarrage

et usbfix?

si g fé cke tu mavé di de coché et de fixé