Redirection Google

slt

l'infection vient de ceci: brastk

____________

tu n'as pas d'antivirus? d'anti espion???? dis moi ...

__________

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

ComboFix 08-08-12.01 - Jonathan 2008-10-22 12:12:20.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.80 [GMT -4:00]
Endroit: C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau\ComboFix.exe

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
- FONCTIONNALITES REDUITES -
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\28463
C:\WINDOWS\system32\28463\AJHI.001
C:\WINDOWS\system32\28463\AJHI.002
C:\WINDOWS\system32\28463\AJHI.006
C:\WINDOWS\system32\28463\AJHI.007
C:\WINDOWS\system32\28463\AJHI.exe
C:\WINDOWS\system32\28463\AKV.exe
C:\WINDOWS\system32\28463\IUCB.001
C:\WINDOWS\system32\28463\IUCB.006
C:\WINDOWS\system32\28463\IUCB.007
C:\WINDOWS\system32\28463\IUCB.exe
C:\WINDOWS\system32\28463\NYFC.001
C:\WINDOWS\system32\28463\NYFC.002
C:\WINDOWS\system32\28463\NYFC.005
C:\WINDOWS\system32\28463\NYFC.006
C:\WINDOWS\system32\28463\NYFC.007
C:\WINDOWS\system32\28463\NYFC.009
C:\WINDOWS\system32\28463\NYFC.009.tmp
C:\WINDOWS\system32\28463\NYFC.exe

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-09-22 to 2008-10-22 ))))))))))))))))))))))))))))))))))))
.

2008-10-21 22:47 . 2008-10-21 22:59 1,030 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-21 22:32 . 2008-10-21 22:32 <REP> d-------- C:\Program Files\Trend Micro
2008-10-21 22:21 . 2008-10-21 22:26 <REP> d-------- C:\fixwareout
2008-10-20 20:01 . 2008-04-13 22:33 1,689,088 ---h---t- C:\WINDOWS\system32\d2cccc7.dll
2008-10-20 20:01 . 2008-04-13 22:33 1,689,088 ---h---t- C:\WINDOWS\system32\4ed0ce2.dll
2008-10-20 20:01 . 2008-04-13 22:33 82,432 ---h---t- C:\WINDOWS\system32\74eff6.dll
2008-10-20 20:01 . 2008-04-13 22:33 82,432 ---h---t- C:\WINDOWS\system32\2dad33a6.dll
2008-10-20 19:51 . 2008-04-13 22:33 1,689,088 ---h---t- C:\WINDOWS\system32\fe4a130.dll
2008-10-20 19:51 . 2008-04-13 22:33 1,689,088 ---h---t- C:\WINDOWS\system32\16c0b0ab.dll
2008-10-20 19:51 . 2008-04-13 22:33 82,432 ---h---t- C:\WINDOWS\system32\55c8843.dll
2008-10-20 19:51 . 2008-04-13 22:33 82,432 ---h---t- C:\WINDOWS\system32\535bc6.dll
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Malwarebytes
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
2008-10-18 12:10 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-18 12:10 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-18 12:03 . 2008-10-18 12:03 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\SmitfraudFix
2008-10-18 10:36 . 2008-10-18 10:36 71,710 --a------ C:\WINDOWS\system32\wini10804.exe
2008-10-17 23:49 . 2008-10-18 10:35 10,240 --a------ C:\WINDOWS\brastk.exe
2008-10-17 23:42 . 2008-10-17 23:42 41,984 --a------ C:\WINDOWS\system32\av.dat
2008-10-17 23:39 . 2008-10-17 23:39 2,048 --a------ C:\WINDOWS\system32\leyybnyr.exe
2008-10-17 23:36 . 2008-10-17 23:36 101,888 --a------ C:\WINDOWS\system32\mvrecpvs.dll
2008-10-17 23:36 . 2008-10-17 23:36 101,888 --a------ C:\WINDOWS\system32\fxnyuw.dll
2008-10-16 23:37 . 2008-10-16 23:36 101,888 --a------ C:\WINDOWS\system32\fuyvah.dll
2008-10-16 23:36 . 2008-10-16 23:36 101,888 --a------ C:\WINDOWS\system32\naxafsnd.dll
2008-10-16 23:31 . 2008-10-16 23:31 2,048 --a------ C:\WINDOWS\system32\wiwvunsk.exe
2008-10-16 17:42 . 2008-10-16 18:15 2,965 --a------ C:\VirtualDJ Local Database v5.xml
2008-10-16 17:29 . 2008-10-16 17:29 156,672 --a------ C:\WINDOWS\system32\fwlhncot.dll
2008-10-16 13:54 . 2008-10-16 13:56 <REP> d-------- C:\KillerJohn's TurboT v8.0
2008-10-16 03:03 . 2008-10-16 03:03 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-10-15 18:58 . 2008-10-15 18:58 <REP> d-------- C:\Program Files\VirtualDJ
2008-10-15 18:42 . 2008-10-15 18:42 <REP> d-------- C:\Program Files\ASIO4ALL v2
2008-10-15 17:17 . 2008-10-15 17:17 <REP> d-------- C:\Program Files\Outsim
2008-10-15 17:12 . 2008-10-15 18:51 <REP> d-------- C:\Program Files\Image-Line
2008-10-15 16:36 . 2008-08-14 09:23 2,191,232 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,068,096 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 16:36 . 2008-09-15 11:26 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 16:36 . 2008-09-08 06:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-15 07:36 . 2008-10-15 07:36 <REP> d-------- C:\Program Files\Magnum
2008-10-13 15:24 . 2008-10-13 15:24 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
2008-10-13 12:17 . 2008-10-13 12:17 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-12 23:41 . 2008-10-12 23:41 <REP> d-------- C:\Nexon
2008-10-12 23:41 . 2008-10-12 23:51 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NexonUS
2008-10-12 17:10 . 2008-10-15 07:36 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-10-03 23:36 . 2008-10-15 20:03 <REP> d-------- C:\Program Files\Metin2_France
2008-09-30 08:07 . 2008-09-30 08:08 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Media Player Classic
2008-09-30 08:06 . 2008-09-30 08:06 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-09-27 17:27 . 2008-09-27 17:29 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Tracing
2008-09-27 17:20 . 2008-09-27 17:20 <REP> d-------- C:\Program Files\Microsoft
2008-09-27 17:15 . 2008-09-27 17:15 <REP> d-------- C:\Program Files\Fichiers communs\Windows Live
2008-09-27 15:42 . 2008-09-27 15:43 <REP> d-------- C:\Documents and Settings\Denise et Jean\Application Data\Winamp
2008-09-23 21:52 . 2008-09-23 22:16 <REP> d-------- C:\Program Files\Cheat Engine
2008-09-23 21:52 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
2008-09-23 21:52 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
2008-09-22 20:15 . 2008-09-27 17:36 <REP> d-------- C:\Program Files\Frets on FireGH
2008-09-22 19:53 . 2008-09-27 17:36 <REP> d-------- C:\Program Files\Frets on Fire

