ça prend du temps son analyse car ya pas mal de temps que rien n'as eté fait donc !!!!

rapport navilog:

Search Navipromo version 3.5.3 commencé le 13/04/2008 à 21:22:25,36

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Administrateur"

Mise à jour le 09.04.2008 à 20h00 par IL-MAFIOSO

Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180
Système de fichiers : NTFS

Executé en mode normal

*** Recherche Programmes installés ***

*** Recherche dossiers dans C:\WINDOWS.0 ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1.0\APPLIC~1 ***

*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\menudm~1\progra~1" ***

*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1.0\MENUDM~1\PROGRA~1 ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

!! Fichier(s)/processus caché(s) différent(s) !!
!! Résultat Catchme non pris en compte par Navilog1 !!

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS.0\system32 *

* Recherche dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\freddy\locals~1\applic~1" *

*** Recherche fichiers ***

*** Recherche clés spécifiques dans le Registre ***

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

2)Recherche Heuristique :

* Dans C:\WINDOWS.0\system32 :

* Dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" :

* Dans "C:\DOCUME~1\freddy\locals~1\applic~1" :

3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

*** Analyse terminée le 13/04/2008 à 21:36:46,97 ***

rapport hijakthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:42:24, on 13/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\system32\igfxtray.exe
C:\WINDOWS.0\system32\hkcmd.exe
C:\WINDOWS.0\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS.0\mrofinu1423.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\nvcoi\nvcoi.exe
C:\Program Files\JavaCore\JavaCore.exe
C:\Documents and Settings\Administrateur\Application Data\WinTouch\WinTouch.exe
C:\Documents and Settings\Administrateur\Application Data\Microsoft\Windows\uabpq.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS.0\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS.0\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS.0\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS.0\system32\userinit.exe,C:\WINDOWS.0\system32\%%%.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\CPV\CPV8.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS.0\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS.0\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Flash Media] C:\WINDOWS.0\system32\%%%.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS.0\mrofinu1423.exe 61A847B5BBF7281336993B466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\steam\steam.exe" -silent
O4 - HKCU\..\Run: [nvcoi] C:\Program Files\nvcoi\nvcoi.exe
O4 - HKCU\..\Run: [JavaCore] C:\Program Files\\JavaCore\\JavaCore.exe
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Administrateur\Application Data\WinTouch\WinTouch.exe
O4 - HKCU\..\Run: [SfKg6w] C:\Documents and Settings\Administrateur\Application Data\Microsoft\Windows\uabpq.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlhr] RunDll32.exe %SystemRoot%\System32\AdvPack.Dll,LaunchINFSection %SystemRoot%\inf\nlite.inf,C (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 6461 bytes

Re

• Télécharge SDFix (AndyManchesta)
  Double clique sur SDFix.exe et choisis Install pour l'extraire dans son dossier sur le bureau.

• Télécharge MSNFix (aur3n7) sur le bureau.
  Décompresse-le (clic droit >> Extraire ici).

Redémarre en mode sans échec (tuto chapitre C)

• * Double-clique sur le fichier MSNFix.bat.
  * Exécute l'option R.
  * Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage.

• * Ouvre le dossier SDFix qui vient d'être créé sur le bureau et double clique sur RunThis.bat pour lancer le script.
  * Appuie sur Y pour commencer le nettoyage.
  * Quand il te le demandera, appuie sur une touche pour redémarrer le PC.
  * Ton système sera plus long à redémarrer car l'outil va continuer à s'exécuter et supprimer des fichiers.
  * Après le chargement du bureau, l'outil aura terminé et affichera Finished.
  * Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton bureau.
  * Le rapport SDFix s'ouvrira et il sera enregistré dans le dossier SDFix sous le nom Report.txt.
  * Enfin, Copie/Colle le rapport du fichier Report.txt.
  * Le rapport MSNFix sera enregistré dans le même dossier que MSNFix sous forme date_heure.t, poste-le aussi.