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-21 21:41 30 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\jagex_runescape_preferences.dat
2008-10-15 22:50 --------- d-----w C:\Program Files\VstPlugins
2008-10-13 14:29 --------- d-----w C:\Program Files\Opera
2008-10-13 01:58 --------- d---a-w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2008-09-27 21:36 --------- d-----w C:\Program Files\Windows Live
2008-09-27 21:35 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller
2008-09-21 02:35 --------- d-----w C:\Program Files\StealthBot
2008-09-20 01:44 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\ViStart
2008-09-20 00:45 --------- d-----w C:\Program Files\Shockwave.com
2008-09-20 00:42 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0
2008-09-20 00:42 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft Help
2008-09-20 00:35 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Hamachi
2008-09-20 00:26 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-09-19 23:16 --------- d-----w C:\Program Files\Microsoft SDKs
2008-09-16 21:26 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Audacity
2008-09-16 10:12 35 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
2008-09-14 21:38 34 ----a-w C:\Documents and Settings\Denise et Jean\ScreenSize.bat
2008-09-14 21:35 45,056 ----a-w C:\vidchng.exe
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-05 02:14 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\SmartFTP
2008-09-02 09:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-02 09:40 --------- d-----w C:\Program Files\Rockstar Games
2008-09-01 02:55 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Musicnotes
2008-08-27 00:01 --------- d-----w C:\Program Files\Web Publish
2008-08-24 20:41 --------- d-----w C:\Program Files\RealVNC
2008-08-23 16:34 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-08-23 16:31 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-08-23 16:31 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\DAEMON Tools
2008-08-22 03:11 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\mIRC
2008-08-12 03:52 0 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\links.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 05:39 486856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 22:33 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-11-17 17:29 7700480]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-11-17 17:29 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"nwiz"="nwiz.exe" [2006-11-17 17:29 1622016 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]

C:\DOCUME~1\ALLUSE~1.WIN\MENUDM~1\PROGRA~1\DMARRA~1\
GA511 Smart Wizard Utility.lnk - C:\WINDOWS\Installer\{52CAD7C7-1E41-43FE-8613-AB9D79B2DBBC}\NewShortcut1.exe [2008-08-12 11:12:16 40960]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\webface\\TurboTwebface.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\bluevex\\rvx.exe"=
"D:\\Program Files\\Diablo II\\RedVex3\\RedVex3.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\Windows Live\\Copie de Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Metin2_France\\metin2.bin"=
"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\Nexon\Combat Arms\CombatArms.exe"= C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
"C:\Nexon\Combat Arms\Engine.exe"= C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe
"C:\\Nexon\\Combat Arms\\NMService.exe"=
"C:\\Program Files\\Magnum\\eMule0.49b\\eMule0.49b\\emule.exe"=

R2 LANPkt;Realtek LANPkt Protocol;C:\WINDOWS\system32\DRIVERS\LANPkt.sys [2006-11-28 11:48]
R3 dfmirage;dfmirage;C:\WINDOWS\system32\DRIVERS\dfmirage.sys [2005-11-25 17:43]
S3 Diag69xp;Diag69xp;C:\WINDOWS\system32\Drivers\Diag69xp.sys [2006-11-28 11:48]
S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-07-25 20:57]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-09-10 00:04]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 17:10]
S4 echovnc-service;echovnc-service;C:\Program Files\EchoVNC\winvnc.exe []
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-WinampAgent - D:\Program Files\Winamp\winampa.exe
HKLM-Run-AJHI Agent - C:\WINDOWS\system32\28463\AJHI.exe
HKU-Default-Run-brastk - C:\WINDOWS\system32\brastk.exe

.
------- Supplementary Scan -------
.

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_3_0_3_0.cab
C:\WINDOWS\Downloaded Program Files\hardwaredetection.inf

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-22 12:15:42
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv]
"imagepath"="\systemroot\system32\drivers\TDSSmaxt.sys"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RealVNC\VNC4\winvnc4.exe
C:\Program Files\NETGEAR GA511 Adapter\GA511.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-10-22 12:20:04 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-22 16:19:53

Pre-Run: 24,195,674,112 octets libres
Post-Run: 24,679,202,816 octets libres

206 --- E O F --- 2008-10-16 07:04:26

Merci pour tout ! Plus aucun problème !
Que me conseille tu comme Antivirus, Firewall qui prend pas trop de RAM. ?
J'en ai testé plusieurs et ils ont tous ralentit mon PC ...

installe antivir en antivirus:
https://www.malekal.com/avira-free-security-antivirus-gratuit/

et colle un rapport avec

________________

en parefeu garde pour l'instant actif celui de windows ou mets ZONE ALARM plus efficace mais consommant plus de ressources
_______________

remet un rapport hijakhcits aussi pour verifier

Comme j'avais pensé, il est revenue :(

Voila mon HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:42:00, on 2008-10-22
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\NETGEAR GA511 Adapter\GA511.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Raccourci vers ScreenSize.lnk = C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
O4 - Global Startup: GA511 Smart Wizard Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - https://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

Salut,

Pour avancer jlpjlp,

---> Télécharge SDFix (créé par AndyManchesta) sur ton Bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
- Double-clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
- Redémarre ton ordinateur en mode sans échec.

---> Pour redémarrer en mode sans échec :
- Redémarre ton PC.
- Au démarrage, tapote sur F8 (F5 sur certains PC) juste après l'affichage du BIOS et juste avant le chargement de Windows.
- Dans le menu d'options avancées, choisis Mode sans échec.
- Choisis ton compte.

---> Déroule la liste des instructions ci-dessous :
- Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double-clique sur RunThis.bat pour lancer le script.
- Appuie sur Y pour commencer le processus de nettoyage.
- Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
- Appuie sur une touche pour redémarrer le PC.
- Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
- Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
- Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
- Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
- Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse.

SDFix: Version 1.228
Run by Jonathan on 2008-10-22 at 22:00

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Rootkit Found :
C:\WINDOWS\system32\drivers\TDSSmaxt.sys - Rootkit.Win32.Agent.cku

Name :
tdssserv

Path :
\systemroot\system32\drivers\TDSSmaxt.sys

tdssserv - Deleted

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\drivers\TDSSmaxt.sys - Deleted
C:\WINDOWS\system32\TDSSofxh.dll - Deleted
C:\WINDOWS\system32\TDSSnrsr.dll - Deleted
C:\WINDOWS\system32\TDSSriqp.dll - Deleted
C:\WINDOWS\system32\TDSScfum.dll - Deleted
C:\WINDOWS\system32\TDSSlxwp.dll - Deleted
C:\WINDOWS\system32\TDSSrhym.dll - Deleted
C:\WINDOWS\system32\PfModNT.sys - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-22 22:04:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

disk error: C:\WINDOWS\system32\config\system, 0
scanning hidden registry entries ...

disk error: C:\WINDOWS\system32\config\software, 0
disk error: C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ntuser.dat, 0
scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"="C:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe:*:Enabled:VNC Server Free Edition for Win32"
"C:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"="C:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe:*:Enabled:VNC Viewer Free Edition for Win32"
"D:\\KillerJohn's TurboT v7.5\\modules\\webface\\TurboTwebface.exe"="D:\\KillerJohn's TurboT v7.5\\modules\\webface\\TurboTwebface.exe:*:Enabled:TurboTwebface"
"D:\\KillerJohn's TurboT v7.5\\modules\\bluevex\\rvx.exe"="D:\\KillerJohn's TurboT v7.5\\modules\\bluevex\\rvx.exe:*:Enabled:rvx"
"D:\\Program Files\\Diablo II\\RedVex3\\RedVex3.exe"="D:\\Program Files\\Diablo II\\RedVex3\\RedVex3.exe:*:Enabled:RedVex3"
"C:\\Program Files\\Opera\\opera.exe"="C:\\Program Files\\Opera\\opera.exe:*:Enabled:Opera Internet Browser"
"C:\\Program Files\\Windows Live\\Copie de Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Copie de Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Metin2_France\\metin2.bin"="C:\\Program Files\\Metin2_France\\metin2.bin:*:Enabled:metin2"
"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\NexonUS\\NGM\\NGM.exe"="C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\NexonUS\\NGM\\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\\Nexon\\Combat Arms\\CombatArms.exe"="C:\\Nexon\\Combat Arms\\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\\Nexon\\Combat Arms\\Engine.exe"="C:\\Nexon\\Combat Arms\\Engine.exe:*Enabled:Engine.exe"
"C:\\Nexon\\Combat Arms\\NMService.exe"="C:\\Nexon\\Combat Arms\\NMService.exe:*:Enabled:Nexon Messenger Core"
"C:\\Program Files\\Magnum\\eMule0.49b\\eMule0.49b\\emule.exe"="C:\\Program Files\\Magnum\\eMule0.49b\\eMule0.49b\\emule.exe:*:Enabled:eMule"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Nexon\\Combat Arms\\CombatArms.exe"="C:\\Nexon\\Combat Arms\\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\\Nexon\\Combat Arms\\Engine.exe"="C:\\Nexon\\Combat Arms\\Engine.exe:*Enabled:Engine.exe"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 23 Aug 2008 635,848 A.SH. --- "C:\Program Files\Internet Explorer\iexplore.exe"
Sun 13 Apr 2008 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
Sun 13 Apr 2008 1,689,088 ...H. --- "C:\WINDOWS\system32\16c0b0ab.dll"
Sun 13 Apr 2008 82,432 ...H. --- "C:\WINDOWS\system32\2dad33a6.dll"
Sun 13 Apr 2008 1,689,088 ...H. --- "C:\WINDOWS\system32\4ed0ce2.dll"
Sun 13 Apr 2008 82,432 ...H. --- "C:\WINDOWS\system32\535bc6.dll"
Sun 13 Apr 2008 82,432 ...H. --- "C:\WINDOWS\system32\55c8843.dll"
Sun 13 Apr 2008 82,432 ...H. --- "C:\WINDOWS\system32\74eff6.dll"
Sun 13 Apr 2008 1,689,088 ...H. --- "C:\WINDOWS\system32\d2cccc7.dll"
Sun 13 Apr 2008 1,689,088 ...H. --- "C:\WINDOWS\system32\fe4a130.dll"
Thu 14 Aug 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Thu 9 Nov 2006 20,480 ...H. --- "C:\Nexon\Combat Arms\HShield\1537f1c1.dll"
Thu 9 Nov 2006 20,480 ...H. --- "C:\Nexon\Combat Arms\HShield\16965ce.dll"
Thu 9 Nov 2006 20,480 ...H. --- "C:\Nexon\Combat Arms\HShield\228faa8b.dll"
Thu 9 Nov 2006 20,480 ...H. --- "C:\Nexon\Combat Arms\HShield\a77aea2.dll"
Sun 12 Oct 2008 0 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv01.tmp"

Finished!