+ nouveau rapport HijackThis.

Bonjour

Ca marche pour les rapports

le rapport de MSNfix:

MSNFix 1.704

C:\Documents and Settings\Administrateur\Bureau\MSNFix
Fix exécuté le 14/04/2008 - 20:50:20,80 By Administrateur
mode sans échec

************************ Recherche les fichiers présents

... C:\WINDOWS.0\system32\%%%.exe
... C:\WINDOWS.0\system32\%%%.exe
... C:\WINDOWS.0\system32\%%%.exe
... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\wintouch.cfg
... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\WinTouch.exe
... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\WTUninstaller.exe
... C:\Program Files\nvcoi\mst.stt
... C:\Program Files\nvcoi\nvcoi.exe
... C:\Program Files\Temporary\InsiDERInst.exe
... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\wintouch.cfg
... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\WinTouch.exe
... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\WTUninstaller.exe
... C:\Program Files\Fichiers communs\Yazzle1560OinUninstaller.exe
... C:\Program Files\JavaCore\JavaCore.exe
... C:\Program Files\JavaCore\UnInstall.exe
... C:\Program Files\Temporary\InsiDERInst.exe
... C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Setup.exe
... C:\Documents and Settings\Administrateur\??????.exe
... C:\Documents and Settings\Administrateur\????????.exe
... C:\WINDOWS.0\b???.exe
... C:\WINDOWS.0\mrofinu*.exe
... C:\WINDOWS.0\mrofinu*.exe.tmp
... C:\WINDOWS.0\system32\real.txt
... C:\Program Files\nvcoi\mst.stt
... C:\Program Files\nvcoi\nvcoi.exe

************************ Recherche les dossiers présents

... C:\Program Files\InetGet2\
... C:\Program Files\Temporary\
... C:\Program Files\nvcoi\
... C:\Program Files\nvcoi\
... C:\Program Files\CPV\
... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\




************************ Suppression des fichiers

.. OK ... C:\WINDOWS.0\system32\%.exe
/!\ ... C:\WINDOWS.0\system32\%%%.exe
/!\ ... C:\WINDOWS.0\system32\%%%.exe
/!\ ... C:\WINDOWS.0\system32\%%%.exe
/!\ ... C:\WINDOWS.0\system32\%%%.exe
/!\ ... C:\WINDOWS.0\system32\%%%.exe
/!\ ... C:\WINDOWS.0\system32\%%%.exe
/!\ ... C:\WINDOWS.0\system32\%%%.exe
.. OK ... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\wintouch.cfg
/!\ ... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\WinTouch.exe
.. OK ... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\WTUninstaller.exe
.. OK ... C:\Program Files\nvcoi\mst.stt
.. OK ... C:\Program Files\nvcoi\nvcoi.exe
.. OK ... C:\Program Files\Temporary\InsiDERInst.exe
.. OK ... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\wintouch.cfg
/!\ ... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\WinTouch.exe
.. OK ... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\WTUninstaller.exe
.. OK ... C:\Program Files\Fichiers communs\Yazzle1560OinUninstaller.exe
.. OK ... C:\Program Files\JavaCore\JavaCore.exe
.. OK ... C:\Program Files\JavaCore\UnInstall.exe
.. OK ... C:\Program Files\Temporary\InsiDERInst.exe
.. OK ... C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Setup.exe
/!\ ... C:\Documents and Settings\Administrateur\??????.exe
/!\ ... C:\Documents and Settings\Administrateur\????????.exe
/!\ ... C:\WINDOWS.0\b???.exe
.. OK ... C:\WINDOWS.0\mrofinu*.exe
.. OK ... C:\WINDOWS.0\mrofinu*.exe.tmp
.. OK ... C:\WINDOWS.0\system32\real.txt
.. OK ... C:\Program Files\nvcoi\mst.stt
.. OK ... C:\Program Files\nvcoi\nvcoi.exe