Tout va a nouveau très bien aucun redirection pour l'instant.

---> Fais un scan avec Antivir comme jlpjlp le demande (poste le rapport).

slt destrio5
merci d'être passé

Avira AntiVir Personal
Report file date: 22 octobre, 2008 22:10

Scanning for 1704573 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: Jonathan
Computer name: JONATHAN-U2KZFI

Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 14:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 13:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 18:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 13:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 16:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 19:54:15
ANTIVIR2.VDF : 7.0.7.59 4366336 Bytes 19/10/2008 01:48:45
ANTIVIR3.VDF : 7.0.7.75 148480 Bytes 22/10/2008 01:48:46
Engineversion : 8.2.0.5
AEVDF.DLL : 8.1.0.6 102772 Bytes 23/10/2008 01:48:58
AESCRIPT.DLL : 8.1.1.9 319867 Bytes 23/10/2008 01:48:57
AESCN.DLL : 8.1.1.3 123252 Bytes 23/10/2008 01:48:56
AERDL.DLL : 8.1.1.2 438644 Bytes 23/10/2008 01:48:55
AEPACK.DLL : 8.1.2.4 369014 Bytes 23/10/2008 01:48:54
AEOFFICE.DLL : 8.1.0.28 196987 Bytes 23/10/2008 01:48:53
AEHEUR.DLL : 8.1.0.59 1438071 Bytes 23/10/2008 01:48:52
AEHELP.DLL : 8.1.1.2 115062 Bytes 23/10/2008 01:48:50
AEGEN.DLL : 8.1.0.41 319861 Bytes 23/10/2008 01:48:50
AEEMU.DLL : 8.1.0.9 393588 Bytes 23/10/2008 01:48:49
AECORE.DLL : 8.1.2.6 172406 Bytes 23/10/2008 01:48:48
AEBB.DLL : 8.1.0.3 53618 Bytes 23/10/2008 01:48:47
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 14:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 15:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 23/10/2008 01:48:46
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 17:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 14:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 18:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 23:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 18:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 18:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 19:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 19:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 22 octobre, 2008 22:10

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'opera.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'GA511.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'soundman.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'winvnc4.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
26 processes with 26 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '53' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau\r2d2.dll
[DETECTION] Is the TR/Peed.B.7 Trojan
[NOTE] The file was moved to '4963de29.qua'!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau\R2Map.dgl
[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
[NOTE] The file was moved to '494cde35.qua'!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Local Settings\Application Data\Opera\Opera\profile\cache4\temporary_download\C3PO.zip
[0] Archive type: ZIP
--> R2Map.dgl
[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
--> r2d2.dll
[DETECTION] Is the TR/Peed.B.7 Trojan
[NOTE] The file was moved to '494fdeeb.qua'!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Local Settings\Application Data\Opera\Opera\profile\cache4\temporary_download\D2BSInstaller.zip
[0] Archive type: ZIP
--> D2BSInstaller/Scripts/AutoD2BS/AutoD2BS.exe
[DETECTION] Is the TR/Midgare.mxm.2 Trojan
--> D2BSInstaller/Scripts/EMB/D2BS.exe
[DETECTION] Is the TR/Hijacker.Gen Trojan
--> D2BSInstaller/Scripts/YADB/scripts/AutoD2BS.exe
[DETECTION] Is the TR/Midgare.mxm.2 Trojan
[NOTE] The file was moved to '4941def8.qua'!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Local Settings\Application Data\Opera\Opera\profile\cache4\temporary_download\SmitfraudFix.exe
[DETECTION] Contains recognition pattern of the DR/Tool.Reboot.F.173 dropper
[WARNING] The file was ignored!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Local Settings\Application Data\Opera\Opera\profile\cache4\temporary_download\VersionHack.zip
[0] Archive type: ZIP
--> d2loader.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '4971df70.qua'!
C:\Program Files\Rockstar Games\GTA San Andreas\gta_sa_dll.exe
[DETECTION] Is the TR/Armin.I Trojan
[WARNING] The file was ignored!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\AJHI.007.vir
[DETECTION] Is the TR/Keylog.Ardamax.NAF Trojan
[NOTE] The file was moved to '4947e2ce.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\AJHI.exe.vir
[DETECTION] Is the TR/Spy.Ardamax.J Trojan
[NOTE] The file was moved to '4947e2d2.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\AKV.exe.vir
[DETECTION] Is the TR/Spy.Ardamax.A.1 Trojan
[NOTE] The file was moved to '4955e2d5.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\IUCB.006.vir
[DETECTION] Is the TR/Keylog.Ardamax.NAJ.1 Trojan
[NOTE] The file was moved to '4942e2e1.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\IUCB.007.vir
[DETECTION] Is the TR/Keylog.Ardamax.NAJ.2 Trojan
[NOTE] The file was moved to '4942e2e3.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\IUCB.exe.vir
[DETECTION] Is the TR/Spy.Ardamax.J Trojan
[NOTE] The file was moved to '4942e2e5.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\NYFC.007.vir
[DETECTION] Is the TR/Keylog.Ardamax.NAF Trojan
[NOTE] The file was moved to '4945e2ea.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\NYFC.exe.vir
[DETECTION] Is the TR/Spy.Ardamax.J Trojan
[NOTE] The file was moved to '4945e2ec.qua'!
C:\SDFix\backups\catchme.zip
[0] Archive type: ZIP
--> TDSSmaxt.sys
[DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.ats back-door program
--> TDSSmaxt.sys.1
[DETECTION] Is the TR/Trash.Gen Trojan
--> TDSSofxh.dll
[DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.acx back-door program
--> TDSSnrsr.dll
[DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.adb back-door program
--> TDSSriqp.dll
[DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.acs back-door program
--> TDSScfum.dll
[DETECTION] Is the TR/FakeAV.1.Gen.67 Trojan
[WARNING] The file was ignored!
C:\WINDOWS\system32\fwlhncot.dll
[DETECTION] Is the TR/Crypt.Morphine.Gen Trojan
[NOTE] The file was moved to '496befee.qua'!
C:\WINDOWS\system32\leyybnyr.exe
[DETECTION] Is the TR/QLowZones.S Trojan
[NOTE] The file was moved to '4978efe9.qua'!
C:\WINDOWS\system32\wini10804.exe
[DETECTION] Is the TR/Fakealert.QE Trojan
[NOTE] The file was moved to '496df01e.qua'!
C:\WINDOWS\system32\wiwvunsk.exe
[DETECTION] Is the TR/QLowZones.S Trojan
[NOTE] The file was moved to '4976f01f.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\'
D:\Documents and Settings\Jonathan\Mes documents\Diablo 2\D2BS\Scripts\AutoD2BS\AutoD2BS.exe
[DETECTION] Is the TR/Midgare.mxm.2 Trojan
[NOTE] The file was moved to '4973f2c8.qua'!
D:\Documents and Settings\Jonathan\Mes documents\Diablo 2\D2BS\Scripts\EMB\D2BS.exe
[DETECTION] Is the TR/Hijacker.Gen Trojan
[NOTE] The file was moved to '4941f285.qua'!
D:\Documents and Settings\Jonathan\Mes documents\Diablo 2\D2BS\Scripts\YADB\scripts\AutoD2BS.exe
[DETECTION] Is the TR/Midgare.mxm.2 Trojan
[NOTE] The file was moved to '4973f2cb.qua'!
D:\Documents and Settings\Jonathan\Mes documents\Diablo 2\Edge of Nowhere\D2BSInstaller.zip
[0] Archive type: ZIP
--> D2BSInstaller/Scripts/AutoD2BS/AutoD2BS.exe
[DETECTION] Is the TR/Midgare.mxm.2 Trojan
--> D2BSInstaller/Scripts/EMB/D2BS.exe
[DETECTION] Is the TR/Hijacker.Gen Trojan
--> D2BSInstaller/Scripts/YADB/scripts/AutoD2BS.exe
[DETECTION] Is the TR/Midgare.mxm.2 Trojan
[NOTE] The file was moved to '4941f28a.qua'!
D:\Documents and Settings\Jonathan\Mes documents\Fruity Loops Studio 8.0 Full Producers Edition\fruityloops.studio.producer.edition.xxl.v8.0.0.EXE
[0] Archive type: RSRC
--> Object
[1] Archive type: CAB (Microsoft)
--> FRUITY~1.EXE
[DETECTION] Is the TR/Agent.74081.A Trojan
[NOTE] The file was moved to '4974f2d0.qua'!

End of the scan: 22 octobre, 2008 23:49
Used time: 1:38:35 Hour(s)

The scan has been done completely.

7218 Scanning directories
346822 Files were scanned
35 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
22 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
346785 Files not concerned
3108 Archives were scanned
5 Warnings
22 Notes

ok vire ce qui est en quarantaine dans antivir

_________

vire ce qui est dans le dossier quarantine et backups en allant dans poste de travail puis:

C:\QooBox\Quarantine

C:\SDFix\backups

____________

recolle un rapport antivir et dis tes soucis actuels

Pour l'instant aucun soucis a l'horizon. Le posterai le rapport dès que j'ai le temps necessaire. ( C'est quand même assez long )

Meme rapport que l'autre. Le virus revient lorsque je redémarre mon PC.
- Redirection Goole
- PC Ralenti
- Gèle souvent ( Besoin d'un redémarrage )

remet un rapport combofix et hijackhtis

ComboFix 08-08-13.01 - Jonathan 2008-10-24 13:23:02.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.65 [GMT -4:00]
Endroit: C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau\ComboFix-Must Have-Windows spyware-Antivires-Smitfraud-Virtuemoddll-Vundo- Remover-www.PcHurricane.com-\ComboFix-www.PcHurricane.com-.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
- FONCTIONNALITES REDUITES -
.

((((((((((((((((((((((((((((( Fichiers créés 2008-09-24 to 2008-10-24 ))))))))))))))))))))))))))))))))))))
.