************************ Suppression des dossiers

.. OK ... C:\Program Files\InetGet2\
/!\ ... C:\Program Files\Temporary\
/!\ ... C:\Program Files\nvcoi\
/!\ ... C:\Program Files\nvcoi\
/!\ ... C:\Program Files\CPV\
/!\ ... C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\


************************ Nettoyage du registre



Les fichiers encore présents seront supprimés au prochain redémarrage


Aucun Fichier trouvé
.. OK ... C:\WINDOWS.0\system32\%.exe



************************ Fichiers suspects

Aucun Fichier trouvé


Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 14042008_21142713.zip

************************ HKLM\...\Winlogon\Userinit

Userinit = C:\WINDOWS.0\system32\userinit.exe,

------------------------------------------------------------------------
Auteur : !aur3n7 Contact: http://changelog.fr
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

le rapport de sdfix:

SDFix: Version 1.171
Run by Administrateur on 14/04/2008 at 21:06

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\ADMINI~1\Bureau\SDFix

Checking Services :

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS.EXE - Deleted
C:\WINDOWS.EXE - Deleted
C:\DOCUME~1\ADMINI~1\APPLIC~1\MICROS~1\WINDOWS\UABPQ.EXE - Deleted
C:\DOCUME~1\ADMINI~1\EIPDIU.EXE - Deleted
C:\DOCUME~1\ADMINI~1\JIMNUG.EXE - Deleted
C:\DOCUME~1\ADMINI~1\LRAHCL.EXE - Deleted
C:\DOCUME~1\ADMINI~1\MNBTCW.EXE - Deleted
C:\DOCUME~1\ADMINI~1\OYIAZP.EXE - Deleted
C:\DOCUME~1\ADMINI~1\RDMKIY.EXE - Deleted
C:\DOCUME~1\ADMINI~1\RRHTIH.EXE - Deleted
C:\DOCUME~1\ADMINI~1\SEJOWV.EXE - Deleted
C:\DOCUME~1\ADMINI~1\SGJXLS.EXE - Deleted
C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\WinTouch.exe - Deleted
C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\wintouch.MSNFix - Deleted
C:\DOCUME~1\ADMINI~1\APPLIC~1\WinTouch\WTUninstaller.MSNFix - Deleted
C:\Program Files\CPV\CPV8.dll - Deleted
C:\Program Files\JavaCore\JavaCore.MSNFix - Deleted
C:\Program Files\JavaCore\UnInstall.MSNFix - Deleted
C:\Program Files\nvcoi\mst.MSNFix - Deleted
C:\Program Files\nvcoi\nvcoi.MSNFix - Deleted
C:\Program Files\Temporary\InsiDERInst.MSNFix - Deleted
C:\Program Files\Fichiers communs\Yazzle1560OinAdmin.exe - Deleted
C:\Program Files\Fichiers communs\Yazzle1560OinUninstaller.MSNFix - Deleted
C:\WINDOWS.0\17PHolmes1423.exe - Deleted
C:\WINDOWS.0\b138.exe - Deleted
C:\WINDOWS.0\b152.exe - Deleted
C:\WINDOWS.0\b153.exe - Deleted
C:\WINDOWS.0\b155.exe - Deleted
C:\Documents and Settings\Administrateur\real.txt - Deleted

Folder C:\Documents and Settings\Administrateur\Application Data\WinTouch - Removed
Folder C:\Program Files\CPV - Removed
Folder C:\Program Files\JavaCore - Removed
Folder C:\Program Files\nvcoi - Removed
Folder C:\Program Files\Temporary - Removed