2008-10-24 11:41 . 2008-10-24 11:41 <REP> d-------- C:\Program Files\ElcomSoft
2008-10-24 11:41 . 2008-10-24 11:42 1,158 --a------ C:\WINDOWS\AZPR3.INI
2008-10-24 11:19 . 2008-10-15 12:35 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-24 10:56 . 2008-10-24 10:56 0 --a------ C:\WINDOWS\nsreg.dat
2008-10-24 10:51 . 2008-10-24 11:15 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-10-23 23:37 . 2008-10-23 23:37 <REP> d-------- C:\Program Files\Avira
2008-10-23 18:22 . 2008-10-23 18:22 <REP> d-------- C:\Program Files\Zone Labs
2008-10-23 18:21 . 2008-10-24 10:45 <REP> d-------- C:\WINDOWS\Internet Logs
2008-10-22 22:10 . 2008-10-22 22:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AntiVir PersonalEdition Classic
2008-10-22 21:59 . 2008-10-22 21:59 579,584 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-10-22 21:58 . 2008-10-22 21:58 <REP> d-------- C:\WINDOWS\ERUNT
2008-10-22 21:54 . 2008-10-24 11:18 <REP> d-------- C:\SDFix
2008-10-22 21:46 . 2008-10-22 21:46 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Avira
2008-10-21 22:47 . 2008-10-23 18:36 800 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-21 22:32 . 2008-10-21 22:32 <REP> d-------- C:\Program Files\Trend Micro
2008-10-21 22:21 . 2008-10-23 23:34 <REP> d-------- C:\fixwareout
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Malwarebytes
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Malwarebytes
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
2008-10-18 12:10 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-18 12:10 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-18 12:03 . 2008-10-18 12:03 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\SmitfraudFix
2008-10-17 23:42 . 2008-10-17 23:42 41,984 --a------ C:\WINDOWS\system32\av.dat
2008-10-16 13:54 . 2008-10-16 13:56 <REP> d-------- C:\KillerJohn's TurboT v8.0
2008-10-16 03:03 . 2008-10-16 03:03 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-10-15 17:12 . 2008-10-23 17:56 <REP> d-------- C:\Program Files\Image-Line
2008-10-15 16:36 . 2008-08-14 09:23 2,191,232 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,068,096 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 16:36 . 2008-09-15 11:26 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 16:36 . 2008-09-08 06:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-15 07:36 . 2008-10-24 11:54 <REP> d-------- C:\Program Files\Magnum
2008-10-13 15:24 . 2008-10-13 15:24 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
2008-10-13 12:17 . 2008-10-13 12:17 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-12 23:41 . 2008-10-12 23:51 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NexonUS
2008-10-12 17:10 . 2008-10-15 07:36 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-09-30 08:07 . 2008-09-30 08:08 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Media Player Classic
2008-09-30 08:07 . 2008-09-30 08:08 <REP> d-------- C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Media Player Classic
2008-09-27 17:27 . 2008-09-27 17:29 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Tracing
2008-09-27 17:15 . 2008-09-27 17:15 <REP> d-------- C:\Program Files\Fichiers communs\Windows Live
2008-09-27 15:42 . 2008-09-27 15:43 <REP> d-------- C:\Documents and Settings\Denise et Jean\Application Data\Winamp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-23 22:32 33,280 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-10-23 22:30 34,304 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-10-23 21:57 --------- d-----w C:\Program Files\StealthBot
2008-10-21 21:41 30 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\jagex_runescape_preferences.dat
2008-10-13 14:29 --------- d-----w C:\Program Files\Opera
2008-10-13 01:58 --------- d---a-w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2008-10-10 12:58 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-10-10 12:58 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-10-01 19:51 87,552 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-09-27 21:36 --------- d-----w C:\Program Files\Windows Live
2008-09-27 21:35 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller
2008-09-25 05:00 856,064 ----a-w C:\WINDOWS\system32\JS32.dll
2008-09-20 01:44 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\ViStart
2008-09-20 01:44 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\ViStart
2008-09-20 00:55 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-20 00:42 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0
2008-09-20 00:42 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft Help
2008-09-20 00:35 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Hamachi
2008-09-20 00:35 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Hamachi
2008-09-20 00:26 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-09-19 23:16 --------- d-----w C:\Program Files\Microsoft SDKs
2008-09-16 21:26 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Audacity
2008-09-16 21:26 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Audacity
2008-09-16 10:12 35 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
2008-09-15 15:26 1,846,528 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-14 21:38 34 ----a-w C:\Documents and Settings\Denise et Jean\ScreenSize.bat
2008-09-14 21:35 45,056 ----a-w C:\vidchng.exe
2008-09-09 03:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-05 02:14 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\SmartFTP
2008-09-05 02:14 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\SmartFTP
2008-09-03 17:26 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-09-02 09:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-02 09:40 --------- d-----w C:\Program Files\Rockstar Games
2008-09-01 02:55 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Musicnotes
2008-08-27 00:01 --------- d-----w C:\Program Files\Web Publish
2008-08-26 08:11 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-24 20:41 --------- d-----w C:\Program Files\RealVNC
2008-08-18 16:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-08-14 13:23 2,191,232 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:23 2,068,096 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-12 03:52 0 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\links.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 22:33 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-11-17 17:29 7700480]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-11-17 17:29 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"nwiz"="nwiz.exe" [2006-11-17 17:29 1622016 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]

C:\Documents and Settings\Denise et Jean\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Denise et Jean\ScreenSize.bat [2008-09-14 17:38:37 34]

C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat [2008-09-14 17:38:58 35]

C:\DOCUME~1\ALLUSE~1.WIN\MENUDM~1\PROGRA~1\DMARRA~1\
GA511 Smart Wizard Utility.lnk - C:\WINDOWS\Installer\{52CAD7C7-1E41-43FE-8613-AB9D79B2DBBC}\NewShortcut1.exe [2008-08-12 11:12:16 40960]

C:\DOCUME~1\JONATH~1.JON\MENUDM~1\PROGRA~1\DMARRA~1\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat [2008-09-14 17:38:58 35]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\webface\\TurboTwebface.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\bluevex\\rvx.exe"=
"D:\\Program Files\\Diablo II\\RedVex3\\RedVex3.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\Windows Live\\Copie de Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\\Program Files\\Magnum\\eMule0.49b\\eMule0.49b\\emule.exe"=

R3 dfmirage;dfmirage;C:\WINDOWS\system32\DRIVERS\dfmirage.sys [2005-11-25 17:43]
S3 Diag69xp;Diag69xp;C:\WINDOWS\system32\Drivers\Diag69xp.sys [2006-11-28 11:48]
S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-07-25 20:57]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 17:10]
S4 echovnc-service;echovnc-service;C:\Program Files\EchoVNC\winvnc.exe []
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DAEMON Tools Lite - C:\Program Files\DAEMON Tools Lite\daemon.exe

.
------- Supplementary Scan -------
.

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_3_0_3_0.cab
C:\WINDOWS\Downloaded Program Files\hardwaredetection.inf

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-24 13:23:44
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys)]
"imagepath"="\systemroot\system32\drivers\TDSSpqxt.sys"
.
Temps d'accomplissement: 2008-10-24 13:25:16
ComboFix-quarantined-files.txt 2008-10-24 17:25:08

Pre-Run: 29,311,426,560 octets libres
Post-Run: 29,313,351,680 octets libres

171 --- E O F --- 2008-10-24 15:22:25

________________________________________________________________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:59:29, on 2008-10-24
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\NETGEAR GA511 Adapter\GA511.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Raccourci vers ScreenSize.lnk = C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
O4 - Global Startup: GA511 Smart Wizard Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - https://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

File::
C:\WINDOWS\system32\drivers\TDSSmaxt.sys
C:\WINDOWS\system32\TDSSofxh.dll
C:\WINDOWS\system32\TDSSnrsr.dll
C:\WINDOWS\system32\TDSSriqp.dll
C:\WINDOWS\system32\TDSScfum.dll
C:\WINDOWS\system32\TDSSlxwp.dll
C:\WINDOWS\system32\TDSSrhym.dll
C:\WINDOWS\system32\PfModNT.sys
C:\WINDOWS\system32\drivers\tdssserv.sys
C:\WINDOWS\system32\tdssadw.dll
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\tdssl.dll
C:\WINDOWS\system32\tdsslog.dll
C:\WINDOWS\system32\tdssmain.dll
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\Temp\tdss13b9.tmp
C:\WINDOWS\Temp\tdss1530.tmp
C:\WINDOWS\Temp\tdss16b6.tmp

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys)]
"imagepath"=-

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

.
_______________

scan avec ceci: ensuite
https://downloads.exterminate-it.com/install/ExterminateItSetup.exe

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:04:21, on 2008-10-24
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\NETGEAR GA511 Adapter\GA511.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Raccourci vers ScreenSize.lnk = C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
O4 - Global Startup: GA511 Smart Wizard Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - https://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

drivers::
TDSSserv
TDSSmaxt

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys)]
"imagepath"="\systemroot\system32\drivers\TDSSpqxt.sys"

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

________________

installe malwarebyte et colle nous un rapport:

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

ComboFix 08-08-13.01 - Jonathan 2008-10-25 9:24:06.4 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.68 [GMT -4:00]
Endroit: C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau\ComboFix-Must Have-Windows spyware-Antivires-Smitfraud-Virtuemoddll-Vundo- Remover-www.PcHurricane.com-\CF148185.exe
Command switches used :: C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau\CFScript.txt

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
- FONCTIONNALITES REDUITES -
.

((((((((((((((((((((((((((((( Fichiers créés 2008-09-25 to 2008-10-25 ))))))))))))))))))))))))))))))))))))
.