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-14 21:15:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:f1,a7,40,0c,4c,ce,df,d4,b8,e0,c3,bc,a9,0a,b2,b8,bb,04,ae,58,80,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:35,d9,82,77,b7,b6,14,0f,f5,c5,df,13,4f,25,d0,e4,61,1f,e3,a0,b7,..
"d0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:b7,b4,a3,32,55,e1,d7,ba,da,c8,51,19,42,1d,59,b0,a3,56,cf,c9,24,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:f1,a7,40,0c,4c,ce,df,d4,b8,e0,c3,bc,a9,0a,b2,b8,bb,04,ae,58,80,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:35,d9,82,77,b7,b6,14,0f,f5,c5,df,13,4f,25,d0,e4,61,1f,e3,a0,b7,..
"d0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:b7,b4,a3,32,55,e1,d7,ba,da,c8,51,19,42,1d,59,b0,a3,56,cf,c9,24,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Steam\\SteamApps\\fredo0013\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\fredo0013\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :

File Backups: - C:\DOCUME~1\ADMINI~1\Bureau\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 11 Apr 2008 230,400 ..SHR --- "C:\WINDOWS.0\??stem\w?nword.exe"
Wed 21 Nov 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS.0\DRM\DRMv1.bak"
Sat 9 Jun 2007 70,656 ..SHR --- "C:\Program Files\Makayama Interactive\Easy WiFi Radar\Setup.exe"
Mon 14 Apr 2008 68,608 ..SHR --- "C:\Documents and Settings\Administrateur\Application Data\T?sks\javaw.exe"
Sun 25 Nov 2007 25,839,664 A..H. --- "C:\WINDOWS.0\SoftwareDistribution\Download\60ca6af11040112be1355236afadeb90\BIT70.tmp"
Thu 22 Nov 2007 0 A..H. --- "C:\WINDOWS.0\SoftwareDistribution\Download\cc102203f99c8c6ebf1523556f8411b6\BIT1.tmp"

Finished!

et le rapport de HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:37:52, on 14/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\WINDOWS.0\system32\notepad.exe
C:\WINDOWS.0\system32\notepad.exe
C:\WINDOWS.0\system32\igfxtray.exe
C:\WINDOWS.0\system32\hkcmd.exe
C:\WINDOWS.0\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\DOCUME~1\ADMINI~1\APPLIC~1\TSKS~1\javaw.exe
C:\WINDOWS.0\??stem\w?nword.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\WINDOWS.0\system32\wuauclt.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {98DC32FA-8445-F0C0-119A-D68F71782F96} - C:\WINDOWS.0\system32\aehh.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS.0\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS.0\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Roce] "C:\DOCUME~1\ADMINI~1\APPLIC~1\TSKS~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [Vxvy] C:\WINDOWS.0\??stem\w?nword.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlhr] RunDll32.exe %SystemRoot%\System32\AdvPack.Dll,LaunchINFSection %SystemRoot%\inf\nlite.inf,C (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 5780 bytes

Re

• Télécharge antivir http://www.clubic.com/telecharger-fiche10821-antivir-personal-edition-7.html

• Fais un scan avec antivir pour cela

Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier. Choisi ta session et pas celle de l'administrateur.

- Ouvre antivir par le menu Démarrer / Programmes
- Clique sur l'onglet Scanner.
- Sélectionne Manual Selection
- Sélectionne sur le disque C
- Lance le scan
- Mettez les élements infectieux détectés en quarantaine via le bouton "move to quarantine, vous pouvez cocher la case "apply selection to all following detection" afin qu'antivir déplace tous les éléments infections suivants automatiquement.

Poste le rapport d'antivir

bonjour desoler pour hier soir mes l'analyse a mit du temps voila le rapport de lanti virus:

AntiVir PersonalEdition Classic
Report file date: lundi 14 avril 2008 22:30

Scanning for 835736 virus strains and unwanted programs.