2008-10-24 22:58 . 2008-10-24 22:58 <REP> d-------- C:\CF14818
2008-10-24 13:20 . 2008-10-24 13:25 <REP> d-------- C:\ComboFix-www.PcHurricane.com-
2008-10-24 11:41 . 2008-10-24 11:41 <REP> d-------- C:\Program Files\ElcomSoft
2008-10-24 11:41 . 2008-10-24 11:42 1,158 --a------ C:\WINDOWS\AZPR3.INI
2008-10-24 11:19 . 2008-10-15 12:35 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-24 10:56 . 2008-10-24 10:56 0 --a------ C:\WINDOWS\nsreg.dat
2008-10-24 10:51 . 2008-10-24 11:15 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-10-23 23:37 . 2008-10-23 23:37 <REP> d-------- C:\Program Files\Avira
2008-10-23 18:22 . 2008-10-23 18:22 <REP> d-------- C:\Program Files\Zone Labs
2008-10-23 18:21 . 2008-10-24 10:45 <REP> d-------- C:\WINDOWS\Internet Logs
2008-10-22 22:10 . 2008-10-22 22:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AntiVir PersonalEdition Classic
2008-10-22 21:59 . 2008-10-22 21:59 579,584 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-10-22 21:58 . 2008-10-22 21:58 <REP> d-------- C:\WINDOWS\ERUNT
2008-10-22 21:54 . 2008-10-24 11:18 <REP> d-------- C:\SDFix
2008-10-22 21:46 . 2008-10-22 21:46 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Avira
2008-10-21 22:47 . 2008-10-23 18:36 800 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-21 22:32 . 2008-10-21 22:32 <REP> d-------- C:\Program Files\Trend Micro
2008-10-21 22:21 . 2008-10-23 23:34 <REP> d-------- C:\fixwareout
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Malwarebytes
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
2008-10-18 12:10 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-18 12:10 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-18 12:03 . 2008-10-18 12:03 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\SmitfraudFix
2008-10-17 23:42 . 2008-10-17 23:42 41,984 --a------ C:\WINDOWS\system32\av.dat
2008-10-16 13:54 . 2008-10-16 13:56 <REP> d-------- C:\KillerJohn's TurboT v8.0
2008-10-16 03:03 . 2008-10-16 03:03 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-10-15 17:12 . 2008-10-23 17:56 <REP> d-------- C:\Program Files\Image-Line
2008-10-15 16:36 . 2008-08-14 09:23 2,191,232 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,068,096 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 16:36 . 2008-09-15 11:26 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 16:36 . 2008-09-08 06:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-15 07:36 . 2008-10-24 11:54 <REP> d-------- C:\Program Files\Magnum
2008-10-13 15:24 . 2008-10-13 15:24 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
2008-10-13 12:17 . 2008-10-13 12:17 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-12 23:41 . 2008-10-12 23:51 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NexonUS
2008-10-12 17:10 . 2008-10-15 07:36 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-09-30 08:07 . 2008-09-30 08:08 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Media Player Classic
2008-09-27 17:27 . 2008-09-27 17:29 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Tracing
2008-09-27 17:15 . 2008-09-27 17:15 <REP> d-------- C:\Program Files\Fichiers communs\Windows Live
2008-09-27 15:42 . 2008-09-27 15:43 <REP> d-------- C:\Documents and Settings\Denise et Jean\Application Data\Winamp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-25 03:08 --------- d-----w C:\Program Files\ma-config.com
2008-10-25 03:08 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ma-config.com
2008-10-23 22:32 33,280 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-10-23 22:30 34,304 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-10-23 21:57 --------- d-----w C:\Program Files\StealthBot
2008-10-21 21:41 30 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\jagex_runescape_preferences.dat
2008-10-13 14:29 --------- d-----w C:\Program Files\Opera
2008-10-13 01:58 --------- d---a-w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2008-10-10 12:58 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-10-10 12:58 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-10-01 19:51 87,552 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-09-27 21:36 --------- d-----w C:\Program Files\Windows Live
2008-09-27 21:35 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller
2008-09-25 05:00 856,064 ----a-w C:\WINDOWS\system32\JS32.dll
2008-09-20 01:44 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\ViStart
2008-09-20 00:55 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-20 00:42 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0
2008-09-20 00:42 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft Help
2008-09-20 00:35 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Hamachi
2008-09-20 00:26 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-09-19 23:16 --------- d-----w C:\Program Files\Microsoft SDKs
2008-09-16 21:26 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Audacity
2008-09-16 10:12 35 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
2008-09-15 15:26 1,846,528 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-14 21:38 34 ----a-w C:\Documents and Settings\Denise et Jean\ScreenSize.bat
2008-09-14 21:35 45,056 ----a-w C:\vidchng.exe
2008-09-09 03:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-05 02:14 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\SmartFTP
2008-09-03 17:26 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-09-02 09:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-02 09:40 --------- d-----w C:\Program Files\Rockstar Games
2008-09-01 02:55 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Musicnotes
2008-08-27 00:01 --------- d-----w C:\Program Files\Web Publish
2008-08-26 08:11 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-18 16:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-08-14 13:23 2,191,232 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:23 2,068,096 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-12 03:52 0 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\links.dat
.

((((((((((((((((((((((((((((( snapshot@2008-10-24_13.24.35.17 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-24 17:22:12 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-10-25 13:17:49 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-10-24 17:22:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2008-10-25 13:17:49 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2008-10-24 17:12:11 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008102420081025\index.dat
+ 2008-10-25 03:47:32 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008102420081025\index.dat
+ 2008-10-25 08:47:41 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008102520081026\index.dat
- 2008-10-24 17:22:12 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-10-25 13:17:49 49,152 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 22:33 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-11-17 17:29 7700480]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-11-17 17:29 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"nwiz"="nwiz.exe" [2006-11-17 17:29 1622016 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]

C:\Documents and Settings\Denise et Jean\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Denise et Jean\ScreenSize.bat [2008-09-14 17:38:37 34]

C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat [2008-09-14 17:38:58 35]

C:\DOCUME~1\ALLUSE~1.WIN\MENUDM~1\PROGRA~1\DMARRA~1\
GA511 Smart Wizard Utility.lnk - C:\WINDOWS\Installer\{52CAD7C7-1E41-43FE-8613-AB9D79B2DBBC}\NewShortcut1.exe [2008-08-12 11:12:16 40960]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\webface\\TurboTwebface.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\bluevex\\rvx.exe"=
"D:\\Program Files\\Diablo II\\RedVex3\\RedVex3.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\Windows Live\\Copie de Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\\Program Files\\Magnum\\eMule0.49b\\eMule0.49b\\emule.exe"=

R3 dfmirage;dfmirage;C:\WINDOWS\system32\DRIVERS\dfmirage.sys [2005-11-25 17:43]
S3 Diag69xp;Diag69xp;C:\WINDOWS\system32\Drivers\Diag69xp.sys [2006-11-28 11:48]
S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-09-02 16:14]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 17:10]
S4 echovnc-service;echovnc-service;C:\Program Files\EchoVNC\winvnc.exe []
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-25 09:24:50
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\catchme]
"ImagePath"="\??\C:\DOCUME~1\JONATH~1.JON\LOCALS~1\Temp\catchme.sys"

slt

et merci lyonnais92 ...

le gros souci en fait c'est que tu n'as pas fais ce qui a été demandé ! tu as gardé un combofix que tu avais qui n'est pas a jour depuis aout 2008!!!!!

vire le et télécharge la derniere version en suivant le lien déjà donné et colle le rapport

Je ne peux pas télécharger combofix au lien que tu m'as envoyé. La page s'ouvre blanche et rien le charge.
Lorsque je ping bleepingcomputer.com, ça ma donne l'ip : 127.0.0.1 ce qui est localhost... Surement rapport avec le virus. Il me faudrai quelqu'un pour l'uploader sur rapidshare par exemple.