Licensed to: Avira antivir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Administrateur
Computer name: EMILIE

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 13:26:55
ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 13:27:04
ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 13:27:13
AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 16:43:56
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 07:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:21

Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan Memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: lundi 14 avril 2008 22:30

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
11 processes with 11 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '32' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Administrateur\alugbt.MSNFix
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '4878bf53.qua'!
C:\Documents and Settings\Administrateur\dqhofo.MSNFix
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '486bbf58.qua'!
C:\Documents and Settings\Administrateur\Bureau\catchme.zip
[0] Archive type: ZIP
--> %0e+000xe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '4877bf8c.qua'!
C:\Documents and Settings\Administrateur\Bureau\MSNFix\14042008_21142713.zip
[0] Archive type: ZIP
--> backup/alugbt.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/dqhofo.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/eipdiu.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/jimnug.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/lrahcl.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/mnbtcw.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/mrofinu1423.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/mrofinu1423.exe.tmp
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/oyiazp.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/rdmkiy.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/rrhtih.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/sejowv.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/sgjxls.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '4833c0c7.qua'!
C:\Documents and Settings\Administrateur\Bureau\SDFix\backups\backups.zip
[0] Archive type: ZIP
--> backups/17PHolmes1423.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backups/eipdiu.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backups/jimnug.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backups/lrahcl.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backups/mnbtcw.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backups/oyiazp.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backups/rdmkiy.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backups/rrhtih.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backups/sejowv.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backups/sgjxls.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backups/Yazzle1560OinAdmin.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '4866c0fd.qua'!
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\NABQ01T3\17PHolmes[1].cmt
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '4853c129.qua'!
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\UU4CD94R\wv[1].exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '485ec18c.qua'!
C:\Program Files\Navilog1\navilog1.bat
[DETECTION] Contains suspicious code HEUR/Exploit.HTML
[INFO] The file was moved to '4879c63d.qua'!
C:\WINDOWS.0\mrofinu1423.exe.MSNFix
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '4872cb29.qua'!
C:\WINDOWS.0\mrofinu1423.MSNFix
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '49fbf4fa.qua'!
C:\WINDOWS.0\system32\drivers\sptd.sys
[WARNING] The file could not be opened!

End of the scan: lundi 14 avril 2008 23:42
Used time: 1:11:46 min

The scan has been done completely.

4228 Scanning directories
248414 Files were scanned
30 viruses and/or unwanted programs were found
2 Files were classified as suspicious:
0 files were deleted
0 files were repaired
10 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
248384 Files not concerned
1841 Archives were scanned
2 Warnings
3 Notes

Bonjour

Passe ton IE 6 à la version IE7 et mets à jour ton système poste en suite un nouveau rapport HijackThis

Bonjour

Peux-tu décrire, plus, ta panne stp !

Les manipulations que l'on a faites ne provoquent pas de pannes

bonjour je decrit la panne

japuit sur le bouton pour allumer l'ordinateur il s'allume met l'ecran et tout noir il y a rien du tout et rien ne ce passe

merci

bonjour astucien

je vous envoie ce mail pour vous dire que l'ordinateur c'est rallumer comme sa j'ai rien fait de special il c'est mit a fonctioné

pour finir je vouler savoir si il y a dautre choze a faire ou non pour finir avec mon problem de virus

merci

Bonjour

poste un nouveau rapport HijackThis stp

voici le rapport hijackithis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:57:24, on 01/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\WINDOWS.0\system32\igfxtray.exe
C:\WINDOWS.0\system32\hkcmd.exe
C:\WINDOWS.0\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS.0\??stem\w?nword.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS.0\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {98DC32FA-8445-F0C0-119A-D68F71782F96} - C:\WINDOWS.0\system32\aehh.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS.0\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS.0\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Roce] "C:\DOCUME~1\ADMINI~1\APPLIC~1\TSKS~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [Vxvy] C:\WINDOWS.0\??stem\w?nword.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlhr] RunDll32.exe %SystemRoot%\System32\AdvPack.Dll,LaunchINFSection %SystemRoot%\inf\nlite.inf,C (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: antivir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: antivir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 6465 bytes

Bonjour

Il y a effectivement du travail

• Désactive les logiciels de protection (Antivirus, Antispywares)

• Télécharge : combofix.exe (sUBs)

• Sauvegarde le sur ton bureau et pas ailleurs!

• Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider.

• Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

• Poste un nouveau rapport HijackThis aussi.

bonjour je vous envoi les rapport demender ,c'est le rapport de combofix:

ComboFix 08-04-29.5 - Administrateur 2008-05-01 20:47:05.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.141 [GMT 2:00]
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrateur\Application Data\TSKS~1
C:\Documents and Settings\Administrateur\Application Data\TSKS~1\T?sks\
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\CPV.stt
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Outerinfo
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Outerinfo\Terms.lnk
C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Outerinfo\Uninstall.lnk
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\Terms.rtf
C:\WINDOWS.0\stem~1
C:\WINDOWS.0\stem~1\w?nword.exe
C:\WINDOWS.0\system32\aehh.dll
C:\WINDOWS.0\system32\drivers\npf.sys
C:\WINDOWS.0\system32\Packet.dll
C:\WINDOWS.0\system32\WanPacket.dll
C:\WINDOWS.0\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-01 to 2008-05-01 ))))))))))))))))))))))))))))))))))))
.

2008-05-01 20:46 . 2008-05-01 20:46 1,024 --ah----- C:\Documents and Settings\Default User.WINDOWS.0\ntuser.dat.LOG
2008-04-30 22:23 . 2008-04-30 22:23 268 --ah----- C:\sqmdata02.sqm
2008-04-30 22:23 . 2008-04-30 22:23 244 --ah----- C:\sqmnoopt02.sqm
2008-04-30 13:59 . 2008-04-30 13:59 268 --ah----- C:\sqmdata01.sqm
2008-04-30 13:59 . 2008-04-30 13:59 244 --ah----- C:\sqmnoopt01.sqm
2008-04-14 22:15 . 2008-04-14 22:15 <REP> d-------- C:\Program Files\Avira
2008-04-14 22:15 . 2008-04-14 22:15 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Avira
2008-04-14 21:01 . 2008-04-14 21:02 <REP> d-------- C:\WINDOWS.0\ERUNT
2008-04-14 20:13 . 2008-04-14 05:40 <REP> d-------- C:\SDFix
2008-04-14 15:01 . 2008-04-14 15:01 9,662 --a------ C:\WINDOWS.0\system32\ZoneAlarmIconFR.ico
2008-04-13 22:15 . 2008-04-13 22:15 244 --ah----- C:\sqmnoopt00.sqm
2008-04-13 22:15 . 2008-04-13 22:15 232 --ah----- C:\sqmdata00.sqm
2008-04-13 22:15 . 2008-04-13 22:15 0 --a------ C:\WINDOWS.0\system32\real.MSNFix
2008-04-13 21:41 . 2008-04-13 21:41 <REP> d-------- C:\Program Files\Trend Micro
2008-04-13 21:20 . 2008-04-14 23:00 <REP> d-------- C:\Program Files\Navilog1
2008-04-13 12:15 . 2008-04-13 12:18 <REP> d-------- C:\Program Files\Inet_Get_2
2008-04-12 20:58 . 2008-04-12 20:58 <REP> d-------- C:\WINDOWS.0\system32\AVGUARD_4803e887
2008-04-12 17:56 . 2008-04-12 17:56 <REP> d-------- C:\WINDOWS.0\system32\AVGUARD_480a3837
2008-04-12 10:51 . 2008-04-12 11:01 <REP> d-------- C:\WINDOWS.0\system32\AVGUARD_4804e513
2008-04-12 10:43 . 2008-04-12 10:43 <REP> d-------- C:\WINDOWS.0\system32\AVGUARD_48054f96
2008-04-11 22:42 . 2008-05-01 20:46 1,024 --ah----- C:\WINDOWS.0\system32\config\systemprofile\NtUser.dat.LOG
2008-04-07 20:07 . 2008-04-07 20:07 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-07 10: